Bug 48975 - [4.6/4.7 Regression] ICE in execute_cse_reciprocals() with -fno-tree-slp-vectorize
[4.6/4.7 Regression] ICE in execute_cse_reciprocals() with -fno-tree-slp-vect...
Status: RESOLVED FIXED
Product: gcc
Classification: Unclassified
Component: tree-optimization
4.7.0
: P3 normal
: 4.6.1
Assigned To: Jakub Jelinek
: ice-checking
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-05-12 08:16 UTC by Arthur O'Dwyer
Modified: 2011-05-12 17:49 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Known to work: 4.4.5, 4.5.1
Known to fail: 4.6.0, 4.7.0
Last reconfirmed: 2011-05-12 09:14:00


Attachments
Output of "ajo-gcc -w -O1 -finline-functions -ftree-vectorize -ffast-math -fno-tree-slp-vectorize -c test1281247203.c" (2.22 KB, text/plain)
2011-05-12 08:16 UTC, Arthur O'Dwyer
Details
gcc46-pr48975.patch (1.28 KB, patch)
2011-05-12 11:09 UTC, Jakub Jelinek
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Arthur O'Dwyer 2011-05-12 08:16:22 UTC
Created attachment 24232 [details]
Output of "ajo-gcc -w -O1 -finline-functions -ftree-vectorize -ffast-math -fno-tree-slp-vectorize -c test1281247203.c"

This reproduces for me with svn revision 173589 (2011-05-09). It doesn't reproduce with gcc 4.5.1. I'm on Ubuntu 10.10, x86-64.

cat >test1281247203.c <<EOF
static int ADD(int x) {
  return (x > 0) ? 0 : x+1;
}

void func_65(unsigned int x) {
    int l_376 = -1;
  lbl_469:
    while (x) {
      x = ADD(x);
    }
}
EOF
gcc -w -O1 -finline-functions -ftree-vectorize -ffast-math -fno-tree-slp-vectorize -c test1281247203.c

test1281247203.c: In function ‘func_65’:
test1281247203.c:5:6: internal compiler error: in execute_cse_reciprocals, at tree-ssa-math-opts.c:512


This test case is reduced from the output of Csmith 2.1.0 (git hash 541a6480,
https://github.com/csmith-project/csmith/), using the following command line:
csmith --no-paranoid --longlong --no-pointers --arrays --jumps --consts --no-volatiles --no-checksum --no-divs --no-muls --no-bitfields --no-packed-struct -s 1281247203
Comment 1 Jakub Jelinek 2011-05-12 09:14:00 UTC
Confirmed, started in between r160500 and r161170, ICEs even on 4.6 branch if --enable-checking.
Comment 2 Jakub Jelinek 2011-05-12 09:25:46 UTC
tree-if-conv.c fails to free_bb_predicate on some bbs, thus bb->aux is non-NULL on entry to following passes.
Comment 3 Jakub Jelinek 2011-05-12 11:09:36 UTC
Created attachment 24237 [details]
gcc46-pr48975.patch

The problem was that combine_blocks removes most of the bbs in the loop, keeps around only header, latch and maybe exit_bb, but free_bb_predicate is called in the caller on ifc_bbs entries starting with 0 (loop->header which stays, fine) up to number of remaining bbs in the loop - 1 (that number can be at most 3).
But nothing reordered ifc_bbs entries, so it very well can free_bb_predicate of a removed bb (use after free) and can fail to free_bb_predicate for latch or exit_bb.  This patch fixes it by free_bb_predicate for all bbs in the loop already before (some of) the bbs are removed and ensures the caller doesn't try to do that again.
Comment 4 Jakub Jelinek 2011-05-12 17:44:26 UTC
Author: jakub
Date: Thu May 12 17:44:23 2011
New Revision: 173709

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173709
Log:
	PR tree-optimization/48975
	* tree-if-conv.c (combine_blocks): Call free_bb_predicate
	on all bbs here and free and clear ifc_bbs at the end.

	* gcc.dg/pr48975.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr48975.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-if-conv.c
Comment 5 Jakub Jelinek 2011-05-12 17:46:21 UTC
Author: jakub
Date: Thu May 12 17:46:15 2011
New Revision: 173710

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173710
Log:
	PR tree-optimization/48975
	* tree-if-conv.c (combine_blocks): Call free_bb_predicate
	on all bbs here and free and clear ifc_bbs at the end.

	* gcc.dg/pr48975.c: New test.

Added:
    branches/gcc-4_6-branch/gcc/testsuite/gcc.dg/pr48975.c
Modified:
    branches/gcc-4_6-branch/gcc/ChangeLog
    branches/gcc-4_6-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_6-branch/gcc/tree-if-conv.c
Comment 6 Jakub Jelinek 2011-05-12 17:49:48 UTC
Fixed.