[Bug middle-end/68117] New: [6 Regression] ICE: Segmentation fault building Firefox on ppc64le

[Bug middle-end/68117] New: [6 Regression] ICE: Segmentation fault building Firefox on ppc64le

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

            Bug ID: 68117
           Summary: [6 Regression] ICE: Segmentation fault building
                    Firefox on ppc64le
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org
  Target Milestone: ---

trippels@gcc2-power8 libvorbis % /home/trippels/gcc_test/usr/local/bin/gcc -o
Unified_c_media_libvorbis0.o -c -I../../dist/system_wrappers -include
/home/trippels/gecko-dev/config/gcc_hidden.h -DMOZ_GLUE_IN_PROGRAM
-DAB_CD=en-US -DNO_NSPR_10_SUPPORT -I/home/trippels/gecko-dev/media/libvorbis
-I. -I/home/trippels/gecko-dev/media/libvorbis/lib -I../../dist/include
-I/usr/include/nspr4 -I/home/trippels/moz-build-dir/dist/include/nss
-I/usr/include/pixman-1 -fPIC -include ../../mozilla-config.h -DMOZILLA_CLIENT
-MD -MP -MF .deps/Unified_c_media_libvorbis0.o.pp -Wall
-Wdeclaration-after-statement -Wempty-body -Wpointer-to-int-cast -Wsign-compare
-Wtype-limits -Werror=char-subscripts -Werror=comment -Werror=endif-labels
-Werror=enum-compare -Werror=ignored-qualifiers -Werror=int-to-pointer-cast
-Werror=multichar -Werror=nonnull -Werror=pointer-arith -Werror=pointer-sign
-Werror=return-type -Werror=sequence-point -Werror=trigraphs
-Werror=unknown-pragmas -Wno-unused -Wcast-align -w -ffunction-sections
-fdata-sections -std=gnu99 -fgnu89-inline -fno-strict-aliasing -fno-math-errno
-pthread -pipe -DNDEBUG -DTRIMMED -O3 -fomit-frame-pointer -Wno-uninitialized
/home/trippels/moz-build-dir/media/libvorbis/Unified_c_media_libvorbis0.c
In file included from
/home/trippels/moz-build-dir/media/libvorbis/Unified_c_media_libvorbis0.c:137:0:
/home/trippels/gecko-dev/media/libvorbis/lib/vorbisenc.c: In function
‘get_setup_template’:
/home/trippels/gecko-dev/media/libvorbis/lib/vorbisenc.c:633:20: error: invalid
PHI argument
 static const void *get_setup_template(long ch,long srate,
                    ^
<<< Unknown tree: <invalid tree code> >>>
/home/trippels/gecko-dev/media/libvorbis/lib/vorbisenc.c:633:20: internal
compiler error: Segmentation fault
0x107f7e73 crash_signal
        ../../gcc/gcc/toplev.c:353
0x1084fe44 contains_struct_check
        ../../gcc/gcc/tree.h:3032
0x1084fe44 verify_gimple_phi
        ../../gcc/gcc/tree-cfg.c:4669
0x1084fe44 verify_gimple_in_cfg(function*, bool)
        ../../gcc/gcc/tree-cfg.c:4963
0x106f98e3 execute_function_todo
        ../../gcc/gcc/passes.c:1968
0x106fa5e3 do_per_function
        ../../gcc/gcc/passes.c:1659
0x106fa8ff execute_todo
        ../../gcc/gcc/passes.c:2025
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

Adding --save-temp to the above makes the issue go away.

Valgrind shows:

