[Bug c++/60474] New: [regression] Crash in tree_class_check

[Bug c++/60474] New: [regression] Crash in tree_class_check

[jacek at codeweavers dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

            Bug ID: 60474
           Summary: [regression] Crash in tree_class_check
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jacek at codeweavers dot com

Created attachment 32317
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32317&action=edit
test case

Compiling Mozilla sources with current GCC trunk causes ICE. I'm attaching a
simplified test case. I tested on i686-w64-mingw32 target, but it's unlikely to
matter. The crash happens with -O1 optimization level (and no other that I
tried).

$ i686-w64-mingw32-g++ test.i -c -O1
test.i: In function 'void FillBackgroundList(nsAutoTArray<Layer>&,
ComputedValueItem Layer::*, uint32_t) [with ComputedValueItem = unsigned char;
uint32_t = unsigned int]':
test.i:26:1: internal compiler error: Segmentation fault
 FillBackgroundList(nsAutoTArray< Layer> &aLayers,
 ^
0xb48fcf crash_signal
        ../../../gcc-git/gcc/toplev.c:337
0x1061e40 tree_class_check
        ../../../gcc-git/gcc/tree.h:2831
0x1061e40 double_int_ext_for_comb(double_int, aff_tree*)
        ../../../gcc-git/gcc/tree-affine.c:44
0x10624a6 aff_combination_scale(aff_tree*, double_int)
        ../../../gcc-git/gcc/tree-affine.c:86
0xc658a6 difference_cost
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:3896
0xc6a4ba get_computation_cost_at
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:4176
0xc6ce8c get_computation_cost
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:4290
0xc6ce8c determine_use_iv_cost_generic
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:4317
0xc6ce8c determine_use_iv_cost
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:4911
0xc6f090 determine_use_iv_costs
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:5031
0xc6f090 tree_ssa_iv_optimize_loop
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:6849
0xc6f9b3 tree_ssa_iv_optimize()
        ../../../gcc-git/gcc/tree-ssa-loop-ivopts.c:6895
0xc816a7 tree_ssa_loop_ivopts
        ../../../gcc-git/gcc/tree-ssa-loop.c:362
0xc816a7 execute
        ../../../gcc-git/gcc/tree-ssa-loop.c:398

[Bug c++/60474] [4.9 Regression] Crash in tree_class_check

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
      Known to work|                            |4.7.3, 4.8.3
           Keywords|                            |ice-on-valid-code
   Last reconfirmed|                            |2014-03-09
                 CC|                            |trippels at gcc dot gnu.org
     Ever confirmed|0                           |1
            Summary|[regression] Crash in       |[4.9 Regression] Crash in
                   |tree_class_check            |tree_class_check
   Target Milestone|---                         |4.9.0
      Known to fail|                            |4.9.0

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Confirmed.

Further reduced testcase ICEs also on x86_64:

markus@x4 tmp % cat test.ii
struct Layer;
template <typename> struct A
{
  Layer *m_fn1 ();
  Layer &operator[](int p1) { return m_fn1 ()[p1]; }
};
struct Layer
{
};
void fn1 (A<int> &p1, int Layer::*p2, int p3)
{
  for (int a = 0;; ++a, ++p3)
    p1[p3].*p2 = p1[a].*p2;
}

markus@x4 tmp % g++ -O2 -c test.ii
test.ii: In function ‘void fn1(A<int>&, int Layer::*, int)’:
test.ii:10:6: internal compiler error: Segmentation fault
>From gcc-bugs-return-445831-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Sun Mar 09 14:48:49 2014
Return-Path: <gcc-bugs-return-445831-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 25213 invoked by alias); 9 Mar 2014 14:48:48 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 25146 invoked by uid 48); 9 Mar 2014 14:48:43 -0000
From: "bdavis at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug fortran/59746] internal compiler error: Segmentation fault
Date: Sun, 09 Mar 2014 14:48:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: fortran
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords: error-recovery
X-Bugzilla-Severity: normal
X-Bugzilla-Who: bdavis at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-59746-4-p1lVhjG5NS@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-59746-4@http.gcc.gnu.org/bugzilla/>
References: <bug-59746-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-03/txt/msg00700.txt.bz2
Content-length: 166

http://gcc.gnu.org/bugzilla/show_bug.cgi?idY746

--- Comment #4 from Bud Davis <bdavis at gcc dot gnu.org> ---
http://gcc.gnu.org/ml/fortran/2014-03/msg00066.html

[Bug c++/60474] [4.9 Regression] Crash in tree_class_check

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Started with r207239.

[Bug c++/60474] [4.9 Regression] Crash in tree_class_check

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug c++/60474] [4.9 Regression] Crash in tree_class_check

[ktietz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

Kai Tietz <ktietz at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ktietz at gcc dot gnu.org

--- Comment #3 from Kai Tietz <ktietz at gcc dot gnu.org> ---
Issue is that in double_int_ext_for_comb we try to get type-precision of a
comb->type, where type is a NULL_TREE.

[Bug c++/60474] [4.9 Regression] Crash in tree_class_check

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug c++/60474] [4.9 Regression] Crash in tree_class_check

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Mar 10 13:27:16 2014
New Revision: 208451

URL: http://gcc.gnu.org/viewcvs?rev=208451&root=gcc&view=rev
Log:
2014-03-10  Richard Biener  <rguenther@suse.de>

    PR middle-end/60474
    * tree.c (signed_or_unsigned_type_for): Handle OFFSET_TYPEs.

    * g++.dg/torture/pr60474.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr60474.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree.c

[Bug c++/60474] [4.9 Regression] Crash in tree_class_check

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60474

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
                 CC|                            |jakub at gcc dot gnu.org
         Resolution|---                         |FIXED

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.