Re: [PATCH] Empty redirect_edge_var_map after each pass and function

[Jeff Law <law at redhat dot com>]

On 12/01/2015 11:33 AM, Alan Lawrence wrote:
> I was not able to reduce the testcase below about 30k characters, with e.g.
> #define T_VOID 0
> .... T_VOID ....
> producing the ICE, but manually changing to
> .... 0 ....
> preventing the ICE; as did running the preprocessor as a separate step, or a
> wide variety of options (e.g. -fdump-tree-alias).
Which is almost always an indication that there's a memory corruption, 
or uninitialized memory read or something similar.


> In the end I traced this to loop_unswitch reading stale values from the edge
> redirect map, which is keyed on 'edge' (a pointer to struct edge_def); the map
> entries had been left there by pass_dominator (on a different function), and by
> "chance" the edge *pointers* were the same as to some current edge_defs (even
> though they pointed to structures created by different allocations, the first
> of which had since been freed). Hence the fragility of the testcase and
> environment.
Right.  So the question I have is how/why did DOM leave anything in the 
map.   And if DOM is fixed to not leave stuff lying around, can we then 
assert that nothing is ever left in those maps between passes?  There's 
certainly no good reason I'm aware of why DOM would leave things in this 
state.

Jeff