/home/trippels/gecko-dev/media/libvorbis/lib/vorbisenc.c:633:20: error: invalid
PHI argument
 static const void *get_setup_template(long ch,long srate,
                    ^
<<< Unknown tree: <invalid tree code> >>>
==2662== Invalid read of size 1
==2662==    at 0x1084FE44: contains_struct_check (tree.h:3032)
==2662==    by 0x1084FE44: verify_gimple_phi (tree-cfg.c:4669)
==2662==    by 0x1084FE44: verify_gimple_in_cfg(function*, bool)
(tree-cfg.c:4963)
==2662==    by 0x106F98E3: execute_function_todo(function*, void*)
(passes.c:1968)
==2662==    by 0x106FA5E3: do_per_function(void (*)(function*, void*), void*)
(passes.c:1659)
==2662==    by 0x106FA8FF: execute_todo(unsigned int) (passes.c:2025)
==2662==    by 0x106FE287: execute_one_pass(opt_pass*) (passes.c:2357)
==2662==    by 0x106FE763: execute_pass_list_1(opt_pass*) (passes.c:2397)
==2662==    by 0x106FE77B: execute_pass_list_1(opt_pass*) (passes.c:2398)
==2662==    by 0x106FE77B: execute_pass_list_1(opt_pass*) (passes.c:2398)
==2662==    by 0x106FE803: execute_pass_list(function*, opt_pass*)
(passes.c:2408)
==2662==    by 0x1034A7CF: cgraph_node::expand() (cgraphunit.c:1983)
==2662==    by 0x1034C7B7: expand_all_functions (cgraphunit.c:2119)
==2662==    by 0x1034C7B7: symbol_table::compile() (cgraphunit.c:2472)
==2662==    by 0x1034EEBB: symbol_table::finalize_compilation_unit()
(cgraphunit.c:2562)
==2662==  Address 0x118b0961 is not stack'd, malloc'd or (recently) free'd
==2662==
>From gcc-bugs-return-500722-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Oct 27 18:59:31 2015
Return-Path: <gcc-bugs-return-500722-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 5978 invoked by alias); 27 Oct 2015 18:59:31 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 5951 invoked by uid 48); 27 Oct 2015 18:59:27 -0000
From: "trippels at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/68117] [6 Regression] ICE: Segmentation fault building Firefox on ppc64le
Date: Tue, 27 Oct 2015 18:59:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 6.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: trippels at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-68117-4-Abj4Favete@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-68117-4@http.gcc.gnu.org/bugzilla/>
References: <bug-68117-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-10/txt/msg02277.txt.bz2
Content-length: 419

https://gcc.gnu.org/bugzilla/show_bug.cgi?idh117

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |alalaw01 at gcc dot gnu.org

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Started with r229437.

[Bug middle-end/68117] [6 Regression] ICE: Segmentation fault building Firefox on ppc64le

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |6.0

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Does

Index: gcc/tree-scalar-evolution.c
===================================================================
--- gcc/tree-scalar-evolution.c (revision 229481)
+++ gcc/tree-scalar-evolution.c (working copy)
@@ -1849,8 +1849,7 @@ interpret_rhs_expr (struct loop *loop, g
       chrec2 = instantiate_parameters (loop, chrec2);

       chrec2 = fold_build2 (LSHIFT_EXPR, type,
-                           build_int_cst (TREE_TYPE (rhs1), 1),
-                           chrec2);
+                           build_int_cst (type, 1), chrec2);
       res = chrec_fold_multiply (type, chrec1, chrec2);
       break;


fix it?

[Bug middle-end/68117] [6 Regression] ICE: Segmentation fault building Firefox on ppc64le

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Probably not.

[Bug middle-end/68117] [6 Regression] ICE: Segmentation fault building Firefox on ppc64le

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

--- Comment #4 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #3)
> Probably not.

Yes, it doesn't help.

[Bug middle-end/68117] [6 Regression] ICE: Segmentation fault building Firefox on ppc64le

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hjl.tools at gmail dot com

--- Comment #5 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
*** Bug 68135 has been marked as a duplicate of this bug. ***

[Bug middle-end/68117] [6 Regression] error: invalid PHI argument <<< Unknown tree: <invalid tree code> >>>

