[Bug debug/67355] [5 Regression] ICE compiling LTP testcase, endless cselib recursion from var-tracking

[Bug debug/67355] [5 Regression] ICE compiling LTP testcase, endless cselib recursion from var-tracking

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67355

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |i?86-*-*
   Target Milestone|---                         |5.3
            Summary|[5 Regression] ICE          |[5 Regression] ICE
                   |compiling LTP testcase      |compiling LTP testcase,
                   |                            |endless cselib recursion
                   |                            |from var-tracking

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Delta-reduced (w/ includes):

#include <stdio.h>
double pi;
FILE *temp;
static int checkbuf(char *, int, int);
int main(int argc, char *argv[])
{
  register int i, j;
  char buf[100];
  for (i = 0; i < 30; i++)
    for (j = 0; j < 30; j++)
      {
        sprintf(buf, "%*.*f", i, j, pi);
        if (checkbuf(buf, i, j)) {
        }
      }
}
static int checkbuf(char *str, int n1, int n2)
{
  register int bd;
  /* before decimal point */    register int ad;
  /* after decimal point */     register int tw;
  /* total width */     register int dp;
  /* decimal point */   char *buf;
  bd = ad = dp = 0;
  while (*str && *str != '.') {
      bd++;
      str++;
  }
  if (*str == '.') {
      dp++;
      str++;
      if (*str) {
          while (*str) {
              ad++;
              str++;
          }
      }
  }
  tw = bd + dp + ad;
  if (tw < n1) {
      fprintf(temp, "\tWidth too small.\n");
      return (-1);
  }
  if (ad != n2) {
      fprintf(temp, "\tn1 = %d, n2 = %d, buf= '%s'\n", n1, n2, buf);
  }
  return (0);
}


Program received signal SIGSEGV, Segmentation fault.
0x00000000008a1732 in rtx_equal_for_cselib_1 (x=0x7ffff687c810, 
    y=0x7ffff687c7f8, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:1022
1022                  && targetm.commutative_p (x, UNKNOWN)
Missing separate debuginfos, use: zypper install
libgmp10-debuginfo-6.0.0-71.1.x86_64 libisl13-debuginfo-0.14-25.2.x86_64
libmpc3-debuginfo-1.0.2-38.2.x86_64 libmpfr4-debuginfo-3.1.2-3.1.2.x86_64
(gdb) bt
#0  0x00000000008a1732 in rtx_equal_for_cselib_1 (x=0x7ffff687c810, 
    y=0x7ffff687c7f8, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:1022
#1  0x00000000008a12bf in rtx_equal_for_cselib_1 (x=0x7ffff687c810, 
    y=0x235e920, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:924
#2  0x00000000008a17dd in rtx_equal_for_cselib_1 (x=0x7ffff687c7f8, 
    y=0x7ffff687c810, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:1026
#3  0x00000000008a1206 in rtx_equal_for_cselib_1 (x=0x235e920, 
    y=0x7ffff687c810, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:907
... (endless recursion)

entered via

#59 0x00000000008a1206 in rtx_equal_for_cselib_1 (x=0x235e938, 
    y=0x7ffff687c978, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:907
#60 0x00000000008a5b82 in cselib_hasher::equal (v=0x2294170, 
    x_arg=0x7fffffffbef0)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:150
#61 0x00000000008a5d42 in hash_table<cselib_hasher, xcallocator,
false>::find_slot_with_hash (this=0x22d53e0, comparable=0x7fffffffbef0,
hash=13065, 
    insert=INSERT)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/hash-table.h:999
#62 0x00000000008a0761 in cselib_find_slot (mode=SImode, x=0x7ffff687c978, 
    hash=13065, insert=INSERT, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:600
#63 0x00000000008a3b5f in cselib_lookup_1 (x=0x7ffff687c978, mode=SImode, 
    create=1, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:2082
#64 0x00000000008a3c71 in cselib_lookup (x=0x7ffff687c978, mode=SImode, 
    create=1, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:2125
#65 0x00000000008a478f in cselib_add_permanent_equiv (elt=0x2328960, 
    x=0x7ffff687c978, insn=0x7ffff68196c0)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:2427
#66 0x0000000001099612 in reverse_op (val=0x235e938, expr=0x7ffff681a6a8, 
    insn=0x7ffff68196c0)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/var-tracking.c:5846
#67 0x000000000109a4b6 in add_stores (loc=0x7ffff687c960, expr=0x7ffff681a6a8, 
    cuip=0x7fffffffc250)
---Type <return> to continue, or q <return> to quit---
    at /space/rguenther/src/svn/gcc-5-branch/gcc/var-tracking.c:6114
#68 0x0000000000cfb3b0 in note_stores (x=0x7ffff681a6a8, 
    fun=0x1099617 <add_stores(rtx, const_rtx, void*)>, data=0x7fffffffc250)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/rtlanal.c:1652
#69 0x0000000000cfb3f7 in note_stores (x=0x7ffff680b680, 
    fun=0x1099617 <add_stores(rtx, const_rtx, void*)>, data=0x7fffffffc250)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/rtlanal.c:1657
#70 0x000000000109c929 in add_with_sets (insn=0x7ffff68196c0, 
    sets=0x7fffffffc350, n_sets=1)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/var-tracking.c:6559
#71 0x00000000008a4cf6 in cselib_record_sets (insn=0x7ffff68196c0)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:2574
#72 0x00000000008a52e6 in cselib_process_insn (insn=0x7ffff68196c0)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:2686
#73 0x00000000010a7a79 in vt_initialize ()
    at /space/rguenther/src/svn/gcc-5-branch/gcc/var-tracking.c:10132
#74 0x00000000010a82de in variable_tracking_main_1 ()
    at /space/rguenther/src/svn/gcc-5-branch/gcc/var-tracking.c:10331
#75 0x00000000010a8408 in variable_tracking_main ()
    at /space/rguenther/src/svn/gcc-5-branch/gcc/var-tracking.c:10384

Can't reproduce on trunk.

