[Bug tree-optimization/64326] New: ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[Bug tree-optimization/64326] New: ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

            Bug ID: 64326
           Summary: ICE at -O3 on x86_64-linux-gnu in check_probability,
                    at basic-block.h:581
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The following code causes an ICE when compiled with the current gcc trunk at
-O3 on x86_64-linux-gnu in both 32-bit and 64-bit modes. 

It is a regression from 4.9.x.


$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/5.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 5.0.0 20141215 (experimental) [trunk revision 218731] (GCC) 

$ 
$ gcc-trunk -O2 -c small.c
$ gcc-4.9 -O3 -c small.c
$ 
$ gcc-trunk -O3 -c small.c
small.c: In function ‘fn2’:
small.c:11:1: internal compiler error: in check_probability, at
basic-block.h:581
 fn2 ()
 ^
0xc9da16 check_probability
    ../../gcc-trunk/gcc/basic-block.h:581
0xc9b165 check_probability
    ../../gcc-trunk/gcc/tree.h:2893
0xc9b165 combine_probabilities
    ../../gcc-trunk/gcc/basic-block.h:590
0xc9b165 slpeel_tree_peel_loop_to_edge
    ../../gcc-trunk/gcc/tree-vect-loop-manip.c:1382
0xc9b504 vect_do_peeling_for_loop_bound(_loop_vec_info*, tree_node*,
tree_node*, unsigned int, bool)
    ../../gcc-trunk/gcc/tree-vect-loop-manip.c:1773
0xc8bef7 vect_transform_loop(_loop_vec_info*)
    ../../gcc-trunk/gcc/tree-vect-loop.c:5907
0xcaa3f7 vectorize_loops()
    ../../gcc-trunk/gcc/tree-vectorizer.c:491
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$ 


----------------------------


int a, b, c, d, e, f[5][2];
char g;

int
fn1 ()
{
  return d && c ? 0 : 1;
}

int
fn2 ()
{
  int h;
  for (;;)
    for (; e;)
      {
    int i, j;
    h = a ? 1 : b;
    if (h || fn1 () ^ g - 682)
      {
        for (i = 0; i < 5; i++)
          for (j = 0; j < 2; j++)
        f[i][j] = 0;
        return 0;
      }
      }
}
>From gcc-bugs-return-470839-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Dec 16 08:37:50 2014
Return-Path: <gcc-bugs-return-470839-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 10291 invoked by alias); 16 Dec 2014 08:37:50 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 10257 invoked by uid 48); 16 Dec 2014 08:37:46 -0000
From: "mpolacek at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581
Date: Tue, 16 Dec 2014 08:37:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: mpolacek at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status cf_reconfirmed_on cc target_milestone short_desc everconfirmed
Message-ID: <bug-64326-4-FQxfgSvg4O@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-64326-4@http.gcc.gnu.org/bugzilla/>
References: <bug-64326-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-12/txt/msg01846.txt.bz2
Content-length: 898

https://gcc.gnu.org/bugzilla/show_bug.cgi?idd326

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-12-16
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |5.0
            Summary|ICE at -O3 on               |[5 Regression] ICE at -O3
                   |x86_64-linux-gnu in         |on x86_64-linux-gnu in
                   |check_probability, at       |check_probability, at
                   |basic-block.h:581           |basic-block.h:581
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r211725.

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[tbsaunde at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

tbsaunde at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tbsaunde at gcc dot gnu.org

--- Comment #3 from tbsaunde at gcc dot gnu.org ---
So, in cfghooks.c make_forwarder_block we redirect two edges to point at a bb, 
both edges have probability 1 (10000) the first edge's src bb has freq 873, and
the second 9409.  So at least one of those is slightly high, and when we
combine them we set the freq for dummy to 10282.  Then later we copy that freq
of 10282 and assert because that's not a sane frequency.  Its not entirely
clear to me if make_forwarder_block should handle this case by capping freq at
10000, or if the bug is even earlier when those two initial frequencies are
generated.

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
make_forwarder_block is definitely wrong on not capping. But I do not see how
vectorizing can get us to a frequncy over FREQ_MAX? So probably some earlier
bug in there too

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[tbsaunde at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

--- Comment #5 from tbsaunde at gcc dot gnu.org ---
(In reply to Jan Hubicka from comment #4)
> make_forwarder_block is definitely wrong on not capping. But I do not see
> how vectorizing can get us to a frequncy over FREQ_MAX? So probably some
> earlier bug in there too

ok, I'll send a patch adding capping to make_forwarder_block.  That's enough to
make the testcase not ICE for me, do we care about trying to find the other bug
assuming there is one? or does it make more sense to just hope it goes away
when more frequency stuff uses sreal?

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Hmm, the ICE seems to not reproduce for me :(

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[tbsaunde at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

--- Comment #7 from tbsaunde at gcc dot gnu.org ---
(In reply to Jan Hubicka from comment #6)
> Hmm, the ICE seems to not reproduce for me :(

I can reproduce with r220551, nothing special x86_64-linux-gnu with ./cc1 -O3
test.c

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[tbsaunde at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

--- Comment #8 from tbsaunde at gcc dot gnu.org ---
Author: tbsaunde
Date: Tue Feb 10 14:49:07 2015
New Revision: 220585

URL: https://gcc.gnu.org/viewcvs?rev=220585&root=gcc&view=rev
Log:
cap frequency in make_forwarder_block

In the testcase the block with problematic frequency has to incoming
edges.  Each edge has probability 1.  The first edge's source bb has
frequency 873/10000, and the second has a frequency of 9409/10000.  So
at least one of those is slightly high probably from some sort of rounding
issue related to fixed point, but in any case make_forwarder_block
should not create basic blocks with frequency greater than BB_FREQ_MAX.

gcc/

    PR tree-optimization/64326
    * cfghooks.c (make_forwarder_block): Cap frequency of created
    basic block.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr64326.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/cfghooks.c

[Bug tree-optimization/64326] [5 Regression] ICE at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:581

[tbsaunde at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64326

tbsaunde at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from tbsaunde at gcc dot gnu.org ---
(In reply to Jakub Jelinek from comment #9)
> So fixed?

yes, just didn't get back to this tab yet