[Bug middle-end/60647] New: [4.8 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[Bug middle-end/60647] New: [4.8 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[doko at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

            Bug ID: 60647
           Summary: [4.8 Regression] ICE in visit_ref_for_mod_analysis, at
                    ipa-prop.c:2112
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: doko at gcc dot gnu.org

Created attachment 32444
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32444&action=edit
preprocessed source

seen with trunk r208764 on x86_64-linux-gnu. 4.8 branch works

$ gcc -c -O2 -c dsdm.i
dsdm.c: In function 'FreeDropSites':
dsdm.c:535:2: warning: incompatible implicit declaration of built-in function
'free'
  free(next);
  ^
dsdm.c: In function 'WriteSiteRectList':
dsdm.c:601:5: warning: incompatible implicit declaration of built-in function
'free'
     free(array);
     ^
dsdm.c: In function 'SubtractWindowFromVisibleRegion.isra.1':
dsdm.c:790:1: internal compiler error: in visit_ref_for_mod_analysis, at
ipa-prop.c:2112
 }
 ^
Please submit a full bug report,
with preprocessed source if appropriate.

[Bug middle-end/60647] [4.8 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-03-25
                 CC|                            |trippels at gcc dot gnu.org
   Target Milestone|---                         |4.9.0
     Ever confirmed|0                           |1

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
markus@x4 tmp % cat test.i
struct _wincore
{
  int y;
  int width;
};
int a;
static fn1 (dpy, winInfo) struct _XDisplay *dpy;
struct _wincore *winInfo;
{
  a = winInfo->width;
  fn2 ();
}

static fn3 (dpy, winInfo, visrgn) struct _XDisplay *dpy;
{
  int b = fn1 (0, winInfo);
  fn4 (0, 0, visrgn);
}

fn5 (event) struct _XEvent *event;
{
  fn3 (0, 0, 0);
}

markus@x4 tmp % gcc -O2 -c test.i
test.i: In function ‘fn3.isra.1’:
test.i:23:1: internal compiler error: in visit_ref_for_mod_analysis, at
ipa-prop.c:2112
>From gcc-bugs-return-447380-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Mar 25 11:12:32 2014
Return-Path: <gcc-bugs-return-447380-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 19197 invoked by alias); 25 Mar 2014 11:12:32 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 19158 invoked by uid 48); 25 Mar 2014 11:12:29 -0000
From: "redi at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/50025] [DR 1288] C++0x initialization syntax doesn't work for class members of reference type
Date: Tue, 25 Mar 2014 11:12:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 4.6.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: redi at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: target_milestone
Message-ID: <bug-50025-4-hajGubw2KQ@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-50025-4@http.gcc.gnu.org/bugzilla/>
References: <bug-50025-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-03/txt/msg02249.txt.bz2
Content-length: 610

http://gcc.gnu.org/bugzilla/show_bug.cgi?idP025

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.0

--- Comment #24 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to __vic from comment #23)
> Is it related bug?

Yes, the original C++11 rules required a temporary to be created there and the
reference member binds to that temporary (which then goes out of scope).

Your code works correctly with GCC 4.9

[Bug middle-end/60647] [4.8 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

[Bug middle-end/60647] [4.8 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

--- Comment #3 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Richard, this started with r207879.

[Bug middle-end/60647] [4.8 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Oh, mine then.

[Bug middle-end/60647] [4.9 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
It's even "wrong-code" it seems.  IPA SRA is confused about the K&R style
functions and

static fn3 (dpy, winInfo, visrgn) struct _XDisplay *dpy;
{
  int b = fn1 (0, winInfo);
  fn4 (0, 0, visrgn);
}

winInfo having type 'int' here.  Not sure how I exposed that with the
patch though ...

At least the testcase is broken.  When I add a proper type to winInfo in fn3
it works.

Martin, do we want to guard IPA SRA against this sort of bogosities?

As of the actual transform it seems that IPA SRA misses to adjust accesses
when it removes unused params ;)  (well, not actually unused ... heh)

That said, can you look into it?  You are more familiar with IPA SRA and
where we'd add a sanity check that argument type and formal parameter type
match (and thus local analysis is valid).