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

--- Comment #6 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Hmm, it looks like r229437 may be innocent after all.
This morning I've hit another ICE that goes away if I add --save-temps 
to the command line:

trippels@gcc2-power8 tools % ~/gcc_6/usr/local/bin/g++ -ftemplate-depth-128 -O3
-finline-functions -Wno-inline -Wall -m64 -Winvalid-pch -DBOOST_ALL_NO_LIB=1
-DBOOST_BUILD_PCH_ENABLED -DBOOST_CHRONO_STATIC_LINK=1
-DBOOST_CHRONO_THREAD_DISABLED -DBOOST_HAS_ICU=1 -DBOOST_SYSTEM_NO_DEPRECATED
-DBOOST_SYSTEM_STATIC_LINK=1 -DBOOST_TEST_NO_AUTO_LINK=1
-DBOOST_TIMER_STATIC_LINK=1 -DBOOST_UBLAS_UNSUPPORTED_COMPILER=0 -DNDEBUG
-I"/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/gcc-6.0.0/release/link-static"
-I".." -I"../libs/math/include_private" -I"../libs/math/test" -c -o
"/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/test_bessel_y_prime.test/gcc-6.0.0/release/link-static/test_bessel_y_prime.o"
"../libs/math/test/test_bessel_y_prime.cpp"                                     
In file included from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/vector:65:0,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/random.h:34,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/random:49,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_algo.h:66,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/algorithm:62,
                 from ../boost/math/tools/config.hpp:17,
                 from ../boost/math/tools/promotion.hpp:26,
                 from ../boost/math/special_functions/detail/round_fwd.hpp:12,
                 from ../boost/math/special_functions/math_fwd.hpp:26,
                 from ../libs/math/test/pch_light.hpp:9,
                 from ../libs/math/test/test_bessel_y_prime.cpp:6:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h: In
function ‘void std::fill(std::_Bit_iterator, std::_Bit_iterator, const bool&)’:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h:398:3:
internal compiler error: in fold_convert_loc, at fold-const.c:2201
   fill(_Bit_iterator __first, _Bit_iterator __last, const bool& __x)
   ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
trippels@gcc2-power8 tools % ~/gcc_6/usr/local/bin/g++ --save-temps
-ftemplate-depth-128 -O3 -finline-functions -Wno-inline -Wall -m64
-Winvalid-pch -DBOOST_ALL_NO_LIB=1 -DBOOST_BUILD_PCH_ENABLED
-DBOOST_CHRONO_STATIC_LINK=1 -DBOOST_CHRONO_THREAD_DISABLED -DBOOST_HAS_ICU=1
-DBOOST_SYSTEM_NO_DEPRECATED -DBOOST_SYSTEM_STATIC_LINK=1
-DBOOST_TEST_NO_AUTO_LINK=1 -DBOOST_TIMER_STATIC_LINK=1
-DBOOST_UBLAS_UNSUPPORTED_COMPILER=0 -DNDEBUG
-I"/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/gcc-6.0.0/release/link-static"
-I".." -I"../libs/math/include_private" -I"../libs/math/test" -c -o
"/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/test_bessel_y_prime.test/gcc-6.0.0/release/link-static/test_bessel_y_prime.o"
"../libs/math/test/test_bessel_y_prime.cpp"
trippels@gcc2-power8 tools %  

Any hints on how to debug this further?
Looks like memory is corrupted somehow.
>From gcc-bugs-return-500879-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Oct 29 09:08:45 2015
Return-Path: <gcc-bugs-return-500879-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 75944 invoked by alias); 29 Oct 2015 09:08:45 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 75902 invoked by uid 48); 29 Oct 2015 09:08:40 -0000
From: "trippels at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/68117] [6 Regression] error: invalid PHI argument <<< Unknown tree: <invalid tree code> >>>
Date: Thu, 29 Oct 2015 09:08:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 6.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: trippels at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 6.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-68117-4-OCyMpriu9t@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-68117-4@http.gcc.gnu.org/bugzilla/>
References: <bug-68117-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-10/txt/msg02434.txt.bz2
Content-length: 9308

