| Summary: | [4.4 Regression] cc1 segfault from svn 137122 | ||
|---|---|---|---|
| Product: | gcc | Reporter: | John Regehr <regehr> |
| Component: | target | Assignee: | Jakub Jelinek <jakub> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | fang, gcc-bugs, pinskia |
| Priority: | P1 | Keywords: | ice-on-valid-code |
| Version: | 4.4.0 | ||
| Target Milestone: | 4.4.0 | ||
| Host: | i686-pc-linux-gnu | Target: | i686-pc-linux-gnu |
| Build: | i686-pc-linux-gnu | Known to work: | |
| Known to fail: | Last reconfirmed: | 2008-10-07 16:16:48 | |
| Bug Depends on: | |||
| Bug Blocks: | 33424, 37290 | ||
| Attachments: | Patch for cse.c | ||
|
Description
John Regehr
2008-06-25 22:01:37 UTC
Confirmed. We endlessly recurse in cse_cc_succs. Created attachment 15859 [details]
Patch for cse.c
I have looked at the debug dumps for the testcase.
This seems like a very rare case:
1. -O3 turns on the loop unswitching pass (-funswitch-loops),
which transforms the function into two loops guarded by a
conditional branch from a header block.
2. During cse2 (the immediately next pass),
cse.c:cse_main() transforms that conditional branch into a jump,
cutting off the connection to one of the loops.
3. The cut off loop becomes segregated from the other basic blocks,
and becomes a circular loop, with a single edge acting as both the
entry and latch edge.
4. This cut off loop still contains control flow, and sets CC within.
cse.c:cse_condition_reg() calls the recursive cse_cc_succs() to delete
redundant CC setters on this circular loop.
5. cse.c:cse_cc_succs() uses the "single predecessor edge" condition as the
stopping control flow test, which in this case of a single edge circular
loop (a "ring" like control flow structure), fails to properly stop the
recursion. cse_cc_succs() then blows up the stack and segfaults.
The proposed fix is to record visited basic blocks during the
recursive traversal, see the enclosed patch.
This one isn't reproducible for me on the trunk. I've reproduced PR37341 though. And I believe your patch is an overkill, as cse_cc_succs only recurses if edge destination has a single predecessor. So IMHO you don't need to keep a bitmap of visited blocks, as the only way to reach endless recursion is if you eventually reach the original bb cse_condition_code_reg called cse_cc_succs with, as if there is a smaller loop there would be some bb with more than one predecessor. To fix this, we can either add an extra argument to cse_cc_succs (the original bb) and bail if e->dest is equal to orig_bb; IMHO this is the cheapest variant), or we could call find_unreachable_blocks () if tem > 0 before cse_condition_code_reg and disregard (bb->flags & BB_REACHABLE) == 0 bb's (or delete_unreachable_blocks ()). Subject: Bug 36635 Author: jakub Date: Wed Oct 8 08:12:25 2008 New Revision: 140966 URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=140966 Log: PR target/36635 PR target/37290 PR rtl-optimization/37341 * cse.c (cse_cc_succs): Add ORIG_BB argument, don't follow edges to ORIG_BB, pass through ORIG_BB recursively. (cse_condition_code_reg): Adjust caller. * gcc.c-torture/compile/pr37341.c: New test. Added: trunk/gcc/testsuite/gcc.c-torture/compile/pr37341.c Modified: trunk/gcc/ChangeLog trunk/gcc/cse.c trunk/gcc/testsuite/ChangeLog Fixed. |