Bug 66794

Summary: [4.9 Regression] ICE at -O2 and -O3 on x86_64-linux-gnu
Product: gcc Reporter: Zhendong Su <su>
Component: tree-optimizationAssignee: Richard Biener <rguenth>
Status: RESOLVED FIXED    
Severity: normal    
Priority: P2    
Version: 6.0   
Target Milestone: 4.9.4   
Host: Target:
Build: Known to work: 5.2.0, 6.0
Known to fail: 4.9.3, 5.1.0 Last reconfirmed: 2015-07-08 00:00:00
Bug Depends on: 66807    
Bug Blocks:    

Description Zhendong Su 2015-07-07 21:45:05 UTC
The following code causes an ICE when compiled with the current gcc trunk at -O3 on x86_64-linux-gnu in both 32-bit and 64-bit modes. 

It is a regression from 5.1.x. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 6.0.0 20150707 (experimental) [trunk revision 225501] (GCC) 
$ 
$ gcc-trunk -Os -c small.c
small.c: In function ‘fn1’:
small.c:18:10: warning: function returns address of local variable [-Wreturn-local-addr]
   return *c;
          ^
small.c:12:7: note: declared here
   int f, **g = &b;
       ^
$ gcc-5.1 -O2 -c small.c
small.c: In function ‘fn1’:
small.c:18:10: warning: function may return address of local variable [-Wreturn-local-addr]
   return *c;
          ^
small.c:12:7: note: declared here
   int f, **g = &b;
       ^
$ 
$ gcc-trunk -O2 -c small.c
small.c: In function ‘fn1’:
small.c:18:10: warning: function may return address of local variable [-Wreturn-local-addr]
   return *c;
          ^
small.c:12:7: note: declared here
   int f, **g = &b;
       ^
small.c:10:1: error: dominator of 4 status unknown
 fn1 ()
 ^
small.c:10:1: internal compiler error: Segmentation fault
0xbb296f crash_signal
	../../gcc-trunk/gcc/toplev.c:360
0x76ac43 verify_dominators(cdi_direction)
	../../gcc-trunk/gcc/dominance.c:1059
0x76aed7 calculate_dominance_info(cdi_direction)
	../../gcc-trunk/gcc/dominance.c:685
0xcd85e4 execute
	../../gcc-trunk/gcc/tree-ssa-dse.c:404
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$ 


------------------------------


int a, *b, e;
static int **c = &b;

struct
{
  int f0;
} d;

int *
fn1 ()
{
  int f, **g = &b;
  e = a;
  for (; a;)
    for (; d.f0; d.f0++)
      ;
  *g = &f;
  return *c;
}
Comment 1 Richard Biener 2015-07-08 08:04:35 UTC
So this means post-dominators are corrupt at then entry to DSE.  Usually passes
should always release post-dominators - it seems there is at least one that fails to do that.  isolate-paths in this case.  Passes are not good at making sure
to release post-dom-info when they invalidate it.

The regression is due to extra checking.

Index: gcc/gimple-ssa-isolate-paths.c
===================================================================
--- gcc/gimple-ssa-isolate-paths.c      (revision 225504)
+++ gcc/gimple-ssa-isolate-paths.c      (working copy)
@@ -501,10 +501,10 @@ gimple_ssa_isolate_erroneous_paths (void
   /* We scramble the CFG and loop structures a bit, clean up
      appropriately.  We really should incrementally update the
      loop structures, in theory it shouldn't be that hard.  */
+  free_dominance_info (CDI_POST_DOMINATORS);
   if (cfg_altered)
     {
       free_dominance_info (CDI_DOMINATORS);
-      free_dominance_info (CDI_POST_DOMINATORS);
       loops_state_set (LOOPS_NEED_FIXUP);
       return TODO_cleanup_cfg | TODO_update_ssa;
     }

fixes it.
Comment 2 Richard Biener 2015-07-08 11:48:14 UTC
Author: rguenth
Date: Wed Jul  8 11:47:42 2015
New Revision: 225545

URL: https://gcc.gnu.org/viewcvs?rev=225545&root=gcc&view=rev
Log:
2015-07-08  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/66794
	* passes.c (execute_function_todo): Assert that post-dominators
	are not computed.
	* gimple-ssa-isolate-paths.c (gimple_ssa_isolate_erroneous_paths):
	Free post-dominators.