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

--- Comment #7 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
...
==123276== Conditional jump or move depends on uninitialised value(s)
==123276==    at 0x10B3FFB8: extract_range_from_binary_expr_1(value_range*,
tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10AE79FF: extract_range_from_unary_expr_1(value_range*,
tree_code, tree_node*, value_range*, tree_node*) [clone .lto_priv.6507] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10A58D57: vrp_visit_stmt(gimple*, edge_def**, tree_node**)
(in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x108BE377: ssa_propagate(ssa_prop_result (*)(gimple*,
edge_def**, tree_node**), ssa_prop_result (*)(gphi*)) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10A45E97: (anonymous
namespace)::pass_vrp::execute(function*) [clone .lto_priv.2433] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10633147: execute_one_pass(opt_pass*) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10736D8F: execute_pass_list(function*, opt_pass*) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10661947: cgraph_node::expand() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10630303: symbol_table::compile() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1064A783: symbol_table::finalize_compilation_unit() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x105E7B4B: compile_file() [clone .lto_priv.3048] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10538363: toplev::main(int, char**) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==  Uninitialised value was created by a stack allocation
==123276==    at 0x10B3D598: extract_range_from_binary_expr_1(value_range*,
tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==
==123276== Conditional jump or move depends on uninitialised value(s)
==123276==    at 0x10B3FFB8: extract_range_from_binary_expr_1(value_range*,
tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10AE79FF: extract_range_from_unary_expr_1(value_range*,
tree_code, tree_node*, value_range*, tree_node*) [clone .lto_priv.6507] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10BF8217: simplify_stmt_for_jump_threading(gimple*, gimple*,
avail_exprs_stack*) [clone .lto_priv.6342] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10BF5DF3:
record_temporary_equivalences_from_stmts_at_dest(edge_def*, const_and_copies*,
avail_exprs_stack*, tree_node* (*)(gimple*, gimple*, avail_exprs_stack*), bool)
[clone .isra.44] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10BE8C6B: thread_across_edge(gcond*, edge_def*, bool,
const_and_copies*, avail_exprs_stack*, tree_node* (*)(gimple*, gimple*,
avail_exprs_stack*)) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10A46B7F: (anonymous
namespace)::pass_vrp::execute(function*) [clone .lto_priv.2433] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10633147: execute_one_pass(opt_pass*) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10736D8F: execute_pass_list(function*, opt_pass*) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10661947: cgraph_node::expand() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10630303: symbol_table::compile() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1064A783: symbol_table::finalize_compilation_unit() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x105E7B4B: compile_file() [clone .lto_priv.3048] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==  Uninitialised value was created by a stack allocation
==123276==    at 0x10B3D598: extract_range_from_binary_expr_1(value_range*,
tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==
==123276== Conditional jump or move depends on uninitialised value(s)
==123276==    at 0x109F79FC: estimate_numbers_of_iterations_loop(loop*) [clone
.lto_priv.6542] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x109F6993: estimate_numbers_of_iterations() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x109F1723: tree_unroll_loops_completely(bool, bool) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1090259B: (anonymous
namespace)::pass_complete_unrolli::execute(function*) [clone .lto_priv.2414]
(in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10633147: execute_one_pass(opt_pass*) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10736D8F: execute_pass_list(function*, opt_pass*) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10661947: cgraph_node::expand() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10630303: symbol_table::compile() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1064A783: symbol_table::finalize_compilation_unit() (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x105E7B4B: compile_file() [clone .lto_priv.3048] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10538363: toplev::main(int, char**) (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10536DEF: main (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==  Uninitialised value was created by a stack allocation
==123276==    at 0x109F6FD4: estimate_numbers_of_iterations_loop(loop*) [clone
.lto_priv.6542] (in
/home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==
In file included from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/vector:65:0,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/random.h:34,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/random:49,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_algo.h:66,
                 from
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/algorithm:62,
                 from ../boost/math/tools/config.hpp:17,
                 from ../boost/math/tools/promotion.hpp:26,
                 from ../boost/math/special_functions/detail/round_fwd.hpp:12,
                 from ../boost/math/special_functions/math_fwd.hpp:26,
                 from ../libs/math/test/pch_light.hpp:9,
                 from ../libs/math/test/test_bessel_y_prime.cpp:6:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h: In
function ‘void std::fill(std::_Bit_iterator, std::_Bit_iterator, const bool&)’:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h:398:3:
internal compiler error: in fold_convert_loc, at fold-const.c:2201
>From gcc-bugs-return-500880-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Oct 29 09:14:45 2015
Return-Path: <gcc-bugs-return-500880-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 86718 invoked by alias); 29 Oct 2015 09:14:45 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 86691 invoked by uid 48); 29 Oct 2015 09:14:41 -0000
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/68142] New: unsafe association of multiplication
Date: Thu, 29 Oct 2015 09:14:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 6.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status keywords bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-68142-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-10/txt/msg02435.txt.bz2
Content-length: 840

https://gcc.gnu.org/bugzilla/show_bug.cgi?idh142

            Bug ID: 68142
           Summary: unsafe association of multiplication
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rguenth at gcc dot gnu.org
  Target Milestone: ---

