[Bug middle-end/65735] New: [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c) on arm-linux-gnueabihf

[Bug middle-end/65735] New: [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c) on arm-linux-gnueabihf

[doko at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

            Bug ID: 65735
           Summary: [5 Regression] ICE (in duplicate_thread_path, at
                    tree-ssa-threadupdate.c) on arm-linux-gnueabihf
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: doko at gcc dot gnu.org

Created attachment 35290
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35290&action=edit
preprocessed source

seen with r221867 on arm-linux-gnueabihf

$ g++ -c -g -O2 menu.ii 
menu.ii: In function 'void fn2()':
menu.ii:2:6: internal compiler error: in duplicate_thread_path, at
tree-ssa-threadupdate.c:2445
 void fn2() {
      ^
0x7c2d8f duplicate_thread_path
        ../../src/gcc/tree-ssa-threadupdate.c:2444
0x7c2d8f thread_through_all_blocks(bool)
        ../../src/gcc/tree-ssa-threadupdate.c:2594
0x74020d execute
        ../../src/gcc/tree-ssa-dom.c:938
Please submit a full bug report,
with preprocessed source if appropriate.

$ cat menu.ii
int fn1();
void fn2() {
  int a, b, c;
  while (!a) {
    c = fn1();
    if (c == 7)
      c = b;
    switch (c) {
    case 1:
      a = b++;
      if (b)
        b = 1;
    }
  }
}

$ g++ -v
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/arm-linux-gnueabihf/5/lto-wrapper
Target: arm-linux-gnueabihf
Configured with: ../src/configure -v --with-pkgversion='Ubuntu
5-20150404-0ubuntu11' --with-bugurl=file:///usr/share/doc/gcc-5/README.Bugs
--enable-languages=c,ada,c++,java,go,fortran,objc,obj-c++ --prefix=/usr
--program-suffix=-5 --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu
--enable-libstdcxx-debug --enable-libstdcxx-time=yes
--with-default-libstdcxx-abi=c++98 --enable-gnu-unique-object --disable-libitm
--disable-libquadmath --enable-plugin --with-system-zlib
--disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo
--with-java-home=/usr/lib/jvm/java-1.5.0-gcj-5-armhf/jre --enable-java-home
--with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-5-armhf
--with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-5-armhf
--with-arch-directory=arm --with-ecj-jar=/usr/share/java/eclipse-ecj.jar
--enable-objc-gc --enable-multiarch --enable-multilib --disable-sjlj-exceptions
--with-arch=armv7-a --with-fpu=vfpv3-d16 --with-float=hard --with-mode=thumb
--disable-werror --enable-multilib --enable-checking=yes
--build=arm-linux-gnueabihf --host=arm-linux-gnueabihf
--target=arm-linux-gnueabihf
Thread model: posix
gcc version 5.0.0 20150404 (experimental) [trunk revision 221867] (Ubuntu
5-20150404-0ubuntu11)

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[doko at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

Matthias Klose <doko at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|arm-linux-gnueabihf         |
            Summary|[5 Regression] ICE (in      |[5 Regression] ICE (in
                   |duplicate_thread_path, at   |duplicate_thread_path, at
                   |tree-ssa-threadupdate.c) on |tree-ssa-threadupdate.c)
                   |arm-linux-gnueabihf         |

--- Comment #1 from Matthias Klose <doko at gcc dot gnu.org> ---
fails on x86_64-linux-gnu too.

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-04-10
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |law at gcc dot gnu.org,
                   |                            |spop at gcc dot gnu.org
   Target Milestone|---                         |5.0
     Ever confirmed|0                           |1

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r221675.

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly cleaned up testcase (so it doesn't use ununinitialized vars).  -O2 is
enough.
The ICE is on:
2443          /* Make sure the successor is the next node in the path.  */
2444          gcc_assert (i + 1 == n_region
2445                  || region_copy[i + 1] == single_succ_edge (bb)->dest);

i is 0, n_region is 5.

int foo (void);

void
bar (int a, int b, int c)
{
  while (!a)
    {
      c = foo ();
      if (c == 7)
    c = b;
      switch (c)
    {
    case 1:
      a = b++;
      if (b)
        b = 1;
    }
    }
}

