[Bug ipa/68064] New: [6 Regression] ICE: in meet_with, at ipa-cp.c:874

[Bug ipa/68064] New: [6 Regression] ICE: in meet_with, at ipa-cp.c:874

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68064

            Bug ID: 68064
           Summary: [6 Regression] ICE: in meet_with, at ipa-cp.c:874
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org
                CC: jamborm at gcc dot gnu.org
  Target Milestone: ---

r228491 causes during build of Chromium browser:

In file included from ../../v8/src/heap/heap.h:18:0,
                 from ../../v8/src/contexts.h:8,
                 from ../../v8/src/isolate.h:17,
                 from ../../v8/src/factory.h:8,
                 from ../../v8/src/bootstrapper.h:8,
                 from ../../v8/src/compiler/typer.cc:9:
../../v8/src/heap/spaces.h:3016:7: internal compiler error: in meet_with, at
ipa-cp.c:874
 class LargeObjectIterator : public ObjectIterator {
       ^
0x133609f ipcp_alignment_lattice::meet_with(unsigned int, unsigned int)
        ../../gcc/gcc/ipa-cp.c:874
0x1337eef propagate_alignment_accross_jump_function
        ../../gcc/gcc/ipa-cp.c:1615
0x1337eef propagate_constants_accross_call
        ../../gcc/gcc/ipa-cp.c:1958
0x133b548 propagate_constants_topo
        ../../gcc/gcc/ipa-cp.c:2825
0x133b548 ipcp_propagate_stage
        ../../gcc/gcc/ipa-cp.c:2922
0x133de5c ipcp_driver
        ../../gcc/gcc/ipa-cp.c:4581
0x133de5c execute
        ../../gcc/gcc/ipa-cp.c:4673
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

Reducing...

[Bug ipa/68064] [6 Regression] ICE: in meet_with, at ipa-cp.c:874

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68064

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |6.0

[Bug ipa/68064] [6 Regression] ICE: in meet_with, at ipa-cp.c:874

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68064

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-10-23
                 CC|                            |hubicka at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
markus@x4 Release % cat typer.ii
template <class Config> class A {
public:
  class B;
  typedef typename Config::template D<A>::type TypeHandle;
  static A *Tagged() { return B::New(B::kTagged); }
  static TypeHandle Union(TypeHandle);
  static TypeHandle Representation(TypeHandle, typename Config::Region *);
  bool Is();
};

template <class Config> class A<Config>::B {
  friend A;
  enum { kTaggedPointer = 1 << 31, kTagged = kTaggedPointer };
  static A *New(int p1) { return Config::from_bitset(p1); }
};

struct C {
  typedef int Region;
  template <class> struct D { typedef A<C> *type; };
  static A<C> *from_bitset(unsigned);
};
A<C> *C::from_bitset(unsigned p1) { return reinterpret_cast<A<C> *>(p1); }

namespace {
int *a;
void fn1(A<C> *p1) { A<C>::Union(A<C>::Representation(p1, a)); }
}

void fn2() {
  A<C> b;
  A<C> *c = b.Is() ? 0 : A<C>::Tagged();
  fn1(c);
}

markus@x4 Release % g++ -c -O2 typer.ii
typer.ii:33:1: internal compiler error: in meet_with, at ipa-cp.c:874

[Bug ipa/68064] [6 Regression] ICE: in meet_with, at ipa-cp.c:874

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68064

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org

--- Comment #2 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Mine.

[Bug ipa/68064] [6 Regression] ICE: in meet_with, at ipa-cp.c:874

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68064

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
The problem is that IPA-CP does not handle zero-aligned pointers (what
would they be?) but get_pointer_alignment_1 actually returns zero for
one and itself returns true, meaning it claims it knows the alignment
is what it says.  The reason for that is that the pointer is actually
either zero or an integer constant, selected by a ternary operator.

Given the circumstances, the behavior of get_pointer_alignment_1 is
actually OK, I suppose, so wee need to check for it like this:

--- a/gcc/ipa-prop.c
+++ b/gcc/ipa-prop.c
@@ -1651,6 +1651,7 @@ ipa_compute_jump_functions_for_edge (struct
ipa_func_body_info *fbi,
          unsigned align;

          if (get_pointer_alignment_1 (arg, &align, &hwi_bitpos)
+             && align != 0
              && align % BITS_PER_UNIT == 0
              && hwi_bitpos % BITS_PER_UNIT == 0)
            {

[Bug ipa/68064] [6 Regression] ICE: in meet_with, at ipa-cp.c:874

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68064

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed committing the fix on the mailing list

https://gcc.gnu.org/ml/gcc-patches/2015-10/msg03383.html