Bug 64284 - [5 Regression] ICE: Segmentation fault
Summary: [5 Regression] ICE: Segmentation fault
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 5.0
: P3 normal
Target Milestone: 5.0
Assignee: Richard Biener
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-12 11:01 UTC by Richard Biener
Modified: 2015-03-05 14:28 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2014-12-12 00:00:00


Attachments
preprocessed source (64.27 KB, text/plain)
2014-12-12 11:01 UTC, Richard Biener
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Biener 2014-12-12 11:01:17 UTC
Created attachment 34265 [details]
preprocessed source

> ./cc1 -quiet scp.i -O2
scp.c: In function 'shell_quotearg':
scp.c:126:1: internal compiler error: Segmentation fault
0xd473a0 crash_signal
        /space/rguenther/src/svn/trunk2/gcc/toplev.c:358
0xf8bde8 thread_through_loop_header
        /space/rguenther/src/svn/trunk2/gcc/tree-ssa-threadupdate.c:1869
0xf8d8e8 thread_through_all_blocks(bool)
        /space/rguenther/src/svn/trunk2/gcc/tree-ssa-threadupdate.c:2570
0x1027bd9 finalize_jump_threads
        /space/rguenther/src/svn/trunk2/gcc/tree-vrp.c:10151
0x1027fd6 execute_vrp
        /space/rguenther/src/svn/trunk2/gcc/tree-vrp.c:10305
0x102825c execute
        /space/rguenther/src/svn/trunk2/gcc/tree-vrp.c:10368
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
Comment 1 Richard Biener 2014-12-12 11:19:49 UTC
  Registering jump thread: (4, 5) incoming edge;  (5, 55) joiner;  (55, 63) normal;
  Registering FSM jump thread: (94, 5) incoming edge;  (6, 20) nocopy;
  Registering jump thread: (61, 6) incoming edge;  (6, 20) normal;
  Registering jump thread: (77, 6) incoming edge;  (6, 20) normal;
  Registering jump thread: (69, 6) incoming edge;  (6, 20) normal;
  Registering FSM jump thread: (94, 5) incoming edge;  (55, 56) nocopy;
...
  Threaded jump 69 --> 6 to 109
  Threaded jump 77 --> 6 to 109
  Threaded jump 61 --> 6 to 109

and then we end up with an invalid loop.  FSM threads the latch edge but
doesn't update the loop structure accordingly so later asking for the
loop latch edge fails (because the loop isn't anymore it seems - or
header and latch are no longer valid).

Let me have a look.
Comment 2 Markus Trippelsdorf 2014-12-12 11:20:14 UTC
trippels@gcc20 ~ % cat scp.i
int *a;
int b;
int
fn1() {
  enum { QSTRING } c = 0;
  while (1) {
    switch (*a) {
    case '\'':
      c = 0;
    default:
      switch (c)
      case 0:
      if (b)
        return 0;
      c = 1;
    }
    a++;
  }
}
Comment 3 Richard Biener 2014-12-12 11:45:39 UTC
Sth like

Index: tree-ssa-threadupdate.c
===================================================================
--- tree-ssa-threadupdate.c     (revision 218621)
+++ tree-ssa-threadupdate.c     (working copy)
@@ -2364,7 +2364,7 @@ duplicate_seme_region (edge entry, edge
                       basic_block *region_copy)
 {
   unsigned i;
-  bool free_region_copy = false, copying_header = false;
+  bool free_region_copy = false;
   struct loop *loop = entry->dest->loop_father;
   edge exit_copy;
   edge redirected;
@@ -2388,10 +2388,7 @@ duplicate_seme_region (edge entry, edge
 
   initialize_original_copy_tables ();
 
-  if (copying_header)
-    set_loop_copy (loop, loop_outer (loop));
-  else
-    set_loop_copy (loop, loop);
+  set_loop_copy (loop, loop);
 
   if (!region_copy)
     {
@@ -2453,6 +2450,8 @@ duplicate_seme_region (edge entry, edge
   }
 
   /* Redirect the entry and add the phi node arguments.  */
+  if (entry->dest == loop->header)
+    mark_loop_for_removal (loop);
   redirected = redirect_edge_and_branch (entry, get_bb_copy (entry->dest));
   gcc_assert (redirected != NULL);
   flush_pending_stmts (entry);

"works" but results in the less than optimal

fix_loop_structure: fixing up loops for function
fix_loop_structure: removing loop 1
flow_loops_find: discovered new loop 2 with header 5

in the testcase the loop header will be entry->src it seems - not sure
how reliably that is in the full generality of duplicate_seme_region.
We know that all blocks are contained in the same loop, so it must be
possible to compute where the header goes.

Ideally we'd simply set loop->header and loop->latch to the correct values,
marking loops for fixup (to recompute BB ownership - or do even that ourselves).
The testcase has two latches later, thus loop->latch would be NULL, but
both VRP and DOM init loops without LOOPS_MAY_HAVE_MULTIPLE_LATCHES so we'd
have to disambiguate the loops.

