Fix crash in vect_is_slp_reduction

Fix crash in vect_is_slp_reduction

[Ryan Mansfield]

There is a crash in vect_is_slp_reduction where use_stmt doesn't get 
initialized in the FOR_EACH_IMM_USE_FAST loop.

1718	      FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
(gdb) call debug_tree(lhs)
  <ssa_name 0x7ffff6e3a5a0
     type <integer_type 0x7ffff7f8c7e0 int32_t sizes-gimplified public SI
         size <integer_cst 0x7ffff7ec47e0 constant 32>
         unit size <integer_cst 0x7ffff7ec4580 constant 4>
         align 32 symtab 0 alias set -1 canonical type 0x7ffff7ecb498 
precision 32 min <integer_cst 0x7ffff7ec4780 -2147483648> max 
<integer_cst 0x7ffff7ec47a0 2147483647> context <translation_unit_decl 
0x7ffff7f98508 D.1314>
         pointer_to_this <pointer_type 0x7ffff7f9f930>>
     var <var_decl 0x7ffff6e1ce60 g_29_lsm.18>def_stmt g_29_lsm.18_137 = 
PHI <g_29_lsm.18_87(15), D.2113_96(18)>

     version 137>
(gdb) n
1742	      if (found)
(gdb)
1746	      if (gimple_code (use_stmt) == GIMPLE_PHI)
(gdb)

Program received signal SIGSEGV, Segmentation fault.
0x0000000000980f22 in gimple_code (g=0x0) at ../../gcc/gimple.h:1098
1098	  return g->gsbase.code;

Is the following sufficient?

Index: tree-vect-loop.c
===================================================================
--- tree-vect-loop.c	(revision 173945)
+++ tree-vect-loop.c	(working copy)
@@ -1743,7 +1743,7 @@
          break;

        /* This is a loop exit phi, and we haven't reached the reduction 
phi.  */
-      if (gimple_code (use_stmt) == GIMPLE_PHI)
+      if (!use_stmt || gimple_code (use_stmt) == GIMPLE_PHI)
          return false;

        if (!is_gimple_assign (use_stmt)

Regards,

Ryan Mansfield

Re: Fix crash in vect_is_slp_reduction

[Richard Guenther]

On Fri, May 20, 2011 at 4:06 PM, Ryan Mansfield <rmansfield@qnx.com> wrote:
> There is a crash in vect_is_slp_reduction where use_stmt doesn't get
> initialized in the FOR_EACH_IMM_USE_FAST loop.
>
> 1718          FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
> (gdb) call debug_tree(lhs)
>  <ssa_name 0x7ffff6e3a5a0
>    type <integer_type 0x7ffff7f8c7e0 int32_t sizes-gimplified public SI
>        size <integer_cst 0x7ffff7ec47e0 constant 32>
>        unit size <integer_cst 0x7ffff7ec4580 constant 4>
>        align 32 symtab 0 alias set -1 canonical type 0x7ffff7ecb498
> precision 32 min <integer_cst 0x7ffff7ec4780 -2147483648> max <integer_cst
> 0x7ffff7ec47a0 2147483647> context <translation_unit_decl 0x7ffff7f98508
> D.1314>
>        pointer_to_this <pointer_type 0x7ffff7f9f930>>
>    var <var_decl 0x7ffff6e1ce60 g_29_lsm.18>def_stmt g_29_lsm.18_137 = PHI
> <g_29_lsm.18_87(15), D.2113_96(18)>
>
>    version 137>
> (gdb) n
> 1742          if (found)
> (gdb)
> 1746          if (gimple_code (use_stmt) == GIMPLE_PHI)
> (gdb)
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000000000980f22 in gimple_code (g=0x0) at ../../gcc/gimple.h:1098
> 1098      return g->gsbase.code;
>
> Is the following sufficient?

No, we shouldn't arrive with a NULL use_stmt here.

Richard.

