Bug 49000 - [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g
Summary: [4.6/4.7 Regression] ICE: verify_ssa failed with -O2 -g
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 4.7.0
: P3 normal
Target Milestone: 4.6.1
Assignee: Jakub Jelinek
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-05-14 18:21 UTC by Arthur O'Dwyer
Modified: 2011-05-23 09:24 UTC (History)
8 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2011-05-14 23:45:11


Attachments
Output of "ajo-gcc -w -O2 -g test1426113557.c -v" (885 bytes, text/plain)
2011-05-14 18:21 UTC, Arthur O'Dwyer
Details
gcc46-pr49000.patch (647 bytes, patch)
2011-05-17 16:33 UTC, Jakub Jelinek
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Arthur O'Dwyer 2011-05-14 18:21:39 UTC
Created attachment 24248 [details]
Output of "ajo-gcc -w -O2 -g test1426113557.c -v"

This reproduces for me with svn revision 173589 (2011-05-09). It doesn't
reproduce with gcc 4.5.1. I'm on Ubuntu 10.10, x86-64.

cat >test1426113557.c <<EOF
static MUL(int ui1, int ui2) {
  return (ui1) * (ui2);
}

static int func_60(int *p_61) {
    return (*p_61);
}

void func_97() {
    int l_234 = 42;
    int *l_342 = &l_234;
    MUL(func_60(&l_234), 3);
}

void func_1(void) {
    func_97();
}
EOF
gcc -w -O2 -g test1426113557.c

test1426113557.c: In function ‘func_1’:
test1426113557.c:17:1: error: expected an SSA_NAME object
test1426113557.c:17:1: error: in statement
# DEBUG D#1 => l_234
test1426113557.c:17:1: internal compiler error: verify_ssa failed


This test case is reduced from the output of Csmith 2.1.0 (git hash 541a6480,
https://github.com/csmith-project/csmith/), using the following command line:
csmith --no-paranoid --no-longlong --pointers --no-arrays --no-jumps --no-consts --no-volatiles --checksum --no-divs --muls --no-bitfields --no-packed-struct -s 1426113557
Comment 1 H.J. Lu 2011-05-14 23:45:11 UTC
It is caused by revision 165964:

http://gcc.gnu.org/ml/gcc-cvs/2010-10/msg01151.html
Comment 2 Ian Lance Taylor 2011-05-16 18:00:37 UTC
Extremely unlikely that that patch introduced the bug.  That patch just fixes a bug introduced by

2010-09-10  Martin Jambor  <mjambor@suse.cz>

	PR tree-optimization/44972
	* ipa-prop.c (ipa_modify_call_arguments): Build MEM_REF instead of
	calling build_ref_for_offset.

Since that patch, Martin has rewritten the code further.

Adding Martin to CC in case this is somehow related to that work.

As far as I can see, the bug here is either that a GIMPLE_DEBUG statement has been created with a memory op, or that gimple_has_mem_ops returns false for GIMPLE_DEBUG.

It looks like the GIMPLE_DEBUG statement is created when l_234 is addressable, but l_234 later becomes addressable due to inlining.  So something has to change somewhere when that happens.
Comment 3 Ian Lance Taylor 2011-05-16 18:01:25 UTC
Adding lxo as this is related to DEBUG insns.
Comment 4 Jakub Jelinek 2011-05-17 08:19:15 UTC
TREE_ADDRESSABLE is cleared by maybe_optimize_var during execute_update_addresses_taken.  If the debug stmt contains just the VAR_DECL, it will be renamed, but in this case it is MEM_REF and for some reason isn't
renamed in that case (if I manually change it to the VAR_DECL, it is).
Later on fold_stmt_1 on the debug stmt performs maybe_fold_reference and optimizes the MEM_REF into the VAR_DECL and triggers the checking failure.
If maybe_fold_reference is used already when the DEBUG stmt is created, it will
be just a VAR_DECL and thus it will work, but not sure if that is the way we want to go.
Comment 5 Richard Biener 2011-05-17 09:40:20 UTC
(In reply to comment #4)
> TREE_ADDRESSABLE is cleared by maybe_optimize_var during
> execute_update_addresses_taken.  If the debug stmt contains just the VAR_DECL,
> it will be renamed, but in this case it is MEM_REF and for some reason isn't
> renamed in that case (if I manually change it to the VAR_DECL, it is).
> Later on fold_stmt_1 on the debug stmt performs maybe_fold_reference and
> optimizes the MEM_REF into the VAR_DECL and triggers the checking failure.
> If maybe_fold_reference is used already when the DEBUG stmt is created, it will
> be just a VAR_DECL and thus it will work, but not sure if that is the way we
> want to go.