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #3)
> Slightly cleaned up testcase (so it doesn't use ununinitialized vars).  -O2
> is enough.
> The ICE is on:
> 2443		  /* Make sure the successor is the next node in the path.  */
> 2444		  gcc_assert (i + 1 == n_region
> 2445			      || region_copy[i + 1] == single_succ_edge (bb)->dest);
> 
> i is 0, n_region is 5.
> 
> int foo (void);
> 
> void
> bar (int a, int b, int c)
> {
>   while (!a)
>     {
>       c = foo ();
>       if (c == 7)
> 	c = b;
>       switch (c)
> 	{
> 	case 1:
> 	  a = b++;
> 	  if (b)
> 	    b = 1;
> 	}
>     }
> }

Don't know anything about the FSM code, but in the second
thread_through_all_blocks
the first path looks like:
(gdb) p *paths.m_vec->m_vecdata[0].m_vec->m_vecdata[0]
$127 = {e = <edge 0x7ffff18669a0 (9 -> 4)>, type = EDGE_FSM_THREAD}
(gdb) p *paths.m_vec->m_vecdata[0].m_vec->m_vecdata[1]
$128 = {e = <edge 0x7ffff1866850 (4 -> 5)>, type = EDGE_FSM_THREAD}
(gdb) p *paths.m_vec->m_vecdata[0].m_vec->m_vecdata[2]
$129 = {e = <edge 0x7ffff1866498 (5 -> 12)>, type = EDGE_FSM_THREAD}
(gdb) p *paths.m_vec->m_vecdata[0].m_vec->m_vecdata[3]
$130 = {e = <edge 0x7ffff18665b0 (12 -> 14)>, type = EDGE_FSM_THREAD}
(gdb) p *paths.m_vec->m_vecdata[0].m_vec->m_vecdata[4]
$131 = {e = <edge 0x7ffff18663f0 (14 -> 5)>, type = EDGE_FSM_THREAD}
(gdb) p *paths.m_vec->m_vecdata[0].m_vec->m_vecdata[5]
$132 = {e = <edge 0x7ffff1866498 (5 -> 12)>, type = EDGE_NO_COPY_SRC_BLOCK}
Having the same block (bb5) twice in the path sounds really suspicious to me.

Guess a quick hack could be to check for bbs appearing more than once in
valid_jump_thread_path.  Dunno if bb->flags & BB_VISITED could be used for
that.
>From gcc-bugs-return-483390-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Sat Apr 11 10:17:00 2015
Return-Path: <gcc-bugs-return-483390-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 82840 invoked by alias); 11 Apr 2015 10:17:00 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 82776 invoked by uid 48); 11 Apr 2015 10:16:56 -0000
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)
Date: Sat, 11 Apr 2015 10:17:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: ice-on-valid-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-65735-4-4wap7l8r7S@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-65735-4@http.gcc.gnu.org/bugzilla/>
References: <bug-65735-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-04/txt/msg00942.txt.bz2
Content-length: 1662

https://gcc.gnu.org/bugzilla/show_bug.cgi?ide735

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It shows up already when registering the path:
  Registering FSM jump thread: (9, 4) incoming edge;  (4, 5)  (5, 12)  (12, 14)
 (14, 5)  (5, 12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 12) incoming edge;  (12, 14)  (14, 5)  (5,
12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 4) incoming edge;  (4, 5)  (5, 12)  (12, 14)
 (14, 5)  (5, 12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 12) incoming edge;  (12, 14)  (14, 5)  (5,
12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 4) incoming edge;  (4, 5)  (5, 12)  (12, 14)
 (14, 5)  (5, 12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 12) incoming edge;  (12, 14)  (14, 5)  (5,
12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 4) incoming edge;  (4, 5)  (5, 12)  (12, 14)
 (14, 5)  (5, 12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 12) incoming edge;  (12, 14)  (14, 5)  (5,
12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 4) incoming edge;  (4, 5)  (5, 12)  (12, 14)
 (14, 5)  (5, 12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 12) incoming edge;  (12, 14)  (14, 5)  (5,
12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 4) incoming edge;  (4, 5)  (5, 12)  (12, 14)
 (14, 5)  (5, 12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 12) incoming edge;  (12, 14)  (14, 5)  (5,
12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 4) incoming edge;  (4, 5)  (5, 12)  (12, 14)
 (14, 5)  (5, 12) nocopy; (5, 12)
  Registering FSM jump thread: (9, 12) incoming edge;  (12, 14)  (14, 5)  (5,
12) nocopy; (5, 12)

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 35300
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35300&action=edit
gcc5-pr65735.patch

Untested fix.

