Bug 41634 - [4.5 Regression] ICE in dom
Summary: [4.5 Regression] ICE in dom
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 4.5.0
: P3 normal
Target Milestone: 4.5.0
Assignee: Richard Biener
URL:
Keywords: ice-on-valid-code
Depends on:
Blocks: 41454
  Show dependency treegraph
 
Reported: 2009-10-08 21:43 UTC by marcus
Modified: 2009-10-09 18:30 UTC (History)
2 users (show)

See Also:
Host:
Target: i?86-*-*
Build:
Known to work:
Known to fail:
Last reconfirmed: 2009-10-09 14:53:55


Attachments
file.i (260 bytes, text/plain)
2009-10-08 21:43 UTC, marcus
Details
debugging patch (582 bytes, patch)
2009-10-09 15:43 UTC, Richard Biener
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description marcus 2009-10-08 21:43:21 UTC
/home/marcus/projects/gcc.trunk/BIN/bin/gcc -m32 -c -O3 -fno-builtin file.i
file.i: In function 'test_readmode':
file.i:4:6: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
Comment 1 marcus 2009-10-08 21:43:46 UTC
Created attachment 18757 [details]
file.i

/home/marcus/projects/gcc.trunk/BIN/bin/gcc -m32 -c -O3 -fno-builtin file.i
Comment 2 Andrew Pinski 2009-10-08 21:46:36 UTC
#0  0x00cb8976 in htab_remove_elt_with_hash (htab=0x43b0dd20, element=0xbffff2e4, hash=2085838349) at /Users/apinski/src/change/gcc/libiberty/hashtab.c:706
#1  0x00672a4e in remove_local_expressions_from_table () at /Users/apinski/src/change/gcc/gcc/tree-ssa-dom.c:836
#2  0x0067702b in dom_opt_leave_block (walk_data=0xbffff468, bb=0x43cfc740) at /Users/apinski/src/change/gcc/gcc/tree-ssa-dom.c:1763
#3  0x00bb6c26 in walk_dominator_tree (walk_data=0xbffff468, bb=0x43cfc740) at /Users/apinski/src/change/gcc/gcc/domwalk.c:205
#4  0x00671d45 in tree_ssa_dominator_optimize () at /Users/apinski/src/change/gcc/gcc/tree-ssa-dom.c:651


Confirmed.
Comment 3 Andrew Pinski 2009-10-08 21:49:14 UTC
This appeared between revision 152380 and 152576.
The only patch which touched dom during that time was:
+2009-10-05  Richard Guenther  <rguenther@suse.de>
+
+       PR tree-optimization/23821
+       * tree-vrp.c (vrp_finalize): Do not perform copy propagation.
+       * tree-ssa-dom.c (cprop_operand): Do not propagate copies into
+       simple IV increments.

But that does not mean it was caused by that patch though.
Comment 4 Richard Biener 2009-10-09 09:50:13 UTC
r152542 works for me (on native i?86).

0>>> COPY D.1540_28 = 13
1>>> COND 1 = D.1540_28 eq_expr 13
1>>> COND 0 = D.1540_28 ne_expr 13
1>>> COND 1 = D.1540_28 le_expr 13
1>>> COND 1 = D.1540_28 ge_expr 13
LKUP STMT D.1539_90 = D.1538_61 plus_expr 1
          D.1539_90 = D.1538_61 + 1;
LKUP STMT D.1540_91 = outbuffer[D.1539_90]
          D.1540_91 = outbuffer[D.1539_90];
LKUP STMT D.1540_91 ne_expr 13
          if (D.1540_91 != 13)
<<<< COND 1 = D.1540_28 ge_expr 13
<<<< COND 1 = D.1540_28 le_expr 13
<<<< COND 0 = D.1540_28 ne_expr 13
<<<< COND 1 = D.1540_28 eq_expr 13
<<<< COND <<< Unknown tree: plus_nomod_expr
  13
   >>>
 = D.1540_28 le_expr 13

there seems to be some memory corruption going on.


