Bug 29534 - [4.1 Regression] ICE in "gcc -O -ftrapv" with decreasing array index
Summary: [4.1 Regression] ICE in "gcc -O -ftrapv" with decreasing array index
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: other (show other bugs)
Version: 4.1.1
: P2 major
Target Milestone: 4.2.0
Assignee: Not yet assigned to anyone
URL:
Keywords: ice-on-valid-code
Depends on:
Blocks:
 
Reported: 2006-10-21 11:16 UTC by Hallvard B Furuseth
Modified: 2008-07-04 15:53 UTC (History)
4 users (show)

See Also:
Host: i686-pc-linux-gnu
Target: i686-pc-linux-gnu
Build: i686-pc-linux-gnu
Known to work: 4.0.3 4.2.0
Known to fail: 4.1.2 4.1.3
Last reconfirmed: 2006-10-21 12:12:55

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hallvard B Furuseth 2006-10-21 11:16:23 UTC 
bash$ cat bug.c
int foo(int arr[]) {
  int i = 2;
  while (arr[--i]) ;
  return i;
}
bash$ gcc -O -ftrapv -c bug.c
gcc: Internal error: Segmentation fault (program cc1)
bash$ g++ -O -ftrapv -c bug.c
g++: Internal error: Segmentation fault (program cc1plus)

Compilation succeeds if -O is removed.  OTOH, it still crashes
with -O -fno-<all -O1 options listed in (gcc)Optimize Options>:

bash$ gcc -O -fno-defer-pop -fno-delayed-branch \
 -fno-guess-branch-probability -fno-cprop-registers -fno-loop-optimize \
 -fno-if-conversion -fno-if-conversion2 -fno-tree-ccp -fno-tree-dce \
 -fno-tree-dominator-opts -fno-tree-dse -fno-tree-ter -fno-tree-lrs \
 -fno-tree-sra -fno-tree-copyrename -fno-tree-fre -fno-tree-ch \
 -fno-merge-constants -fno-omit-frame-pointer \
 -ftrapv -c bug.c
gcc: Internal error: Segmentation fault (program cc1)
Comment 1 Richard Biener 2006-10-21 12:12:55 UTC 
Confirmed.  Works with 4.2.

We endlessly fold

#5  0x08206aa1 in fold_unary (code=NEGATE_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258) at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:6876
#6  0x08212e3e in fold_build1_stat (code=NEGATE_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258) at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:10475
#7  0x081f8a05 in negate_expr (t=0xb7cd3258)
    at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:1167
#8  0x08206aa1 in fold_unary (code=NEGATE_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258) at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:6876
#9  0x08212e3e in fold_build1_stat (code=NEGATE_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258) at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:10475
#10 0x081f8a05 in negate_expr (t=0xb7cd3258)
...
#28 0x081f8a05 in negate_expr (t=0xb7cd3258)
    at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:1167
1167                  tree temp = fold_convert (ntype, TREE_OPERAND (t, 0));
(gdb) call debug_generic_expr (t)
-07fffffff

which has overflowed.

#29 0x08206aa1 in fold_unary (code=NEGATE_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258) at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:6876
#30 0x08212e3e in fold_build1_stat (code=NEGATE_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258) at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:10475
#31 0x081f8a05 in negate_expr (t=0xb7cd3258)
    at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:1167
#32 0x0820cb87 in fold_binary (code=CEIL_DIV_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258, op1=0xb7c4da50)
    at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:8420
#33 0x08212e8e in fold_build2_stat (code=CEIL_DIV_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258, op1=0xb7c4da50)
    at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:10521
#34 0x080fe243 in infer_loop_bounds_from_undefined (loop=0x86a5310)

#32 0x0820cb87 in fold_binary (code=CEIL_DIV_EXPR, type=0xb7c5c284,
    op0=0xb7cd3258, op1=0xb7c4da50)
    at /home/richard/src/gcc-4_1-branch/gcc/fold-const.c:8420
8420        case ROUND_DIV_EXPR:
(gdb) call debug_generic_expr (op0)
-07fffffff
(gdb) call debug_generic_expr (op1)
-1
Comment 2 Joseph S. Myers 2008-07-04 15:53:15 UTC 
Closing 4.1 branch.