Hm, I thought we fold all debug stmts initially.  Probably update-address-taken
should handle debug-stmts in the if (update_vops) path similar to how it
handles other mem-refs.  But I suppose it would have to drop debug stmts
in case it cannot rewrite them(?)
Comment 6 Jakub Jelinek 2011-05-17 10:03:08 UTC
Not always, it is fine to keep say &a around even when a is no longer addressable - then we emit is as (debug_implicit_ptr a).  So, if possible ADDR_EXPR of the var should stay as is, but certainly what can be rewritten should be.
Comment 7 Jakub Jelinek 2011-05-17 16:33:56 UTC
Created attachment 24263 [details]
gcc46-pr49000.patch

Untested fix.
Comment 8 Jakub Jelinek 2011-05-17 17:03:00 UTC
Needs to be guarded additionally with && gimple_debug_bind_has_value_p (stmt)
otherwise it doesn't get too far.
Comment 9 Arthur O'Dwyer 2011-05-18 00:48:32 UTC
Please also check any proposed fix against this second failure, which looks to me as if it's caused by the same thing.  I've renamed homologous structures to emphasize the similarity.

cat >test1875040564.c <<EOF
extern int g_5b;
static int *func_60b(int **p) { return *p; }
void func_97b(int *p_19b) {
    int *l_234b = &g_5b;
    int **l_25b = &l_234b;

    p_19b = func_60b(&l_234b);
    escape(0 == &p_19b);
}
int func_1b() {
  func_97b(0);
}
EOF
gcc -w -O2 -g -c test1875040564.c 

test1875040564.c: In function ‘func_1b’:
test1875040564.c:12:1: error: expected an SSA_NAME object
test1875040564.c:12:1: error: in statement
# DEBUG D#1 => l_234b
test1875040564.c:12:1: internal compiler error: verify_ssa failed

This second test case is reduced from the output of "csmith --no-paranoid --longlong --pointers --arrays --jumps --no-consts --no-volatiles --no-checksum --divs --no-muls --no-bitfields --no-packed-struct -s 1875040564".
Comment 10 H.J. Lu 2011-05-18 03:29:11 UTC
(In reply to comment #9)
> Please also check any proposed fix against this second failure, which looks to
> me as if it's caused by the same thing.  I've renamed homologous structures to
> emphasize the similarity.
> 
> cat >test1875040564.c <<EOF
> extern int g_5b;
> static int *func_60b(int **p) { return *p; }
> void func_97b(int *p_19b) {
>     int *l_234b = &g_5b;
>     int **l_25b = &l_234b;
> 
>     p_19b = func_60b(&l_234b);
>     escape(0 == &p_19b);
> }
> int func_1b() {
>   func_97b(0);
> }
> EOF
> gcc -w -O2 -g -c test1875040564.c 
> 
> test1875040564.c: In function ‘func_1b’:
> test1875040564.c:12:1: error: expected an SSA_NAME object
> test1875040564.c:12:1: error: in statement
> # DEBUG D#1 => l_234b
> test1875040564.c:12:1: internal compiler error: verify_ssa failed
> 
>

I think this is a difference bug.
Comment 11 Jakub Jelinek 2011-05-18 06:05:53 UTC
It is the same bug actually and is also fixed by the patch.  I'll post the patch momentarily.
Comment 12 Jakub Jelinek 2011-05-18 09:22:45 UTC
Author: jakub
Date: Wed May 18 09:22:41 2011
New Revision: 173849

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173849
Log:
	PR tree-optimization/49000
	* tree-ssa.c (execute_update_addresses_taken): Call
	maybe_rewrite_mem_ref_base on debug stmt value.  If it couldn't
	be rewritten and decl has been marked for renaming, reset
	the debug stmt.

	* gcc.dg/pr49000.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr49000.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa.c
Comment 13 Jakub Jelinek 2011-05-18 09:29:57 UTC
Author: jakub
Date: Wed May 18 09:29:46 2011
New Revision: 173850

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173850
Log:
	PR tree-optimization/49000
	* tree-ssa.c (execute_update_addresses_taken): Call
	maybe_rewrite_mem_ref_base on debug stmt value.  If it couldn't
	be rewritten and decl has been marked for renaming, reset
	the debug stmt.

	* gcc.dg/pr49000.c: New test.

Modified:
    branches/gcc-4_6-branch/gcc/ChangeLog
    branches/gcc-4_6-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_6-branch/gcc/tree-ssa.c
Comment 14 Jakub Jelinek 2011-05-18 09:31:31 UTC
Author: jakub
Date: Wed May 18 09:31:25 2011
New Revision: 173851

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=173851
Log:
	PR tree-optimization/49000
	* tree-ssa.c (execute_update_addresses_taken): Call
	maybe_rewrite_mem_ref_base on debug stmt value.  If it couldn't
	be rewritten and decl has been marked for renaming, reset
	the debug stmt.

	* gcc.dg/pr49000.c: New test.

Added:
    branches/gcc-4_6-branch/gcc/testsuite/gcc.dg/pr49000.c
Comment 15 Jakub Jelinek 2011-05-23 09:24:02 UTC
Fixed.