==5807== Invalid read of size 4
==5807==    at 0x866C135: remove_local_expressions_from_table (tree-ssa-dom.c:825)
==5807==    by 0x86702B6: dom_opt_leave_block (tree-ssa-dom.c:1763)
==5807==    by 0x8A91AE8: walk_dominator_tree (domwalk.c:205)
==5807==    by 0x866B61E: tree_ssa_dominator_optimize (tree-ssa-dom.c:651)
==5807==    by 0x84A273A: execute_one_pass (passes.c:1514)
==5807==    by 0x84A28DA: execute_pass_list (passes.c:1563)
==5807==    by 0x84A28F6: execute_pass_list (passes.c:1564)
==5807==    by 0x86017C7: tree_rest_of_compilation (tree-optimize.c:392)
==5807==    by 0x881B1B9: cgraph_expand_function (cgraphunit.c:1160)
==5807==    by 0x881B36A: cgraph_expand_all_functions (cgraphunit.c:1219)
==5807==    by 0x881B97C: cgraph_optimize (cgraphunit.c:1460)
==5807==    by 0x881AEA7: cgraph_finalize_compilation_unit (cgraphunit.c:1089)
==5807==  Address 0x45659c8 is 0 bytes inside a block of size 40 free'd
==5807==    at 0x4024866: free (vg_replace_malloc.c:325)
==5807==    by 0x866B1E0: free_expr_hash_elt (tree-ssa-dom.c:553)
==5807==    by 0x8B86FBF: htab_remove_elt_with_hash (hashtab.c:710)
==5807==    by 0x866C1DA: remove_local_expressions_from_table (tree-ssa-dom.c:836)
==5807==    by 0x86702B6: dom_opt_leave_block (tree-ssa-dom.c:1763)
==5807==    by 0x8A91AE8: walk_dominator_tree (domwalk.c:205)
==5807==    by 0x866B61E: tree_ssa_dominator_optimize (tree-ssa-dom.c:651)
==5807==    by 0x84A273A: execute_one_pass (passes.c:1514)
==5807==    by 0x84A28DA: execute_pass_list (passes.c:1563)
==5807==    by 0x84A28F6: execute_pass_list (passes.c:1564)
==5807==    by 0x86017C7: tree_rest_of_compilation (tree-optimize.c:392)
==5807==    by 0x881B1B9: cgraph_expand_function (cgraphunit.c:1160)


... etc, and a lot more follow.
Comment 5 Richard Biener 2009-10-09 14:53:55 UTC
We have the same expr on the stack more than once.
Comment 6 Richard Biener 2009-10-09 15:43:12 UTC
Created attachment 18768 [details]
debugging patch

Ok, the issue is that we insert a stmt for

2>>> 0x8dffd28 STMT D.2003_28 = "0,1,2,3,4,5,6,7,8,9\r\n\r\nA,B,C,D,E\r\nX,Y,Z"[D.2001_61]

multiple times (thus not finding the already existing dup).

patch for debugging that attached.
Comment 7 Richard Biener 2009-10-09 15:54:36 UTC
Breakpoint 5, lookup_avail_expr (stmt=0xb7d591a0, insert=1 '\1')
    at /home/richard/src/trunk/gcc/tree-ssa-dom.c:2254
2254	  slot = htab_find_slot_with_hash (avail_exprs, element, element->hash,
# VUSE <.MEM_21>
D.2003_28 = "0,1,2,3,4,5,6,7,8,9\r\n\r\nA,B,C,D,E\r\nX,Y,Z"[D.2001_61];
(gdb) p element
$10 = (struct expr_hash_elt *) 0x8dffd28
(gdb) p *element
$1 = {lhs = 0xb7d500d0, expr = {type = 0x0, kind = EXPR_SINGLE, ops = {
      single = {rhs = 0xb7d591d4}, unary = {op = 3084227028, opnd = 0x0}, 
      binary = {op = 3084227028, opnd0 = 0x0, opnd1 = 0x0}, call = {
        fn = 0xb7d591d4, pure = 0 '\0', nargs = 0, args = 0x280000}}}, 
  stmt = 0xb7d591a0, hash = 3753424485, stamp = 0x8dffd28}

