[Bug ipa/64550] New: IPA fixes cause ICE in tree-ssa.c:939

[Bug ipa/64550] New: IPA fixes cause ICE in tree-ssa.c:939

[anton at samba dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64550

            Bug ID: 64550
           Summary: IPA fixes cause ICE in tree-ssa.c:939
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: anton at samba dot org

I just hit the following ICE on our autobuilder:


/var/lib/jenkins/workspace/gcc_kernel_build/linux/net/core/dev.c: In function
‘dev_change_net_namespace.part.23’:
/var/lib/jenkins/workspace/gcc_kernel_build/linux/net/core/dev.c:7435:1:
internal compiler error: in verify_ssa, at tree-ssa.c:939
 subsys_initcall(net_dev_init);
 ^
0x10a5c9c7 verify_ssa(bool, bool)
        ../../gcc/gcc/tree-ssa.c:939
0x1070531b execute_function_todo
        ../../gcc/gcc/passes.c:1947
0x10705f63 do_per_function
        ../../gcc/gcc/passes.c:1639
0x10706127 execute_todo
        ../../gcc/gcc/passes.c:1997
Please submit a full bug report,


The two changes are:


Commit 04478c40f34f1b104f0281393b950020ddafdf82 by marxin
Fix for ipa/PR64503

    PR ipa/64503
    * sreal.c (sreal::dump): Change unsigned format to signed for
    m_exp value.
    (sreal::to_double): Replace exp2 with scalbln.



git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@219378
138bc75d-0d04-0410-961f-82ee72b054a4


and:


Commit 05e3f0539fbe21709229cd34e1fa0d6ead1b0d2f by marxin
IPA ICF: compare_operand is split to multiple functions.

    * ipa-icf-gimple.c (func_checker::compare_ssa_name): Enhance SSA
    name comparison.
    (func_checker::compare_memory_operand): New function.
    (func_checker::compare_operand): Split case to newly
    added functions.
    (func_checker::compare_cst_or_decl): New function.
    (func_checker::compare_gimple_call): Identify
    memory operands.
    (func_checker::compare_gimple_assign): Likewise.
    * ipa-icf-gimple.h: New function.
>From gcc-bugs-return-472612-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Jan 09 13:07:58 2015
Return-Path: <gcc-bugs-return-472612-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 9356 invoked by alias); 9 Jan 2015 13:07:58 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 9317 invoked by uid 48); 9 Jan 2015 13:07:54 -0000
From: "anton at samba dot org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/64550] [5 Regression] IPA fixes cause ICE in tree-ssa.c:939
Date: Fri, 09 Jan 2015 13:07:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: anton at samba dot org
X-Bugzilla-Status: WAITING
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: marxin at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-64550-4-bbAHyjLMk3@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-64550-4@http.gcc.gnu.org/bugzilla/>
References: <bug-64550-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-01/txt/msg00606.txt.bz2
Content-length: 224

https://gcc.gnu.org/bugzilla/show_bug.cgi?idd550

--- Comment #2 from Anton Blanchard <anton at samba dot org> ---
The testcase in bug #64090 hits it, but for some reason the testcase in the bug
it was duped to does not.

[Bug ipa/64550] [5 Regression] IPA fixes cause ICE in tree-ssa.c:939

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64550

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2015-01-09
   Target Milestone|---                         |5.0
            Summary|IPA fixes cause ICE in      |[5 Regression] IPA fixes
                   |tree-ssa.c:939              |cause ICE in tree-ssa.c:939
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Can you attach preprocessed source please?

[Bug ipa/64550] [5 Regression] IPA fixes cause ICE in tree-ssa.c:939

[marxin at gcc dot gnu.org]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="UTF-8", Size: 10711 bytes --]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64550

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
The problem is hidden in missing volatile side-effect comparison for:

# VUSE <.MEM_5(D)>
__mptr_8 ={v} _17->first;
(gdb) call debug_gimple_stmt(s2)
# VUSE <.MEM_5(D)>
__mptr_8 = _17->first;

where compare_memory_operand is called for:

 <component_ref 0x7ffff6d65ed0
    type <pointer_type 0x7ffff6d54bd0
        type <record_type 0x7ffff6d54b28 __hlist_node type_0 TI
            size <integer_cst 0x7ffff6c36cf0 constant 128>
            unit size <integer_cst 0x7ffff6c36d08 constant 16>
            align 64 symtab 0 alias set 5 canonical type 0x7ffff6d54b28 fields
<field_decl 0x7ffff6c5aed8 next> context <translation_unit_decl 0x7ffff7fee3c0
D.1890>
            pointer_to_this <pointer_type 0x7ffff6d54bd0> chain <type_decl
0x7ffff6c5ada8 D.1830>>
        sizes-gimplified public unsigned DI
        size <integer_cst 0x7ffff6c36ca8 constant 64>
        unit size <integer_cst 0x7ffff6c36cc0 constant 8>
        align 64 symtab 0 alias set 3 canonical type 0x7ffff6d54bd0
        pointer_to_this <pointer_type 0x7ffff6d54c78>>
    side-effects volatile
    arg 0 <mem_ref 0x7ffff6d70f78
        type <record_type 0x7ffff6d54a80 __hlist_head type_0 DI size
<integer_cst 0x7ffff6c36ca8 64> unit size <integer_cst 0x7ffff6c36cc0 8>
            align 64 symtab 0 alias set 4 canonical type 0x7ffff6d54a80 fields
<field_decl 0x7ffff6c5ae40 first> context <translation_unit_decl 0x7ffff7fee3c0
D.1890>
            pointer_to_this <pointer_type 0x7ffff6d54dc8> chain <type_decl
0x7ffff6c5ad10 D.1829>>

        arg 0 <ssa_name 0x7ffff6d83288 type <pointer_type 0x7ffff6d54dc8>
            visiteddef_stmt _17 = _13 + _16;

            version 17
            ptr-info 0x7ffff6d71750>
        arg 1 <integer_cst 0x7ffff6d71078 constant 0>
        /home/marxin/Programming/testcases/ppc64-linux-bug.c:41:664>
    arg 1 <field_decl 0x7ffff6c5ae40 first type <pointer_type 0x7ffff6d54bd0>
        unsigned DI file /home/marxin/Programming/testcases/ppc64-linux-bug.c
line 2 col 23 size <integer_cst 0x7ffff6c36ca8 64> unit size <integer_cst
0x7ffff6c36cc0 8>
        align 64 offset_align 128
        offset <integer_cst 0x7ffff6c36cd8 constant 0>
        bit offset <integer_cst 0x7ffff6c36d20 constant 0> context <record_type
0x7ffff6d54a80 __hlist_head>>
    /home/marxin/Programming/testcases/ppc64-linux-bug.c:41:630>

Where volatile is correctly set, but after refactoring our volatile comparison
is based on result of ao_ref_base which is:
<mem_ref 0x7ffff6d70f78

Shouldn't be Richard TREE_THIS_VOLATILE called for arguments given to
func_checker::compare_memory_operand function in case we know it's a memory
reference?
Thanks,
Martin
>From gcc-bugs-return-472620-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Jan 09 14:29:55 2015
Return-Path: <gcc-bugs-return-472620-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 10422 invoked by alias); 9 Jan 2015 14:29:55 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 10390 invoked by uid 48); 9 Jan 2015 14:29:50 -0000
From: "marxin at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/64550] [5 Regression] IPA fixes cause ICE in tree-ssa.c:939
Date: Fri, 09 Jan 2015 14:29:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: marxin at gcc dot gnu.org
X-Bugzilla-Status: WAITING
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: marxin at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-64550-4-Jo9SII8n2s@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-64550-4@http.gcc.gnu.org/bugzilla/>
References: <bug-64550-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-01/txt/msg00614.txt.bz2
Content-length: 720

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64550

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Suggested patch:

diff --git a/gcc/ipa-icf-gimple.c b/gcc/ipa-icf-gimple.c
index 9cb7bc3..7e3b1dd 100644
--- a/gcc/ipa-icf-gimple.c
+++ b/gcc/ipa-icf-gimple.c
@@ -260,7 +260,7 @@ func_checker::compare_memory_operand (tree t1, tree t2)
   /* Compare alias sets for memory operands.  */
   if (source_is_memop && target_is_memop)
     {
-      if (TREE_THIS_VOLATILE (b1) != TREE_THIS_VOLATILE (b2))
+      if (TREE_THIS_VOLATILE (t1) != TREE_THIS_VOLATILE (t2))
     return return_false_with_msg ("different operand volatility");

       if (ao_ref_alias_set (&r1) != ao_ref_alias_set (&r2)
>From gcc-bugs-return-472621-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Jan 09 14:37:43 2015
Return-Path: <gcc-bugs-return-472621-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 18440 invoked by alias); 9 Jan 2015 14:37:42 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 18196 invoked by uid 48); 9 Jan 2015 14:37:37 -0000
From: "ubizjak at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/64551] New: Segfault in target_opts_for_fn (from ipa_icf::sem_function::equals_private)
Date: Fri, 09 Jan 2015 14:37:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: ubizjak at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cf_gcctarget attachments.created
Message-ID: <bug-64551-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-01/txt/msg00615.txt.bz2
Content-length: 3517

https://gcc.gnu.org/bugzilla/show_bug.cgi?idd551

            Bug ID: 64551
           Summary: Segfault in target_opts_for_fn (from
                    ipa_icf::sem_function::equals_private)
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: ubizjak at gmail dot com
            Target: alpha-linux-gnu

Created attachment 34413
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id4413&actioníit
Preprocessed source

Recently introduced problem.

