From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 51784 invoked by alias); 17 Aug 2015 08:25:34 -0000 Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-bugs-owner@gcc.gnu.org Received: (qmail 51709 invoked by uid 48); 17 Aug 2015 08:25:30 -0000 From: "rguenth at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug tree-optimization/67221] [6 Regression] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1) Date: Mon, 17 Aug 2015 08:25:00 -0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: tree-optimization X-Bugzilla-Version: 6.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: rguenth at gcc dot gnu.org X-Bugzilla-Status: ASSIGNED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: rguenth at gcc dot gnu.org X-Bugzilla-Target-Milestone: 6.0 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-SW-Source: 2015-08/txt/msg01099.txt.bz2 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221 --- Comment #5 from Richard Biener --- Ok, so we have e_17 = e_3 + 1; and e_3 value-numbers to e_17 (for some reason). match-and-simplify then recursively matches ((e_3 + 1) + 1) + 1 ... Visiting BB 8 SCC consists of: e_3 e_17 Starting iteration 1 Value numbering e_3 stmt = e_3 = PHI <0(5), e_17(8)> Setting value number of e_3 to c_2 (changed) Value numbering e_17 stmt = e_17 = e_3 + 1; Setting value number of e_17 to e_17 (changed) Starting iteration 2 Value numbering e_3 stmt = e_3 = PHI <0(5), e_17(8)> Setting value number of e_3 to e_17 (changed) Oops. This isn't supposed to happen. Ok - so the only executable edge is the backedge here (should have catched that block as unexecutable, sth to fix as well). Hmm, we only forbid a VARING -> non-VARYING lattice transition, not a transition from one value to another. Fishy. Of course even with the old PHI value-numbering we should have arrived at e_3 == e_17 and the very same problem (problem being using the backedge value as "same val" and the entry edge not executable). Value numbering e_17 stmt = e_17 = e_3 + 1; So the workaround I am installing is to mark backedges into unreachable blocks unexecutable as well. Still the reason the def of e_17 is not found unreachable is (again) in sub-optimal visiting order of the DOM walk :(