Breakpoint 5, lookup_avail_expr (stmt=0xb7d5930c, insert=1 '\1')
    at /home/richard/src/trunk/gcc/tree-ssa-dom.c:2254
2254	  slot = htab_find_slot_with_hash (avail_exprs, element, element->hash,
# VUSE <.MEM_21>
D.2003_14 = "0,1,2,3,4,5,6,7,8,9\r\n\r\nA,B,C,D,E\r\nX,Y,Z"[D.2001_61];
(gdb) p element
$11 = (struct expr_hash_elt *) 0x8e2d8b8
(gdb) p *element
$12 = {lhs = 0xb7d32bfc, expr = {type = 0x0, kind = EXPR_SINGLE, ops = {
      single = {rhs = 0xb7d59340}, unary = {op = 3084227392, 
        opnd = 0xb7d306ac}, binary = {op = 3084227392, opnd0 = 0xb7d306ac, 
        opnd1 = 0xb7d32ac4}, call = {fn = 0xb7d59340, pure = 172 '\254', 
        nargs = 3084069572, args = 0xb7c96498}}}, stmt = 0xb7d5930c, 
  hash = 3753424485, stamp = 0x8e2d8b8}

Breakpoint 6, avail_expr_eq (p1=0x8dffd28, p2=0x8e2d8b8)
    at /home/richard/src/trunk/gcc/tree-ssa-dom.c:2340
(gdb) p *(const struct expr_hash_elt *)p1
$13 = {lhs = 0xb7d500d0, expr = {type = 0x0, kind = EXPR_SINGLE, ops = {
      single = {rhs = 0xb7d591d4}, unary = {op = 3084227028, opnd = 0x0}, 
      binary = {op = 3084227028, opnd0 = 0x0, opnd1 = 0x0}, call = {
        fn = 0xb7d591d4, pure = 0 '\0', nargs = 0, args = 0x280000}}}, 
  stmt = 0xb7d591a0, hash = 3753424485, stamp = 0x8dffd28}
(gdb) p *(const struct expr_hash_elt *)p2
$14 = {lhs = 0xb7d32bfc, expr = {type = 0x0, kind = EXPR_SINGLE, ops = {
      single = {rhs = 0xb7d59340}, unary = {op = 3084227392, 
        opnd = 0xb7d306ac}, binary = {op = 3084227392, opnd0 = 0xb7d306ac, 
        opnd1 = 0xb7d32ac4}, call = {fn = 0xb7d59340, pure = 172 '\254', 
        nargs = 3084069572, args = 0xb7c96498}}}, stmt = 0xb7d5930c, 
  hash = 3753424485, stamp = 0x8e2d8b8}
(gdb) call debug_gimple_stmt (0xb7d591a0)
D.2003_28 = "0,1,2,3,4,5,6,7,8,9\r\n\r\nA,B,C,D,E\r\nX,Y,Z"[D.2001_61];
(gdb) call debug_gimple_stmt (0xb7d5930c)
# VUSE <.MEM_21>
D.2003_14 = "0,1,2,3,4,5,6,7,8,9\r\n\r\nA,B,C,D,E\r\nX,Y,Z"[D.2001_61];

whoops?  where did the VOP go?

