[Bug tree-optimization/67915] New: ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[Bug tree-optimization/67915] New: ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67915

            Bug ID: 67915
           Summary: ICE on valid code at -O2 and -O3 on x86_64-linux-gnu
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu
  Target Milestone: ---

The following code causes an ICE when compiled with the current gcc trunk at
-O2 and -O3 on x86_64-linux-gnu in both 32-bit and 64-bit modes.

It is a regression from 5.2.x.


$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 6.0.0 20151009 (experimental) [trunk revision 228653] (GCC) 
$ 
$ gcc-trunk -Os -c small.c
$ gcc-5.2 -O2 -c small.c
$ 
$ gcc-trunk -O2 -c small.c
small.c: In function ‘fn2’:
small.c:10:1: internal compiler error: Segmentation fault
 fn2 ()
 ^
0xaaee4f crash_signal
        ../../gcc-trunk/gcc/toplev.c:353
0x81c4c4 tree_unary_nonnegative_warnv_p(tree_code, tree_node*, tree_node*,
bool*, int)
        ../../gcc-trunk/gcc/fold-const.c:12822
0x82f0ef fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
        ../../gcc-trunk/gcc/fold-const.c:11257
0xaf5067 cleanup_control_expr_graph
        ../../gcc-trunk/gcc/tree-cfgcleanup.c:116
0xaf5067 cleanup_control_flow_bb
        ../../gcc-trunk/gcc/tree-cfgcleanup.c:211
0xaf5067 cleanup_tree_cfg_bb
        ../../gcc-trunk/gcc/tree-cfgcleanup.c:628
0xaf56a8 cleanup_tree_cfg_1
        ../../gcc-trunk/gcc/tree-cfgcleanup.c:681
0xaf56a8 cleanup_tree_cfg_noloop
        ../../gcc-trunk/gcc/tree-cfgcleanup.c:733
0xaf56a8 cleanup_tree_cfg()
        ../../gcc-trunk/gcc/tree-cfgcleanup.c:788
0x9e9384 execute_function_todo
        ../../gcc-trunk/gcc/passes.c:1915
0x9e9c83 execute_todo
        ../../gcc-trunk/gcc/passes.c:2028
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$ 


-----------------------------------


int a, b, c, d, e, f, g;

int
fn1 (int p1)
{
  return p1;
}

void
fn2 ()
{
lbl:
  g = b;
  if (fn1 (c && e))
    {
      f = a ? 0 : 1 << 1;
      short h = b;
      d = h < 0 || f ? 0 : 1;
    }
  goto lbl;
}
>From gcc-bugs-return-499183-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Oct 09 23:34:17 2015
Return-Path: <gcc-bugs-return-499183-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 66187 invoked by alias); 9 Oct 2015 23:34:17 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 66105 invoked by uid 48); 9 Oct 2015 23:34:12 -0000
From: "pangbw at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug debug/65779] [5/6 Regression] undefined local symbol on powerpc [regression]
Date: Fri, 09 Oct 2015 23:34:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: debug
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: pangbw at gmail dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.3
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-65779-4-c4RW5RIrJ7@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-65779-4@http.gcc.gnu.org/bugzilla/>
References: <bug-65779-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-10/txt/msg00738.txt.bz2
Content-length: 1066

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65779

--- Comment #10 from baoshan <pangbw at gmail dot com> ---
This is my fix for this issue, any comment is welcome.

---
10       gcc/function.c |    5 +++--
11       1 files changed, 3 insertions(+), 2 deletions(-)
12       
13      diff --git a/gcc/function.c b/gcc/function.c
14      index 1a8682b..a9df397 100644
15      --- a/gcc/function.c
16      +++ b/gcc/function.c
17      @@ -5561,8 +5561,9 @@ prepare_shrink_wrap (basic_block entry_block)
18         CLEAR_HARD_REG_SET (uses);
19         CLEAR_HARD_REG_SET (defs);
20         FOR_BB_INSNS_REVERSE_SAFE (entry_block, insn, curr)
21      -    if (NONDEBUG_INSN_P (insn)
22      -   && ​!move_insn_for_shrink_wrap (entry_block, insn, uses, defs))
23      +    if (INSN_P(insn) &&
24      +   (DEBUG_INSN_P (insn)
25      +    || ​!move_insn_for_shrink_wrap (entry_block, insn, uses, defs)))
26             {
27          /* Add all defined registers to DEFs.  */
28          for (ref = DF_INSN_DEFS (insn); *ref; ref++)
>From gcc-bugs-return-499184-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Oct 09 23:41:16 2015
Return-Path: <gcc-bugs-return-499184-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 71544 invoked by alias); 9 Oct 2015 23:41:16 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 71478 invoked by uid 48); 9 Oct 2015 23:41:13 -0000
From: "pinskia at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug debug/65779] [5/6 Regression] undefined local symbol on powerpc [regression]
Date: Fri, 09 Oct 2015 23:41:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: debug
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: pinskia at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.3
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-65779-4-vpIOzNUg9v@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-65779-4@http.gcc.gnu.org/bugzilla/>
References: <bug-65779-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-10/txt/msg00739.txt.bz2
Content-length: 227

https://gcc.gnu.org/bugzilla/show_bug.cgi?ide779

--- Comment #11 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I suspect this was fixed for GCC 6 with the patch that fixed bug 67789 (which
is the more correct patch).

[Bug tree-optimization/67915] ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67915

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-10-12
                 CC|                            |rsandifo at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  Awww - that code again :/

The issue is that cleanup_control_expr_graph doing

        case GIMPLE_COND:
          val = fold_binary_loc (loc, gimple_cond_code (stmt),
                                 boolean_type_node,
                                 gimple_cond_lhs (stmt),
                                 gimple_cond_rhs (stmt));
          break;

now walks the SSA def chain but those defs may be released (were in a CFG
cleanup which can end up removing BBs and releasing SSA names).

