This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
RFA: dominator opts
- From: Dale Johannesen <dalej at apple dot com>
- To: gcc mailing list <gcc at gcc dot gnu dot org>
- Cc: Dale Johannesen <dalej at apple dot com>
- Date: Fri, 25 Feb 2005 17:25:26 -0800
- Subject: RFA: dominator opts
Our tree is a couple of months behind mainline and I can't duplicate
this one in 4.0,
but I could use some help in understanding why. On pass 3 of dom I
have a cfg
that looks like this:
bb1 (succ =2,3)
bb2 (succ=5) p2 = ...
bb3 (succ=4, 5) p3= ...
bb4 (succ=5)
bb5 (succ=6, 7) p5 = PHI (p2, p3)
bb6 (succ=8) p6 = PHI (p5)
bb7 (succ=8) p7 = PHI (p5)
bb8 p8 = PHI (p6, p7)
The dominator opts propagate p5 forwards, observe that p8 is now
single-valued,
and record p5 as TREE_SSA_VALUE (p8):
bb1 (succ =2,3)
bb2 (succ=5) p2 = ...
bb3 (succ=4, 5) p3= ...
bb4 (succ=5)
bb5 (succ=6, 7) p5 = PHI (p2, p3)
bb6 (succ=8)
bb7 (succ=8)
bb8 p8 = PHI (p5, p5) Value = p5
Jump threading decides that the (3,5) edge can be short circuited, and
creates
a copy of bb5 with a duplicate definition of p5:
bb1 (succ =2,3)
bb2 (succ=5) p2 = ...
bb3 (succ=4, 5b) p3= ...
bb4 (succ=5)
bb5 (succ=6, 7) p5 = PHI (p2, p3)
bb5b (succ=7) p5 = PHI (p3)
bb6 (succ=8)
bb7 (succ=8)
bb8 p8 = PHI (p5, p5) Value = p5
rewrite_ssa_into_ssa renames the duplicate p5's:
bb1 (succ =2,3)
bb2 (succ=5) p2 = ...
bb3 (succ=4, 5b) p3= ...
bb4 (succ=5)
bb5 (succ=6, 7) p5a = PHI (p2, p3)
bb5b (succ=7) p5b = PHI (p3)
bb6 (succ=8)
bb7 (succ=8)
bb8 p8 = PHI (p5a, p5b) Value = p5
But nobody has cleared the SSA_VALUE of p8, so it still points to p5,
which
has been freed. This causes a fault on the next iteration, when
cprop_into_successor_phis tries to look at that value.
The crash can be easily fixed in this last routine, but is that the
right approach?
I don't understand what mechanism is supposed to prevent this. Thanks.