[Bug tree-optimization/60733] New: ICE by LTO on valid code at -O3 on x86_64-linux-gnu

[Bug tree-optimization/60733] New: ICE by LTO on valid code at -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

            Bug ID: 60733
           Summary: ICE by LTO on valid code at -O3 on x86_64-linux-gnu
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The following code causes an ICE when compiled with the current gcc trunk at
-O3 using LTO on x86_64-linux-gnu (in both 32-bit and 64-bit modes). 

This is a regression from 4.8.x. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 4.9.0 20140401 (experimental) [trunk revision 208971] (GCC) 
$ 
$ gcc-trunk -O3 small.c; a.out
$ gcc-4.8 -flto -O3 small.c; a.out
$ 
$ gcc-trunk -flto -O3 small.c
small.c: In function ‘main’:
small.c:12:1: error: definition in block 10 follows the use
 main ()
 ^
for SSA_NAME: _83 in statement:
slsr_184 = _83 * 65535;
small.c:12:1: internal compiler error: verify_ssa failed
0xa4b70b verify_ssa(bool)
    ../../gcc-trunk/gcc/tree-ssa.c:1096
0x7ee4fc execute_function_todo
    ../../gcc-trunk/gcc/passes.c:1854
0x7eee53 execute_todo
    ../../gcc-trunk/gcc/passes.c:1887
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
lto-wrapper: gcc-trunk returned 1 exit status
/usr/bin/ld: fatal error: lto-wrapper failed
collect2: error: ld returned 1 exit status
$ 


---------------------------------


int a, d, e, f, g, h, i, j, k, l;

unsigned short b;

short
fn1 (int p1, int p2)
{
  return p1 * p2;
}

int
main ()
{
  for (; a; a--)
    {
      int m = 0;
      if (h)
    {
      for (; i;)
        {
          h++;
          e = 0;
          for (;;)
        ;
        }
      for (; m != -6; m--)
        {
          int n[] = {};
          k = fn1 (b--, d);
          for (g = 0; g; g = 1)
        ;
          l = e ? n[0] : 0;
          f ^= 1;
        }
      j = 0;
      for (;;)
        ;
    }
    }
  d = 0;
  return 0;
}
>From gcc-bugs-return-448076-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Apr 01 20:05:32 2014
Return-Path: <gcc-bugs-return-448076-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 30668 invoked by alias); 1 Apr 2014 20:05:32 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 30642 invoked by uid 48); 1 Apr 2014 20:05:29 -0000
From: "su at cs dot ucdavis.edu" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/60733] ICE by LTO on valid code at -O3 on x86_64-linux-gnu
Date: Tue, 01 Apr 2014 20:05:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: su at cs dot ucdavis.edu
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-60733-4-d0sS4YjTdL@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-60733-4@http.gcc.gnu.org/bugzilla/>
References: <bug-60733-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-04/txt/msg00096.txt.bz2
Content-length: 1773

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

--- Comment #1 from Zhendong Su <su at cs dot ucdavis.edu> ---
Here is a variant that causes an ICE even without LTO. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 4.9.0 20140401 (experimental) [trunk revision 208971] (GCC) 
$ 
$ gcc-4.8 -O3 small2.c; a.out
$ 
$ gcc-trunk -O3 small2.c 
small2.c: In function ‘main’:
small2.c:11:1: error: definition in block 12 follows the use
 main ()
 ^
for SSA_NAME: _64 in statement:
slsr_125 = _64 * 65535;
small2.c:11:1: internal compiler error: verify_ssa failed
0xb0b64b verify_ssa(bool)
    ../../gcc-trunk/gcc/tree-ssa.c:1096
0x8ae43c execute_function_todo
    ../../gcc-trunk/gcc/passes.c:1854
0x8aed93 execute_todo
    ../../gcc-trunk/gcc/passes.c:1887
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$   


------------------------------


int a, d, e, f, g, h, i, j, k;
unsigned short b;

short
fn1 (int p1, int p2)
{
  return p1 * p2;
}

int
main ()
{
  for (; a; a--)
    {
      int l = 0;
      if (f >= 0)
    {
      for (; h;)
        e = 0;
      for (; l != -6; l--)
        {
          j = fn1 (b--, d);
          for (g = 0; g; g = 1)
        ;
          k = e ? 2 : 0;
        }
      i = 0;
      for (;;)
        ;
    }
    }
  d = 0;
  return 0;
}
>From gcc-bugs-return-448077-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Apr 01 20:24:14 2014
Return-Path: <gcc-bugs-return-448077-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 5621 invoked by alias); 1 Apr 2014 20:24:14 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 5596 invoked by uid 48); 1 Apr 2014 20:24:08 -0000
From: "trippels at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug libstdc++/60734] New: Undefined behavior in g++-v4/bits/stl_tree.h
Date: Tue, 01 Apr 2014 20:24:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: libstdc++
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: trippels at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter
Message-ID: <bug-60734-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-04/txt/msg00097.txt.bz2
Content-length: 2219

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60734

            Bug ID: 60734
           Summary: Undefined behavior in g++-v4/bits/stl_tree.h
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org

While debugging a gold linker issue I came across the following
-fsanitize=undefined runtime error:

/usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.0/include/g++-v4/bits/stl_tree.h:741:25:
runtime error: downcast of address 0x7fff4c8e1d80 with insufficient space for
an object of type '_Rb_tree_node<std::pair<const std::basic_string<char>,
gold::Output_segment *> >'
0x7fff4c8e1d80: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  d0 2c 8d 02 00 00 00 00  10 2d 8d 02 00
00 00 00  50 2d 8d 02
              ^ 

      iterator
      end() _GLIBCXX_NOEXCEPT
      { return iterator(static_cast<_Link_type>(&this->_M_impl._M_header)); }

The following message: 
http://lists.cs.uiuc.edu/pipermail/cfe-dev/2013-August/031213.html
also points to the issue.

