cc1 crash with -funroll-all-loops analyzed

[Franz Sirl <Franz dot Sirl-kernel at lauterbach dot com>]

Hi,

the testcase compile/980329-1.c compiled with -O1 -funroll-all-loops is failing
on powerpc-linux-gnu in single_set() while dereferencing a NULL insn.
single_set() was called by can_reverse_comparison(), which got these parameters:

(gdb) p debug_rtx(comparison)

(gt (reg:CC 147)
    (const_int 0 [0x0]))

(gdb) p debug_rtx(insn)

(jump_insn 335 334 0 (set (pc)
        (if_then_else (gt (reg:CC 147)
                (const_int 0 [0x0]))
            (label_ref 0)
            (pc))) -1 (nil)
    (nil))

The NULL insn is generated by a call to prev_nonnote_insn(), but the
previous insn 334 is:

(gdb) p debug_rtx(insn)

(note 334 0 335 "" NOTE_INSN_DELETED)

It looks as if either insn 334 or insn 335 have not been setup correctly in
copy_loop_body(). The complete backtrace is:

(gdb) bt
#0  prev_nonnote_insn (insn=0x0) at ../../../egcsm/gcc/emit-rtl.c:2083
#1  0x18f40c8 in can_reverse_comparison_p (comparison=0x0, insn=0x1b1eaf0) at ../../../egcsm/gcc/jump.c:3153
#2  0x18f58c0 in invert_exp (x=0x1b1eac0, insn=0x1b1eaf0) at ../../../egcsm/gcc/jump.c:4175
#3  0x18f5a1c in invert_exp (x=0x1b1eab0, insn=0x1b1eaf0) at ../../../egcsm/gcc/jump.c:4192
#4  0x191fe2c in copy_loop_body (copy_start=0x1b18fa8, copy_end=0x1b190d0, map=0x7fffd190, exit_label=0x1b1ea38, last_iteration=0,
    unroll_type=UNROLL_NAIVE, start_label=0x1b18fc0, loop_end=0x1b19168, insert_before=0x1b19168, copy_notes_from=0x1b19168)
    at ../../../egcsm/gcc/unroll.c:1987
#5  0x191ee90 in unroll_loop (loop_end=0x1b19168, insn_count=28180480, loop_start=0x1b18fa8, end_insert_before=0x1b19180, loop_info=0x7fffd588,
    strength_reduce_p=28437608) at ../../../egcsm/gcc/unroll.c:1240
#6  0x1913194 in strength_reduce (scan_start=0x1b18fc0, end=0x1b19168, loop_top=0x0, insn_count=3, loop_start=0x1b18fa8, loop_end=0x1b19168,
    loop_cont=0x1b19150, unroll_p=1, bct_p=1) at ../../../egcsm/gcc/loop.c:3892
#7  0x190e1c4 in scan_loop (loop_start=0x1b18fa8, end=0x1b19168, loop_cont=0x1b19150, unroll_p=1, bct_p=1) at ../../../egcsm/gcc/loop.c:1172
#8  0x190c958 in loop_optimize (f=0x1b017a0, dumpfile=0x1b1eaf0, unroll_p=1, bct_p=1) at ../../../egcsm/gcc/loop.c:574
#9  0x1805f88 in rest_of_compilation (decl=0x1b14938) at ../../../egcsm/gcc/toplev.c:3940
#10 0x1a297d4 in finish_function (nested=0) at ../../../egcsm/gcc/c-decl.c:7268
#11 0x1a11d20 in yyparse () at c-parse.y:313(note 259 257 266 "" NOTE_INSN_LOOP_CONT)

(note 266 259 269 "" NOTE_INSN_LOOP_END)

(note 269 266 272 0 NOTE_INSN_BLOCK_END)

(note 272 269 287 0 NOTE_INSN_BLOCK_END)

(note 287 272 289 0 NOTE_INSN_BLOCK_END)

#12 0x1804638 in compile_file (name=0x1ae0000 "") at ../../../egcsm/gcc/toplev.c:3257
#13 0x1808adc in main (argc=6, argv=0x7ffffb84) at ../../../egcsm/gcc/toplev.c:5433
#14 0x16df7d4 in __libc_start_main () at ../sysdeps/powerpc/elf/libc-start.c:106

The offending loop looks like this in the .jump dump, unroll_loop() is called
with insn 247 as loop_start and insn 257 as loop_end:

(note 241 179 242 "" NOTE_INSN_LOOP_END)

(code_label 242 241 244 30 "" [num uses: 1])

(note 244 242 246 "" NOTE_INSN_LOOP_BEG)

(note 246 244 247 "" NOTE_INSN_DELETED)

(note 247 246 256 "" NOTE_INSN_LOOP_BEG)

(note 256 247 255 "" NOTE_INSN_LOOP_CONT)

(code_label 255 256 250 40 "" [num uses: 1])

(insn 250 255 251 (set (reg:SI 146)
        (plus:SI (reg/v:SI 87)
            (const_int 1 [0x1]))) -1 (nil)
    (nil))

(insn 251 250 252 (set (reg:CC 147)
        (compare:CC (reg:SI 146)
            (const_int 0 [0x0]))) -1 (nil)
    (nil))

(jump_insn 252 251 257 (set (pc)
        (if_then_else (gt (reg:CC 147)
                (const_int 0 [0x0]))
            (label_ref 255)
            (pc))) -1 (nil)
    (nil))

(note 257 252 259 "" NOTE_INSN_LOOP_END)

(note 259 257 266 "" NOTE_INSN_LOOP_CONT)

(note 266 259 269 "" NOTE_INSN_LOOP_END)

(note 269 266 272 0 NOTE_INSN_BLOCK_END)

(note 272 269 287 0 NOTE_INSN_BLOCK_END)

(note 287 272 289 0 NOTE_INSN_BLOCK_END)

Hope this helps,
Franz.