While working on PR66313 I noticed we fail for the following with
-fsanitize=undefined

int __attribute__((noinline,noclone))
i(int a)
{
  return (2 * a) * (__INT_MAX__/2 + 1);
}
int main()
{
  volatile tem = i(-1);
  return 0;
}

this is because we simplify the above to

;; Function i (null)
;; enabled by -tree-original


{
  return a * -2147483648(OVF);
}

which is of course invalid.

[Bug middle-end/68117] [6 Regression] error: invalid PHI argument <<< Unknown tree: <invalid tree code> >>>

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Does it only reproduce with a LTO built compiler?  Usually gc-checking with
always-collect might help tracking down GC issues (which this looks like one).

[Bug middle-end/68117] [6 Regression] error: invalid PHI argument <<< Unknown tree: <invalid tree code> >>>

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ienkovich at gcc dot gnu.org

--- Comment #9 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #8)
> Does it only reproduce with a LTO built compiler?  Usually gc-checking with
> always-collect might help tracking down GC issues (which this looks like
> one).

It also happens with a --disable-bootstrap compiler.

Valgrind points to r228599:

==114559== Invalid write of size 8
==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned
int) (tree-phinodes.c:382)
==114559==    by 0x109A814F: flush_pending_stmts(edge_def*) (tree-ssa.c:195)
==114559==    by 0x103B94C3: loop_version(loop*, void*, basic_block_def**,
unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1753)
==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
(tree-ssa-loop-unswitch.c:383)
==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops()
(tree-ssa-loop-unswitch.c:106)
==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*)
(passes.c:2402)
==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
==114559==
==114559== Invalid write of size 8
==114559==    at 0x108665C0: delink_imm_use (ssa-iterators.h:248)
==114559==    by 0x108665C0: remove_phi_arg_num (tree-phinodes.c:400)
==114559==    by 0x108665C0: remove_phi_args(edge_def*) (tree-phinodes.c:433)
==114559==    by 0x107EA977: gimple_execute_on_shrinking_pred(edge_def*)
(tree-cfg.c:8193)
==114559==    by 0x103AA707: execute_on_shrinking_pred(edge_def*)
(cfghooks.c:1207)
==114559==    by 0x10D2C813: redirect_edge_succ(edge_def*, basic_block_def*)
(cfg.c:361)
==114559==    by 0x103A8D8B: redirect_edge_succ_nodup(edge_def*,
basic_block_def*) (cfghooks.c:444)
==114559==    by 0x109A8C27: ssa_redirect_edge(edge_def*, basic_block_def*)
(tree-ssa.c:166)
==114559==    by 0x107FBEDB: gimple_redirect_edge_and_branch(edge_def*,
basic_block_def*) (tree-cfg.c:5677)
==114559==    by 0x103A89F3: redirect_edge_and_branch(edge_def*,
basic_block_def*) (cfghooks.c:358)
==114559==    by 0x107F4C57: gimple_split_edge(edge_def*) (tree-cfg.c:2747)
==114559==    by 0x103A92B7: split_edge(edge_def*) (cfghooks.c:629)
==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**,
unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
(tree-ssa-loop-unswitch.c:383)
==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
==114559==
==114559== Invalid write of size 8
==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned
int) (tree-phinodes.c:382)
==114559==    by 0x107F4D0F: reinstall_phi_args (tree-cfg.c:2698)
==114559==    by 0x107F4D0F: gimple_split_edge(edge_def*) (tree-cfg.c:2749)
==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**,
unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
(tree-ssa-loop-unswitch.c:383)
==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops()
(tree-ssa-loop-unswitch.c:106)
==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*)
(passes.c:2402)
==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
==114559==

[Bug middle-end/68117] [6 Regression] error: invalid PHI argument <<< Unknown tree: <invalid tree code> >>>