[Bug debug/67355] [5 Regression] ICE compiling LTP testcase, endless cselib recursion from var-tracking

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67355

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |trippels at gcc dot gnu.org

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
I cannot reproduce this issue.

[Bug debug/67355] [5 Regression] ICE compiling LTP testcase, endless cselib recursion from var-tracking

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67355

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Hmm, I can't reproduce with my FSF 5.1 or 5.2 builds (release checking) but I
can reproduce with my current GCC 5 branch development build (checking
enabled):

> /abuild/rguenther/gcc5-g/gcc/cc1 -quiet -O2 -m32 -g atof01.i -fstack-protector -funwind-tables -fasynchronous-unwind-tables
Segmentation fault

the above is on x86_64 with -m32 (original report was for native i?86).

[Bug debug/67355] [5 Regression] ICE compiling LTP testcase, endless cselib recursion from var-tracking

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67355

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-08-26
     Ever confirmed|0                           |1

--- Comment #4 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
OK confirmed:

markus@x4 tmp % cat atof01.i
main_j, main_buf, checkbuf_dp, checkbuf_ad;
static fn1 (char *p1, int p2)
{
  int bd, tw;
  bd = checkbuf_ad = checkbuf_dp = 0;
  while (*p1 && *p1 != '.')
    {
      bd++;
      p1++;
    }
  if (p1 == '.')
    {
      checkbuf_dp++;
      while (*p1)
        {
          checkbuf_ad++;
          p1++;
        }
    }
  tw = bd + checkbuf_dp + checkbuf_ad;
  if (tw < p2)
    {
      fn2 ();
      return -1;
    }
  return 0;
}

main ()
{
  int i;
  for (; i < 1; i++)
    for (; main_j; main_j++)
      fn1 (main_buf, main_j);
}

markus@x4 tmp % gcc -O2 -w -m32 -g atof01.i
gcc: internal compiler error: Segmentation fault (program cc1)

[Bug debug/67355] [5 Regression] ICE compiling LTP testcase, endless cselib recursion from var-tracking

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67355

--- Comment #5 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Started with r216728.

[Bug debug/67355] [5 Regression] ICE compiling LTP testcase, endless cselib recursion from var-tracking

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67355

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aoliva at gcc dot gnu.org,
                   |                            |jakub at gcc dot gnu.org

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Breakpoint 5, rtx_equal_for_cselib_1 (x=0x7ffff6a152b8, y=0x7ffff6a152a0, 
    memmode=VOIDmode) at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:871
871       if (REG_P (x) || MEM_P (x))
(gdb) p debug_rtx (x)
(plus:SI (value/u:SI 56:56 @0x2275a78/0x22c6a40)
    (value/u:SI 29:4257 @0x22757f0/0x22c5b60))
$1 = void
(gdb) p debug_rtx (y)
(plus:SI (plus:SI (value/u:SI 56:56 @0x2275a78/0x22c6a40)
        (value/u:SI 29:4257 @0x22757f0/0x22c5b60))
    (value/u:SI 29:4257 @0x22757f0/0x22c5b60))

and we run into

        case 'e':
          if (i == 1
              && targetm.commutative_p (x, UNKNOWN)
              && rtx_equal_for_cselib_1 (XEXP (x, 1), XEXP (y, 0), memmode)
              && rtx_equal_for_cselib_1 (XEXP (x, 0), XEXP (y, 1), memmode))
            return 1;
          if (! rtx_equal_for_cselib_1 (XEXP (x, i), XEXP (y, i), memmode))
            return 0;

recursing with i == 0

rtx_equal_for_cselib_1 (x=0x2275a78, y=0x7ffff6a152b8, memmode=VOIDmode)
    at /space/rguenther/src/svn/gcc-5-branch/gcc/cselib.c:871
871       if (REG_P (x) || MEM_P (x))
(gdb) p debug_rtx (x)
(value/u:SI 56:56 @0x2275a78/0x22c6a40)
$5 = void
(gdb) p debug_rtx (y)
(plus:SI (value/u:SI 56:56 @0x2275a78/0x22c6a40)
    (value/u:SI 29:4257 @0x22757f0/0x22c5b60))

values for x we try from the canonical location list:

(value/u:SI 57:8708 @0x2275a90/0x22c6a70) - skipped

(plus:SI (plus:SI (value/u:SI 56:56 @0x2275a78/0x22c6a40)
        (value/u:SI 29:4257 @0x22757f0/0x22c5b60))
    (value/u:SI 29:4257 @0x22757f0/0x22c5b60))

oops, that's our original 'y' expression!  So we managed to recurse with
the same arguments but swapped.

But values also look somewhat non-sensical as we basically have
(plus (plus value1 value2) value2) == value1 which can only be true
for value2 == 0.

I don't know anything about CSELIB or var-tracking so I'll defer to somebody
else devising a way to fix the invalid(?) value or avoid recursions of this
style.

The problem is likely only latent on trunk.