#1  0x0866c1d7 in remove_local_expressions_from_table ()
    at /home/richard/src/trunk/gcc/tree-ssa-dom.c:836
836	      gcc_assert (slot && *slot == (void *) victim);
(gdb) p victim
$8 = (expr_hash_elt_t) 0x8e2d8d0
(gdb) p *slot
$9 = (void *) 0x8dffd28
Comment 8 Richard Biener 2009-10-09 18:30:22 UTC
Fixed.
Comment 9 Richard Biener 2009-10-09 18:30:24 UTC
Subject: Bug 41634

Author: rguenth
Date: Fri Oct  9 18:30:05 2009
New Revision: 152596

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=152596
Log:
2009-10-09  Richard Guenther  <rguenther@suse.de>

	PR tree-optimization/41634
	* tree-ssa-dom.c (remove_local_expressions_from_table): Assert
	we remove the correct elements.
	(optimize_stmt): Make sure to update stmt operands before
	optimizing redundancies.

	* gcc.c-torture/compile/pr41634.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.c-torture/compile/pr41634.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-dom.c

Comment 10 hjl@gcc.gnu.org 2009-10-15 21:18:20 UTC
Subject: Bug 41634

Author: hjl
Date: Thu Oct 15 21:17:36 2009
New Revision: 152870

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=152870
Log:
2009-10-15  H.J. Lu  <hongjiu.lu@intel.com>

	Backport from mainline:
	2009-10-13  Martin Jambor  <mjambor@suse.cz>

	* gcc.c-torture/compile/pr41661.c: New test.

	2009-10-12  Jerry DeLisle  <jvdelisle@gcc.gnu.org>

	PR libgfortran/41683
	* gfortran.dg/fmt_error_9.f: Add check for repeat count after P.

	2009-10-12  Dodji Seketeli  <dodji@redhat.com>

	PR c++/41570
	* g++.dg/debug/dwarf2/template-params-7.C: New test.

	2009-10-11  Richard Guenther  <rguenther@suse.de>

	PR tree-optimization/41555
	* gcc.dg/torture/pr41555.c: New testcase.

	2009-10-09  Richard Guenther  <rguenther@suse.de>

	PR tree-optimization/41634
	* gcc.c-torture/compile/pr41634.c: New testcase.

	2009-10-08  Michael Matz  <matz@suse.de>

	PR middle-end/41573
	* gcc.dg/pr41573.c: New test.

	2009-10-07  Joseph Myers  <joseph@codesourcery.com>

	PR c/41182
	* gcc.c-torture/compile/pr41182-1.c: New.

Added:
    branches/gcc-4_4-branch/gcc/testsuite/g++.dg/debug/dwarf2/template-params-7.C
      - copied unchanged from r152869, trunk/gcc/testsuite/g++.dg/debug/dwarf2/template-params-7.C
    branches/gcc-4_4-branch/gcc/testsuite/gcc.c-torture/compile/pr41182-1.c
      - copied unchanged from r152869, trunk/gcc/testsuite/gcc.c-torture/compile/pr41182-1.c
    branches/gcc-4_4-branch/gcc/testsuite/gcc.c-torture/compile/pr41634.c
      - copied unchanged from r152869, trunk/gcc/testsuite/gcc.c-torture/compile/pr41634.c
    branches/gcc-4_4-branch/gcc/testsuite/gcc.c-torture/compile/pr41661.c
      - copied unchanged from r152868, trunk/gcc/testsuite/gcc.c-torture/compile/pr41661.c
    branches/gcc-4_4-branch/gcc/testsuite/gcc.dg/pr41573.c
      - copied unchanged from r152869, trunk/gcc/testsuite/gcc.dg/pr41573.c
    branches/gcc-4_4-branch/gcc/testsuite/gcc.dg/torture/pr41555.c
      - copied unchanged from r152869, trunk/gcc/testsuite/gcc.dg/torture/pr41555.c
    branches/gcc-4_4-branch/gcc/testsuite/gfortran.dg/fmt_error_9.f
      - copied unchanged from r152869, trunk/gcc/testsuite/gfortran.dg/fmt_error_9.f
Modified:
    branches/gcc-4_4-branch/gcc/testsuite/ChangeLog