[Bug middle-end/60647] [4.9 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Note the reduced testcase has implicit types, while that isn't necessary to
reproduce this:
struct _wincore
{
  int width, height;
};

static void
foo (dpy, winInfo, offset)
     void *dpy;
     struct _wincore *winInfo;
     int offset;
{
  fn1 (winInfo->height);
}

static void
bar (dpy, winInfo, visrgn)
     void *dpy;
     int winInfo;
     int *visrgn;
{
  foo ((void *) 0, winInfo, 0);
  fn2 (0, 0, visrgn);
}

void
baz (dpy, win, prop)
     void *dpy;
     int win;
     int prop;
{
  bar ((void *) 0, 0, (int *) 0);
}

ICEs in the same spot and:
struct _wincore
{
  int width, height;
};

static void
foo (dpy, winInfo, offset)
     void *dpy;
     struct _wincore *winInfo;
     int offset;
{
  fn1 (winInfo->height);
}

static void
bar (dpy, winInfo, visrgn)
     void *dpy;
     int winInfo;
     int *visrgn;
{
  foo ((void *) 0, winInfo, 0);
  fn2 (visrgn);
}

void
baz (dpy, win, prop)
     void *dpy;
     int win;
     int prop;
{
  bar ((void *) 0, 0, (int *) 0);
}

ICEs during expansion.  And yes, I think IPA-SRA should give up in these cases.

Note even the original testcase looks wrong, there is:
typedef unsigned long XID;
typedef XID Window;
static Region
GetWindowRegion(dpy, winInfo, offset)
    Display *dpy;
    WinGeneric *winInfo;
    int offset;
{
    return MakeRegionFromRect(
 offset ? winInfo->core.x : 0,
 offset ? winInfo->core.y : 0,
 winInfo->core.width,
 winInfo->core.height
    );
}
static void
SubtractWindowFromVisibleRegion(dpy, winInfo, visrgn)
    Display *dpy;
    Window winInfo;
    Region visrgn;
{
    Region winrgn = GetWindowRegion(dpy, winInfo, 1);
    XSubtractRegion(visrgn, winrgn, visrgn);
    XDestroyRegion(winrgn);
}
So, GetWindowRegion is called with unsigned long that is passed to a function
expecting a structure pointer.

[Bug middle-end/60647] [4.9 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Non-K&R that ICEs the same way (with call through incompatible function pointer
type):

struct _wincore
{
  int width, height;
};

static void
foo (void *dpy, struct _wincore *winInfo, int offset)
{
  fn1 (winInfo->height);
}

static void
bar (void *dpy, int winInfo, int *visrgn)
{
  ((void (*) (void *, int, int)) foo) ((void *) 0, winInfo, 0);
  fn2 (0, 0, visrgn);
}

void
baz (void *dpy, int win, int prop)
{
  bar ((void *) 0, 0, (int *) 0);
}

[Bug middle-end/60647] [4.9 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |http://gcc.gnu.org/ml/gcc-p
                   |                            |atches/2014-03/msg01629.htm
                   |                            |l

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I've proposed a fix on the mailing list:

http://gcc.gnu.org/ml/gcc-patches/2014-03/msg01629.html

[Bug middle-end/60647] [4.9 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

--- Comment #9 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Author: jamborm
Date: Mon Mar 31 12:28:33 2014
New Revision: 208957

URL: http://gcc.gnu.org/viewcvs?rev=208957&root=gcc&view=rev
Log:
2014-03-31  Martin Jambor  <mjambor@suse.cz>

    PR middle-end/60647
    * tree-sra.c (callsite_has_enough_arguments_p): Renamed to
    callsite_arguments_match_p.  Updated all callers.  Also check types of
    corresponding formal parameters and actual arguments.
    (not_all_callers_have_enough_arguments_p) Renamed to
    some_callers_have_mismatched_arguments_p.

testsuite/
    * gcc.dg/pr60647-1.c: New test.
    * gcc.dg/pr60647-2.c: Likewise.


Added:
    trunk/gcc/testsuite/gcc.dg/pr60647-1.c
    trunk/gcc/testsuite/gcc.dg/pr60647-2.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-sra.c

[Bug middle-end/60647] [4.9 Regression] ICE in visit_ref_for_mod_analysis, at ipa-prop.c:2112

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60647

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.