[Bug tree-optimization/67659] [5 regression] ICE: segfault: Linux kernel/rcu/tree.c:3261:6

["trippels at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67659

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW
                 CC|                            |trippels at gcc dot gnu.org
          Component|other                       |tree-optimization
      Known to work|                            |4.9.3, 6.0
            Summary|ICE: Linux                  |[5 regression] ICE:
                   |kernel/rcu/tree.c:3261:6    |segfault: Linux
                   |                            |kernel/rcu/tree.c:3261:6
      Known to fail|                            |5.2.1

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
markus@x4 tmp % cat tree.i
struct list_head {
  struct list_head *next, *prev;
} typedef call_rcu_func_t;
struct __wait_queue_head {
  int lock;
  struct list_head task_list;
};
struct completion {
  int done;
  struct __wait_queue_head wait;
};
int call_rcu_sched;
void fn1(unsigned long p1) {
  __asm__("" : : : "memory");
  if (~0UL / 2 >= p1) {
    call_rcu_func_t __crcu_array[] = {call_rcu_sched};
    int __n = sizeof({});
    struct completion __rs_array[__n];
    fn2(0, 1, __crcu_array, __rs_array);
  }
}

void fn3(unsigned long p1) {
  __asm__("" : : : "memory");
  if (~0UL / 2 >= p1) {
    call_rcu_func_t __crcu_array[] = {call_rcu_sched};
    int __n = sizeof({});
    struct completion __rs_array[__n];
    fn2(0, 1, __crcu_array, __rs_array);
  }
}

markus@x4 tmp % gdb --args gcc -O3 -c -w tree.i
Reading symbols from gcc...done.
(gdb) run
Starting program: /usr/bin/gcc -O3 -c -w tree.i
process 16753 is executing new program:
/usr/x86_64-pc-linux-gnu/gcc-bin/5.2.1/gcc
[New process 16757]
process 16757 is executing new program:
/usr/libexec/gcc/x86_64-pc-linux-gnu/5.2.1/cc1

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 16757]
0x00000000007fce50 in ccp_fold_stmt(gimple_stmt_iterator*) [clone .cold.97] ()
(gdb) bt
#0  0x00000000007fce50 in ccp_fold_stmt(gimple_stmt_iterator*) [clone .cold.97]
()
#1  0x0000000000f509c1 in
substitute_and_fold_dom_walker::before_dom_children(basic_block_def*) ()
#2  0x000000000107f821 in dom_walker::walk(basic_block_def*) ()
#3  0x0000000000f505e1 in substitute_and_fold(tree_node* (*)(tree_node*), bool
(*)(gimple_stmt_iterator*), bool) ()
#4  0x0000000000ee9b2a in (anonymous namespace)::pass_ccp::execute(function*)
()
#5  0x0000000000721a13 in execute_one_pass(opt_pass*) ()
#6  0x0000000000722fb2 in execute_pass_list_1(opt_pass*) ()
#7  0x0000000000722fe3 in execute_pass_list_1(opt_pass*) ()
#8  0x0000000000e34619 in execute_pass_list(function*, opt_pass*) ()
#9  0x0000000001104e27 in symbol_table::compile() ()
#10 0x00000000011045fe in symbol_table::finalize_compilation_unit() ()
#11 0x0000000000c2b473 in c_write_global_declarations() ()
#12 0x0000000001148411 in compile_file() ()
#13 0x0000000000c20831 in toplev::main(int, char**) ()
#14 0x0000000000c20c8e in main ()

-fno-ipa-icf "fixes" the issue.