It seems there is a guard against recursion, but it only checks that we don't
recurse through the same PHI more than once.  But e.g. on the bb5 in the
testcase there are two different PHI nodes, and we walk one of the PHI nodes
first and then walk the other PHI node the second time, which is when we add
the same basic block to the path again.  At least short term, I don't think the
paths with loops in them are really supportable.
Tested so far just on the new testcase and on tree-ssa.exp=*dom*, will do full
bootstrap/regtest momentarily.

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Sat Apr 11 17:32:54 2015
New Revision: 222011

URL: https://gcc.gnu.org/viewcvs?rev=222011&root=gcc&view=rev
Log:
    PR tree-optimization/65735
    * tree-ssa-threadedge.c (fsm_find_control_statement_thread_paths):
    Remove visited_phis argument, add visited_bbs, avoid recursing into the
    same bb rather than just into the same phi node.
    (thread_through_normal_block): Adjust caller.

    * gcc.c-torture/compile/pr65735.c: New test.

Added:
    trunk/gcc/testsuite/gcc.c-torture/compile/pr65735.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-threadedge.c

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.

[Bug middle-end/65735] [5 Regression] ICE (in duplicate_thread_path, at tree-ssa-threadupdate.c)

[yroux at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65735

--- Comment #9 from Yvan Roux <yroux at gcc dot gnu.org> ---
Author: yroux
Date: Wed Oct 28 09:00:47 2015
New Revision: 229478

URL: https://gcc.gnu.org/viewcvs?rev=229478&root=gcc&view=rev
Log:
gcc/
2015-10-28 Yvan Roux  <yvan.roux@linaro.org>
           Sebastian Pop  <s.pop@samsung.com>

        Backport from trunk r221007, r221675, r222011.
        2015-04-11  Jakub Jelinek  <jakub@redhat.com>

        PR tree-optimization/65735
        * tree-ssa-threadedge.c (fsm_find_control_statement_thread_paths):
        Remove visited_phis argument, add visited_bbs, avoid recursing into the
        same bb rather than just into the same phi node.
        (thread_through_normal_block): Adjust caller.

        2015-03-25  Sebastian Pop  <s.pop@samsung.com>

        PR tree-optimization/65177
        * tree-ssa-threadupdate.c (verify_seme): Renamed verify_jump_thread.
        (bb_in_bbs): New.
        (duplicate_seme_region): Renamed duplicate_thread_path.  Redirect all
        edges not adjacent on the path to the original code.

        2015-02-26  Sebastian Pop  <s.pop@samsung.com>

        PR tree-optimization/65048
        * tree-ssa-threadupdate.c (valid_jump_thread_path): New.
        (thread_through_all_blocks): Call valid_jump_thread_path.
        Remove invalid FSM jump-thread paths.

gcc/testsuite/
2015-10-28 Yvan Roux  <yvan.roux@linaro.org>
           Sebastian Pop  <s.pop@samsung.com>

        Backport from trunk r221007, r221675, r222011.
        2015-04-11  Jakub Jelinek  <jakub@redhat.com>

        PR tree-optimization/65735
        * gcc.c-torture/compile/pr65735.c: New test.

        2015-03-25  Sebastian Pop  <s.pop@samsung.com>

        PR tree-optimization/65177
        * gcc.dg/tree-ssa/ssa-dom-thread-10.c: New.

        2015-02-26  Sebastian Pop  <s.pop@samsung.com>

        PR tree-optimization/65048
        * gcc.dg/tree-ssa/ssa-dom-thread-9.c: New.


Added:
   
branches/linaro/gcc-4_9-branch/gcc/testsuite/gcc.c-torture/compile/pr65735.c
   
branches/linaro/gcc-4_9-branch/gcc/testsuite/gcc.dg/tree-ssa/ssa-dom-thread-10.c
   
branches/linaro/gcc-4_9-branch/gcc/testsuite/gcc.dg/tree-ssa/ssa-dom-thread-9.c
Modified:
    branches/linaro/gcc-4_9-branch/gcc/ChangeLog.linaro
    branches/linaro/gcc-4_9-branch/gcc/testsuite/ChangeLog.linaro
    branches/linaro/gcc-4_9-branch/gcc/tree-ssa-threadedge.c
    branches/linaro/gcc-4_9-branch/gcc/tree-ssa-threadupdate.c