> Index: tree-vect-loop.c
> ===================================================================
> --- tree-vect-loop.c    (revision 173945)
> +++ tree-vect-loop.c    (working copy)
> @@ -1743,7 +1743,7 @@
>         break;
>
>       /* This is a loop exit phi, and we haven't reached the reduction phi.
>  */
> -      if (gimple_code (use_stmt) == GIMPLE_PHI)
> +      if (!use_stmt || gimple_code (use_stmt) == GIMPLE_PHI)
>         return false;
>
>       if (!is_gimple_assign (use_stmt)
>
> Regards,
>
> Ryan Mansfield
>

Re: Fix crash in vect_is_slp_reduction

[Ira Rosen]

gcc-patches-owner@gcc.gnu.org wrote on 20/05/2011 05:17:47 PM:

>
> On Fri, May 20, 2011 at 4:06 PM, Ryan Mansfield <rmansfield@qnx.com>
wrote:
> > There is a crash in vect_is_slp_reduction where use_stmt doesn't get
> > initialized in the FOR_EACH_IMM_USE_FAST loop.
> >
> > 1718          FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
> > (gdb) call debug_tree(lhs)
> >  <ssa_name 0x7ffff6e3a5a0
> >    type <integer_type 0x7ffff7f8c7e0 int32_t sizes-gimplified public SI
> >        size <integer_cst 0x7ffff7ec47e0 constant 32>
> >        unit size <integer_cst 0x7ffff7ec4580 constant 4>
> >        align 32 symtab 0 alias set -1 canonical type 0x7ffff7ecb498
> > precision 32 min <integer_cst 0x7ffff7ec4780 -2147483648> max
<integer_cst
> > 0x7ffff7ec47a0 2147483647> context <translation_unit_decl
0x7ffff7f98508
> > D.1314>
> >        pointer_to_this <pointer_type 0x7ffff7f9f930>>
> >    var <var_decl 0x7ffff6e1ce60 g_29_lsm.18>def_stmt g_29_lsm.18_137 =
PHI
> > <g_29_lsm.18_87(15), D.2113_96(18)>
> >
> >    version 137>
> > (gdb) n
> > 1742          if (found)
> > (gdb)
> > 1746          if (gimple_code (use_stmt) == GIMPLE_PHI)
> > (gdb)
> >
> > Program received signal SIGSEGV, Segmentation fault.
> > 0x0000000000980f22 in gimple_code (g=0x0) at ../../gcc/gimple.h:1098
> > 1098      return g->gsbase.code;
> >
> > Is the following sufficient?
>
> No, we shouldn't arrive with a NULL use_stmt here.

I think a proper fix will be to fail if there are no uses.
I'll prepare a patch on Sunday.

Ira

Index: tree-vect-loop.c
===================================================================
--- tree-vect-loop.c    (revision 173856)
+++ tree-vect-loop.c    (working copy)
@@ -1704,7 +1704,7 @@ vect_is_slp_reduction (loop_vec_info loop_info, gi
   tree lhs;
   imm_use_iterator imm_iter;
   use_operand_p use_p;
-  int nloop_uses, size = 0;
+  int nloop_uses, size = 0, nuses;
   bool found = false;

   if (loop != vect_loop)
@@ -1715,9 +1715,11 @@ vect_is_slp_reduction (loop_vec_info loop_info, gi
   while (1)
     {
       nloop_uses = 0;
+      nuses = 0;
       FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
         {
           use_stmt = USE_STMT (use_p);
+          nuses++;
           if (is_gimple_debug (use_stmt))
             continue;

@@ -1739,6 +1741,10 @@ vect_is_slp_reduction (loop_vec_info loop_info, gi
             return false;
         }

+      /* The statement has no uses.  */
+      if (nuses == 0)
+       return false;
+
       if (found)
         break;


>
> Richard.
>
> > Index: tree-vect-loop.c
> > ===================================================================
> > --- tree-vect-loop.c    (revision 173945)
> > +++ tree-vect-loop.c    (working copy)
> > @@ -1743,7 +1743,7 @@
> >         break;
> >
> >       /* This is a loop exit phi, and we haven't reached the reduction
phi.
> >  */
> > -      if (gimple_code (use_stmt) == GIMPLE_PHI)
> > +      if (!use_stmt || gimple_code (use_stmt) == GIMPLE_PHI)
> >         return false;
> >
> >       if (!is_gimple_assign (use_stmt)
> >
> > Regards,
> >
> > Ryan Mansfield
> >

Re: Fix crash in vect_is_slp_reduction

[Ryan Mansfield]