Quote:
» _M_header is an _Rb_tree_node_base, which is smaller than an
_Rb_tree_node<_Tp>. Usually, this would be OK -- you can reinterpret_cast
between pointers of different types pretty much arbitrarily -- but because
_Rb_tree_node_base is a base class of _Rb_tree_node<_Tp>, this is a
static_cast, and the ruling wording is 5.2.9/11, which says " If the
prvalue of type “pointer to cv1 B” points
to a B that is actually a subobject of an object of type D, the resulting
pointer points to the enclosing object of type D. Otherwise, the behavior
is undefined."

We've managed to prove that the prvalue of type "pointer to
_Rb_tree_node_base" is not, in fact, a subobject of type
"_Rb_tree_node<_Tp>", because there's not enough room in the allocated
storage for an object of that type at that address. So we've determined
that the behavior is undefined.

This is a bug in libstdc++. The fix is to use reinterpret_cast instead of
static_cast in the definition of 'end'.«

And indeed this fixes the issue for me.
>From gcc-bugs-return-448078-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Apr 01 21:25:51 2014
Return-Path: <gcc-bugs-return-448078-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 8402 invoked by alias); 1 Apr 2014 21:25:50 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 8353 invoked by uid 48); 1 Apr 2014 21:25:46 -0000
From: "jason at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/60374] [4.7/4.8/4.9 Regression] [c++11] ICE with invalid template specialization
Date: Tue, 01 Apr 2014 21:25:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords: error-recovery, ice-on-invalid-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jason at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P4
X-Bugzilla-Assigned-To: jason at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status resolution target_milestone
Message-ID: <bug-60374-4-7uL0vGTFo9@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-60374-4@http.gcc.gnu.org/bugzilla/>
References: <bug-60374-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-04/txt/msg00098.txt.bz2
Content-length: 484

http://gcc.gnu.org/bugzilla/show_bug.cgi?id`374

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|4.7.4                       |4.9.0

--- Comment #1 from Jason Merrill <jason at gcc dot gnu.org> ---
Fixed for 4.9.

[Bug tree-optimization/60733] [4.9 Regression] ICE due to SLSR on valid code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2014-04-02
   Target Milestone|---                         |4.9.0
            Summary|ICE by LTO on valid code at |[4.9 Regression] ICE due to
                   |-O3 on x86_64-linux-gnu     |SLSR on valid code at -O3
                   |                            |on x86_64-linux-gnu
     Ever confirmed|0                           |1

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed. I'll have a look.

[Bug tree-optimization/60733] [4.9 Regression] ICE due to SLSR on valid code at -O3 on x86_64-linux-gnu

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

--- Comment #4 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Ok, will have a look today.

[Bug tree-optimization/60733] [4.9 Regression] ICE due to SLSR on valid code at -O3 on x86_64-linux-gnu

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

--- Comment #5 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
The logic for placement of initializers for PHI candidates is a bit wrong. 
They should be placed at the end of the feeding block for the PHI.  Currently
they can end up being placed too early, as in this case.  I'm testing a patch.

[Bug tree-optimization/60733] [4.9 Regression] ICE due to SLSR on valid code at -O3 on x86_64-linux-gnu

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

--- Comment #6 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Author: wschmidt
Date: Wed Apr  2 22:07:30 2014
New Revision: 209040

URL: http://gcc.gnu.org/viewcvs?rev=209040&root=gcc&view=rev
Log:
[gcc]

2014-04-02  Bill Schmidt  <wschmidt@linux.vnet.ibm.com>

    PR tree-optimization/60733
    * gimple-ssa-strength-reduction.c (ncd_with_phi): Change required
    insertion point for PHI candidates to be the end of the feeding
    block for the PHI argument.

[gcc/testsuite]

2014-04-02  Bill Schmidt  <wschmidt@linux.vnet.ibm.com>

    PR tree-optimization/60733
    * gcc.dg/torture/pr60733.c:  New test.


Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr60733.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/gimple-ssa-strength-reduction.c
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/60733] [4.9 Regression] ICE due to SLSR on valid code at -O3 on x86_64-linux-gnu

[wschmidt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

Bill Schmidt <wschmidt at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Fixed.  Bug was introduced in 4.9 so no backports are needed.

[Bug tree-optimization/60733] [4.9 Regression] ICE due to SLSR on valid code at -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60733

--- Comment #8 from Zhendong Su <su at cs dot ucdavis.edu> ---
(In reply to Bill Schmidt from comment #7)
> Fixed.  Bug was introduced in 4.9 so no backports are needed.

That's very quick; thanks Bill!