	* gcc.dg/torture/pr66794.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr66794.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/gimple-ssa-isolate-paths.c
    trunk/gcc/passes.c
    trunk/gcc/testsuite/ChangeLog
Comment 3 Richard Biener 2015-07-08 11:51:43 UTC
Fixed on trunk.  The issue is latent on the branches though, possibly using broken post-dom info.
Comment 4 Richard Biener 2015-07-10 12:34:00 UTC
Author: rguenth
Date: Fri Jul 10 12:33:28 2015
New Revision: 225671

URL: https://gcc.gnu.org/viewcvs?rev=225671&root=gcc&view=rev
Log:
2015-07-10  Richard Biener  <rguenther@suse.de>

	Backport from mainline
	2015-07-10  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/66823
	* tree-if-conv.c (memrefs_read_or_written_unconditionally): Fix
	inverted predicate.

	* gcc.dg/vect/pr61194.c: Remove -ftree-loop-if-convert-stores
	which should not be necessary.  XFAIL.

	2015-07-08  Richard Biener  <rguenther@suse.de>

	PR middle-end/43341
	* toplev.c (compile_file): Reset maximum_field_alignment after parsing.

	2015-07-08  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/66794
	* gimple-ssa-isolate-paths.c (gimple_ssa_isolate_erroneous_paths):
	Free post-dominators.

	* gcc.dg/torture/pr66794.c: New testcase.

Added:
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr66794.c
Modified:
    branches/gcc-5-branch/gcc/ChangeLog
    branches/gcc-5-branch/gcc/gimple-ssa-isolate-paths.c
    branches/gcc-5-branch/gcc/testsuite/ChangeLog
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/vect/pr61194.c
    branches/gcc-5-branch/gcc/toplev.c
    branches/gcc-5-branch/gcc/tree-if-conv.c
Comment 5 Richard Biener 2016-02-11 13:41:05 UTC
Author: rguenth
Date: Thu Feb 11 13:40:31 2016
New Revision: 233344

URL: https://gcc.gnu.org/viewcvs?rev=233344&root=gcc&view=rev
Log:
2016-02-11  Richard Biener  <rguenther@suse.de>

	Backport from mainline
	2015-02-18  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/62217
	* tree-ssa-dom.c (cprop_operand): Avoid propagating copies
	into BIVs.

	* gcc.dg/tree-ssa/cunroll-11.c: New testcase.

	2015-06-18  Richard Biener  <rguenther@suse.de>

	Backport from mainline
	2015-06-03  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/66375
	* tree-scalar-evolution.c (follow_ssa_edge_binary): First
	add to the evolution before following SSA edges.

	* gcc.dg/torture/pr66375.c: New testcase.

	2015-06-23  Richard Biener  <rguenther@suse.de>

	Backport from mainline
	2015-06-09  Richard Biener  <rguenther@suse.de>

	PR middle-end/66413
	* tree-inline.c (insert_init_debug_bind): Unshare value.

	* gcc.dg/torture/pr66413.c: New testcase.

	2015-07-08  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/66794
	* gimple-ssa-isolate-paths.c (gimple_ssa_isolate_erroneous_paths):
	Free post-dominators.

	* gcc.dg/torture/pr66794.c: New testcase.

	2015-07-10  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/66823
	* tree-if-conv.c (memrefs_read_or_written_unconditionally): Fix
	inverted predicate.

Added:
    branches/gcc-4_9-branch/gcc/testsuite/gcc.dg/torture/pr66375.c
    branches/gcc-4_9-branch/gcc/testsuite/gcc.dg/torture/pr66413.c
    branches/gcc-4_9-branch/gcc/testsuite/gcc.dg/torture/pr66794.c
    branches/gcc-4_9-branch/gcc/testsuite/gcc.dg/tree-ssa/cunroll-11.c
Modified:
    branches/gcc-4_9-branch/gcc/ChangeLog
    branches/gcc-4_9-branch/gcc/gimple-ssa-isolate-paths.c
    branches/gcc-4_9-branch/gcc/gimple.c
    branches/gcc-4_9-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_9-branch/gcc/tree-if-conv.c
    branches/gcc-4_9-branch/gcc/tree-inline.c
    branches/gcc-4_9-branch/gcc/tree-scalar-evolution.c
    branches/gcc-4_9-branch/gcc/tree-ssa-dom.c
Comment 6 Richard Biener 2016-02-11 13:46:29 UTC
Fixed.