On 11-05-20 10:17 AM, Richard Guenther wrote:
> On Fri, May 20, 2011 at 4:06 PM, Ryan Mansfield<rmansfield@qnx.com>  wrote:
>> There is a crash in vect_is_slp_reduction where use_stmt doesn't get
>> initialized in the FOR_EACH_IMM_USE_FAST loop.
>>
>> 1718          FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
>> (gdb) call debug_tree(lhs)
>>   <ssa_name 0x7ffff6e3a5a0
>>     type<integer_type 0x7ffff7f8c7e0 int32_t sizes-gimplified public SI
>>         size<integer_cst 0x7ffff7ec47e0 constant 32>
>>         unit size<integer_cst 0x7ffff7ec4580 constant 4>
>>         align 32 symtab 0 alias set -1 canonical type 0x7ffff7ecb498
>> precision 32 min<integer_cst 0x7ffff7ec4780 -2147483648>  max<integer_cst
>> 0x7ffff7ec47a0 2147483647>  context<translation_unit_decl 0x7ffff7f98508
>> D.1314>
>>         pointer_to_this<pointer_type 0x7ffff7f9f930>>
>>     var<var_decl 0x7ffff6e1ce60 g_29_lsm.18>def_stmt g_29_lsm.18_137 = PHI
>> <g_29_lsm.18_87(15), D.2113_96(18)>
>>
>>     version 137>
>> (gdb) n
>> 1742          if (found)
>> (gdb)
>> 1746          if (gimple_code (use_stmt) == GIMPLE_PHI)
>> (gdb)
>>
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x0000000000980f22 in gimple_code (g=0x0) at ../../gcc/gimple.h:1098
>> 1098      return g->gsbase.code;
>>
>> Is the following sufficient?
>
> No, we shouldn't arrive with a NULL use_stmt here.

OK, thanks. I've filed PR49087 with a testcase.

Regards,

Ryan Mansfield

[patch] Fix PR 49087 (was Re: Fix crash in vect_is_slp_reduction)

[Ira Rosen]

> >
> > No, we shouldn't arrive with a NULL use_stmt here.
>
> I think a proper fix will be to fail if there are no uses.
> I'll prepare a patch on Sunday.
>

Here is the patch. It bails out if LHS has no uses.

Bootstrapped and tested on powerpc64-suse-linux.
Committed.

Ira

ChangeLog:

	PR tree-optimization/49087
	* tree-vect-loop.c (vect_is_slp_reduction): Fail if
	LHS has no uses.

testsuite/ChangeLog:

	PR tree-optimization/49087
	* gcc.dg/vect/O3-pr49087.c: New test.


Index: tree-vect-loop.c
===================================================================
--- tree-vect-loop.c    (revision 174025)
+++ tree-vect-loop.c    (working copy)
@@ -1704,7 +1704,7 @@ vect_is_slp_reduction (loop_vec_info loop_info, gi
   tree lhs;
   imm_use_iterator imm_iter;
   use_operand_p use_p;
-  int nloop_uses, size = 0;
+  int nloop_uses, size = 0, nuses;
   bool found = false;

   if (loop != vect_loop)
@@ -1715,9 +1715,11 @@ vect_is_slp_reduction (loop_vec_info loop_info, gi
   while (1)
     {
       nloop_uses = 0;
+      nuses = 0;
       FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
         {
           use_stmt = USE_STMT (use_p);
+          nuses++;
           if (is_gimple_debug (use_stmt))
             continue;

@@ -1739,6 +1741,10 @@ vect_is_slp_reduction (loop_vec_info loop_info, gi
             return false;
         }

+      /* We reached a statement with no uses.  */
+      if (nuses == 0)
+       return false;
+
       if (found)
         break;

Index: testsuite/gcc.dg/vect/O3-pr49087.c
===================================================================
--- testsuite/gcc.dg/vect/O3-pr49087.c  (revision 0)
+++ testsuite/gcc.dg/vect/O3-pr49087.c  (revision 0)
@@ -0,0 +1,37 @@
+/* { dg-do compile } */
+
+static char func2() { }
+
+struct S0
+{
+ int t;
+};
+
+int g;
+
+struct S0 s0;
+
+int
+foo (int arg)
+{
+  int *ptr = &g;
+  int i, j;
+  for (i = 0; i < 10; i += 1)
+    {
+      for (j = 0; j < 1; j += 1)
+       {
+         int k;
+         if (arg)
+           {
+             int l;
+             for (k = 1; arg < 10; arg = func2 ())
+               {
+                 return l;
+               }
+           }
+         *ptr = func2 () ^ s0.t;
+       }
+    }
+}
+
+/* { dg-final { cleanup-tree-dump "vect" } } */