Segfault can be triggered with attached testcase for --target=alpha-linux-gnu
configured crosscompiler:

~/gcc-build-alpha/gcc/cc1 -O2 -fpreprocessed -quiet -o aaa unwind-dw2.i

../../../gcc-svn/trunk/libgcc/unwind-dw2.c:1695:0: internal compiler error:
Segmentation fault
0xa7d66f crash_signal
        /home/uros/gcc-svn/trunk/gcc/toplev.c:366
0xed5757 tree_check
        /home/uros/gcc-svn/trunk/gcc/tree.h:2778
0xed5757 target_opts_for_fn
        /home/uros/gcc-svn/trunk/gcc/tree.h:4681
0xed5757 ipa_icf::sem_function::equals_private(ipa_icf::sem_item*,
hash_map<symtab_node*, ipa_icf::sem_item*, default_hashmap_traits>&)
        /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:431
0xed6407 ipa_icf::sem_function::equals(ipa_icf::sem_item*,
hash_map<symtab_node*, ipa_icf::sem_item*, default_hashmap_traits>&)
        /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:386
0xed4d1a ipa_icf::sem_item_optimizer::subdivide_classes_by_equality(bool)
        /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:1893
0xed7466 ipa_icf::sem_item_optimizer::execute()
        /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:1712
0xed74f1 ipa_icf_driver
        /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:2441


gdb session:

Program received signal SIGSEGV, Segmentation fault.
target_opts_for_fn (fndecl=<optimized out>) at
/home/uros/gcc-svn/trunk/gcc/tree.h:4681
4681      return TREE_TARGET_OPTION (fn_opts);
(gdb) bt
#0  target_opts_for_fn (fndecl=<optimized out>) at
/home/uros/gcc-svn/trunk/gcc/tree.h:4681
#1  ipa_icf::sem_function::equals_private (this=0x151b080, item=<optimized
out>, ignored_nodes=...)
    at /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:431
#2  0x0000000000ed6408 in ipa_icf::sem_function::equals (this=0x151b080,
item=0x0, ignored_nodes=...)
    at /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:386
#3  0x0000000000ed4d1b in
ipa_icf::sem_item_optimizer::subdivide_classes_by_equality (this=0x1522370,
in_wpaúlse)
    at /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:1893
#4  0x0000000000ed7467 in ipa_icf::sem_item_optimizer::execute (this=0x1522370)
at /home/uros/gcc-svn/trunk/gcc/ipa-icf.c:1712
#5  0x0000000000ed74f2 in ipa_icf::ipa_icf_driver () at
/home/uros/gcc-svn/trunk/gcc/ipa-icf.c:2441
#6  0x00000000009bf8e3 in execute_one_pass (pass=0x14a9590) at
/home/uros/gcc-svn/trunk/gcc/passes.c:2311
#7  0x00000000009bfe16 in execute_ipa_pass_list (pass=0x14a9590) at
/home/uros/gcc-svn/trunk/gcc/passes.c:2708
#8  0x000000000068f79a in ipa_passes () at
/home/uros/gcc-svn/trunk/gcc/cgraphunit.c:2124
#9  symbol_table::compile (this=0x2aaaae7ad000) at
/home/uros/gcc-svn/trunk/gcc/cgraphunit.c:2212

fn_opts is NULL at the call site (line 4681).

(gdb) list
4676    target_opts_for_fn (const_tree fndecl)
4677    {
4678      tree fn_opts = DECL_FUNCTION_SPECIFIC_TARGET (fndecl);
4679      if (fn_opts == NULL_TREE)
4680        fn_opts = target_option_default_node;
4681      return TREE_TARGET_OPTION (fn_opts);
4682    }

[Bug ipa/64550] [5 Regression] IPA fixes cause ICE in tree-ssa.c:939

[anton at samba dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64550

--- Comment #5 from Anton Blanchard <anton at samba dot org> ---
Thanks Martin, the patch fixes the issue for me.

[Bug ipa/64550] [5 Regression] IPA fixes cause ICE in tree-ssa.c:939

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64550

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|---                         |FIXED