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

--- Comment #10 from rguenther at suse dot de <rguenther at suse dot de> ---
On Thu, 29 Oct 2015, trippels at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117
> 
> Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>                  CC|                            |ienkovich at gcc dot gnu.org
> 
> --- Comment #9 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
> (In reply to Richard Biener from comment #8)
> > Does it only reproduce with a LTO built compiler?  Usually gc-checking with
> > always-collect might help tracking down GC issues (which this looks like
> > one).
> 
> It also happens with a --disable-bootstrap compiler.
>
> Valgrind points to r228599:

Nothing obvious but does removing

  mark_virtual_operands_for_renaming (cfun);

help?  It's the only thing that may end up releasing SSA names
(if only virtuals).

> ==114559== Invalid write of size 8
> ==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
> ==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
> ==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
> ==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned
> int) (tree-phinodes.c:382)
> ==114559==    by 0x109A814F: flush_pending_stmts(edge_def*) (tree-ssa.c:195)
> ==114559==    by 0x103B94C3: loop_version(loop*, void*, basic_block_def**,
> unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1753)
> ==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
> ==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
> (tree-ssa-loop-unswitch.c:383)
> ==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops()
> (tree-ssa-loop-unswitch.c:106)
> ==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
> ==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*)
> (passes.c:2402)
> ==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
> ==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
> ==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
> ==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
> ==114559==
> ==114559== Invalid write of size 8
> ==114559==    at 0x108665C0: delink_imm_use (ssa-iterators.h:248)
> ==114559==    by 0x108665C0: remove_phi_arg_num (tree-phinodes.c:400)
> ==114559==    by 0x108665C0: remove_phi_args(edge_def*) (tree-phinodes.c:433)
> ==114559==    by 0x107EA977: gimple_execute_on_shrinking_pred(edge_def*)
> (tree-cfg.c:8193)
> ==114559==    by 0x103AA707: execute_on_shrinking_pred(edge_def*)
> (cfghooks.c:1207)
> ==114559==    by 0x10D2C813: redirect_edge_succ(edge_def*, basic_block_def*)
> (cfg.c:361)
> ==114559==    by 0x103A8D8B: redirect_edge_succ_nodup(edge_def*,
> basic_block_def*) (cfghooks.c:444)
> ==114559==    by 0x109A8C27: ssa_redirect_edge(edge_def*, basic_block_def*)
> (tree-ssa.c:166)
> ==114559==    by 0x107FBEDB: gimple_redirect_edge_and_branch(edge_def*,
> basic_block_def*) (tree-cfg.c:5677)
> ==114559==    by 0x103A89F3: redirect_edge_and_branch(edge_def*,
> basic_block_def*) (cfghooks.c:358)
> ==114559==    by 0x107F4C57: gimple_split_edge(edge_def*) (tree-cfg.c:2747)
> ==114559==    by 0x103A92B7: split_edge(edge_def*) (cfghooks.c:629)
> ==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**,
> unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
> ==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
> ==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
> (tree-ssa-loop-unswitch.c:383)
> ==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
> ==114559==
> ==114559== Invalid write of size 8
> ==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
> ==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
> ==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
> ==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned
> int) (tree-phinodes.c:382)
> ==114559==    by 0x107F4D0F: reinstall_phi_args (tree-cfg.c:2698)
> ==114559==    by 0x107F4D0F: gimple_split_edge(edge_def*) (tree-cfg.c:2749)
> ==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**,
> unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
> ==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
> ==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
> (tree-ssa-loop-unswitch.c:383)
> ==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops()
> (tree-ssa-loop-unswitch.c:106)
> ==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
> ==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*)
> (passes.c:2402)
> ==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
> ==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
> ==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
> ==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
> ==114559==
> 
>

[Bug middle-end/68117] [6 Regression] error: invalid PHI argument <<< Unknown tree: <invalid tree code> >>>

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117

--- Comment #11 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to rguenther@suse.de from comment #10)
> >
> > Valgrind points to r228599:
> 
> Nothing obvious but does removing
> 
>   mark_virtual_operands_for_renaming (cfun);
> 
> help?  It's the only thing that may end up releasing SSA names
> (if only virtuals).

No, it doesn't help. But reverting r228760 and r228599 fixes the issue.