[Bug rtl-optimization/67221] New: ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[Bug rtl-optimization/67221] New: ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

            Bug ID: 67221
           Summary: ICE at -Os and above on x86_64-linux-gnu: Segmentation
                    fault (program cc1)
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu
  Target Milestone: ---

The following (valid) code causes an ICE when compiled with the current gcc
trunk at -Os and above on x86_64-linux-gnu in both 32-bit and 64-bit modes.

It is a regression from 5.1.x. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 6.0.0 20150813 (experimental) [trunk revision 226872] (GCC) 
$ 
$ gcc-trunk -O1 -c small.c
$ gcc-5.1 -Os -c small.c
$ 
$ gcc-trunk -Os -c small.c
gcc-trunk: internal compiler error: Segmentation fault (program cc1)
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
$ 


----------------------------------


int a, b;

int
fn1 (int p)
{
  return 0 == 0 ? p : 0;
}

void
fn2 ()
{
  int c = 1, d[1] = { 1 };
lbl:
  for (;;)
    {
      int e;
      c ? 0 : 0 / c;
      c = 0;
      if (fn1 (d[0]))
        break;
      for (e = 0; e < 1; e++)
        for (c = 1; b;)
          {
            if (a)
              break;
            goto lbl;
          }
    }
}

[Bug rtl-optimization/67221] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-08-14
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |6.0
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

[Bug rtl-optimization/67221] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |trippels at gcc dot gnu.org

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Looks like a stack overflow in gimple-match.c.

[Bug rtl-optimization/67221] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r226850.

[Bug tree-optimization/67221] [6 Regression] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
            Summary|ICE at -Os and above on     |[6 Regression] ICE at -Os
                   |x86_64-linux-gnu:           |and above on
                   |Segmentation fault (program |x86_64-linux-gnu:
                   |cc1)                        |Segmentation fault (program
                   |                            |cc1)

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/67221] [6 Regression] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Ok, so we have

e_17 = e_3 + 1;

and e_3 value-numbers to e_17 (for some reason).  match-and-simplify then
recursively matches ((e_3 + 1) + 1) + 1 ...

Visiting BB 8
SCC consists of: e_3 e_17
Starting iteration 1
Value numbering e_3 stmt = e_3 = PHI <0(5), e_17(8)>
Setting value number of e_3 to c_2 (changed)
Value numbering e_17 stmt = e_17 = e_3 + 1;
Setting value number of e_17 to e_17 (changed)
Starting iteration 2
Value numbering e_3 stmt = e_3 = PHI <0(5), e_17(8)>
Setting value number of e_3 to e_17 (changed)

Oops.  This isn't supposed to happen.  Ok - so the only executable edge
is the backedge here (should have catched that block as unexecutable, sth
to fix as well).  Hmm, we only forbid a VARING -> non-VARYING lattice
transition, not a transition from one value to another.  Fishy.
Of course even with the old PHI value-numbering we should have arrived
at e_3 == e_17 and the very same problem (problem being using the backedge
value as "same val" and the entry edge not executable).

Value numbering e_17 stmt = e_17 = e_3 + 1;


So the workaround I am installing is to mark backedges into unreachable
blocks unexecutable as well.  Still the reason the def of e_17 is not
found unreachable is (again) in sub-optimal visiting order of the
DOM walk :(

[Bug tree-optimization/67221] [6 Regression] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Aug 17 14:17:33 2015
New Revision: 226938

URL: https://gcc.gnu.org/viewcvs?rev=226938&root=gcc&view=rev
Log:
2015-08-17  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67221
        * tree-ssa-sccvn.c (visit_phi): Keep all-TOP args TOP.
        (sccvn_dom_walker::before_dom_children): Mark backedges of
        non-executable blocks as not executable.

        * gcc.dg/torture/pr67221.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr67221.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-sccvn.c

[Bug tree-optimization/67221] [6 Regression] ICE at -Os and above on x86_64-linux-gnu: Segmentation fault (program cc1)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67221

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.