My plan for the above was to remove the fold_binary and just detect whether
this is a true/false condition (see in gimple-fold how we canonicalize those).
Last time I tried this there were some missed CFG cleanups because of that
(unfolded GIMPLE_CONDs).

But of course the fallback was always to do this cleanup in some better
order (though CFG cleanup cannot compute sth like dominators for the obvious
reason - unreachable blocks).

[Bug tree-optimization/67915] ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67915

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
So sth like the following (ISTR some missed foldings that way, it's not too
long
ago that I tested this)

Index: gcc/tree-cfgcleanup.c
===================================================================
--- gcc/tree-cfgcleanup.c       (revision 228706)
+++ gcc/tree-cfgcleanup.c       (working copy)
@@ -110,10 +110,9 @@ cleanup_control_expr_graph (basic_block
       switch (gimple_code (stmt))
        {
        case GIMPLE_COND:
-         val = fold_binary_loc (loc, gimple_cond_code (stmt),
-                                boolean_type_node,
-                                gimple_cond_lhs (stmt),
-                                gimple_cond_rhs (stmt));
+         val = const_binop (gimple_cond_code (stmt),
+                            boolean_type_node,
+                            gimple_cond_lhs (stmt), gimple_cond_rhs (stmt));
          break;

        case GIMPLE_SWITCH:

Or alternatively try to go down

Index: gcc/passes.c
===================================================================
--- gcc/passes.c        (revision 228750)
+++ gcc/passes.c        (working copy)
@@ -1909,7 +1909,16 @@ execute_function_todo (function *fn, voi

   push_cfun (fn);

-  /* Always cleanup the CFG before trying to update SSA.  */
+  if (flags & TODO_update_ssa_any)
+    {
+      /* Always delete unreachable blocks before trying to update SSA.  */
+      if (!dom_info_available_p (CDI_DOMINATORS))
+       delete_unreachable_blocks ();
+
+      unsigned update_flags = flags & TODO_update_ssa_any;
+      update_ssa (update_flags);
+    }
+
   if (flags & TODO_cleanup_cfg)
     {
       cleanup_tree_cfg ();
@@ -1930,10 +1939,9 @@ execute_function_todo (function *fn, voi
         still need to do one.  */
       if (!(flags & TODO_update_ssa_any) && need_ssa_update_p (cfun))
        flags |= TODO_update_ssa;
-    }

-  if (flags & TODO_update_ssa_any)
-    {
+      /* ???  We want to fix the above issue by keeping SSA for up-to-date
+         which might be easier when we have updated SSA before CFG cleanup. 
*/
       unsigned update_flags = flags & TODO_update_ssa_any;
       update_ssa (update_flags);
     }

with all the consequences of even after fixing ??? the probably more expensive
SSA update (on a not cleaned up CFG).

I'm re-testing the first hunk (without instrumenting for regressions...)

[Bug tree-optimization/67915] ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67915

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Index: gcc/tree-cfgcleanup.c
===================================================================
--- gcc/tree-cfgcleanup.c       (revision 228753)
+++ gcc/tree-cfgcleanup.c       (working copy)
@@ -103,17 +103,22 @@ cleanup_control_expr_graph (basic_block
       edge e;
       edge_iterator ei;
       bool warned;
-      location_t loc;

       fold_defer_overflow_warnings ();
-      loc = gimple_location (stmt);
       switch (gimple_code (stmt))
        {
        case GIMPLE_COND:
-         val = fold_binary_loc (loc, gimple_cond_code (stmt),
-                                boolean_type_node,
-                                gimple_cond_lhs (stmt),
-                                gimple_cond_rhs (stmt));
+         val = const_binop (gimple_cond_code (stmt),
+                            boolean_type_node,
+                            gimple_cond_lhs (stmt), gimple_cond_rhs (stmt));
+         if (!val)
+           {
+             tree tem = fold_binary (gimple_cond_code (stmt),
+                                     boolean_type_node,
+                                     gimple_cond_lhs (stmt),
+                                     gimple_cond_rhs (stmt));
+             gcc_assert (!tem || TREE_CODE (tem) != INTEGER_CST);
+           }
          break;

        case GIMPLE_SWITCH:

fails in configuring stage2 gcc/ on

if (_12 < 0)

but probably because of your earlier patch now ... and with that disabled on

if (base.96 != base.96)

which is during CFG build in stage2 libcpp lex.c.  It's the GIMPLIFIERs
"CSE" producing

  <bb 101>:
  base.96 = base;
  base.96 = base;
  if (base.96 != base.96)

(see gimplify.c:lookup_tmp_var) and us not folding that stmt during
gimplification (the thing to fix).  Let's see how far I get with that ;)

[Bug tree-optimization/67915] ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67915

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Taking.

[Bug tree-optimization/67915] ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67915

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Wed Oct 14 12:59:15 2015
New Revision: 228810

URL: https://gcc.gnu.org/viewcvs?rev=228810&root=gcc&view=rev
Log:
2015-10-14  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67915
        * match.pd: Handle comparisons of addresses of STRING_CSTs.
        * gimplify.c (gimplify_cond_expr): Fold the GIMPLE conds we build.
        * tree-cfgcleanup.c (cleanup_control_expr_graph): Remove GENERIC
        stmt folding in favor of GIMPLE one.

        * gcc.dg/torture/pr67915.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr67915.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/gimplify.c
    trunk/gcc/match.pd
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-cfgcleanup.c

[Bug tree-optimization/67915] ICE on valid code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67915

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.