That said - the above patch works.
Comment 4 Richard Biener 2014-12-15 08:20:09 UTC
Fixed.
Comment 5 Richard Biener 2014-12-15 08:20:27 UTC
Author: rguenth
Date: Mon Dec 15 08:19:55 2014
New Revision: 218733

URL: https://gcc.gnu.org/viewcvs?rev=218733&root=gcc&view=rev
Log:
2014-12-15  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/64284
	* tree-ssa-threadupdate.c (duplicate_seme_region): Mark
	the loop for removal if we copied the loop header.

	* gcc.dg/torture/pr64284.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr64284.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-threadupdate.c
Comment 6 Yvan Roux 2015-03-05 14:28:38 UTC
Author: yroux
Date: Thu Mar  5 14:28:05 2015
New Revision: 221216

URL: https://gcc.gnu.org/viewcvs?rev=221216&root=gcc&view=rev
Log:
gcc/
2015-03-05  Yvan Roux  <yvan.roux@linaro.org>

	Backport from trunk r212011, r214942, r214957, r215012, r215016, r218115,
	r218733, r218746, r220491.
	2015-02-06  Sebastian Pop  <s.pop@samsung.com>
		    Brian Rzycki  <b.rzycki@samsung.com>

	PR tree-optimization/64878
	* tree-ssa-threadedge.c: Include tree-ssa-loop.h.
	(fsm_find_control_statement_thread_paths): Add parameter seen_loop_phi.
	Stop recursion at loop phi nodes after having visited a loop phi node.

	2014-12-15  Richard Biener  <rguenther@suse.de>

	PR middle-end/64246
	* cfgloop.c (mark_loop_for_removal): Make safe against multiple
	invocations on the same loop.

	2014-12-15  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/64284
	* tree-ssa-threadupdate.c (duplicate_seme_region): Mark
	the loop for removal if we copied the loop header.

	2014-11-27  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/64083
	* tree-ssa-threadupdate.c (thread_through_all_blocks): Do not
	forcibly mark loop for removal the wrong way.

	2014-09-08  Richard Biener  <rguenther@suse.de>

	PR ipa/63196
	* tree-inline.c (copy_loops): The source loop header should
	always be non-NULL.
	(tree_function_versioning): If loops need fixup after removing
	unreachable blocks fix them.
	* omp-low.c (simd_clone_adjust): Do not add incr block to
	loop under construction.

	2014-09-08  Richard Biener  <rguenther@suse.de>

	PR bootstrap/63204
	* cfgloop.c (mark_loop_for_removal): Track former header
	unconditionally.
	* cfgloop.h (struct loop): Add former_header member unconditionally.
	* loop-init.c (fix_loop_structure): Enable bogus loop removal
	diagnostic unconditionally.

	2014-09-05  Richard Biener  <rguenther@suse.de>

	* cfgloop.c (mark_loop_for_removal): Record former header
	when ENABLE_CHECKING.
	* cfgloop.h (strut loop): Add former_header member when
	ENABLE_CHECKING.
	* loop-init.c (fix_loop_structure): Sanity check loops
	marked for removal if they re-appeared.

	2014-09-05  Richard Biener  <rguenther@suse.de>

	* cfgloop.c (mark_loop_for_removal): New function.
	* cfgloop.h (mark_loop_for_removal): Declare.
	* cfghooks.c (delete_basic_block): Use mark_loop_for_removal.
	(merge_blocks): Likewise.
	(duplicate_block): Likewise.
	* except.c (sjlj_emit_dispatch_table): Likewise.
	* tree-eh.c (cleanup_empty_eh_merge_phis): Likewise.
	* tree-ssa-threadupdate.c (ssa_redirect_edges): Likewise.
	(thread_through_loop_header): Likewise.

	2014-06-26  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/61607
	* tree-ssa-threadupdate.c (ssa_redirect_edges): Cancel the
	loop if we redirected its latch edge.
	(thread_block_1): Do not cancel loops prematurely.

gcc/testsuite/
2015-03-05  Yvan Roux  <yvan.roux@linaro.org>

	Backport from trunk r218115, r218733, r218746, r220491.
	2015-02-06  Sebastian Pop  <s.pop@samsung.com>
		    Brian Rzycki  <b.rzycki@samsung.com>

	PR tree-optimization/64878
	* testsuite/gcc.dg/tree-ssa/ssa-dom-thread-8.c: New.

	2014-12-15  Richard Biener  <rguenther@suse.de>

	PR middle-end/64246
	* gnat.dg/opt46.adb: New testcase.
	* gnat.dg/opt46.ads: Likewise.
	* gnat.dg/opt46_pkg.adb: Likewise.
	* gnat.dg/opt46_pkg.ads: Likewise.

	2014-12-15  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/64284
	* gcc.dg/torture/pr64284.c: New testcase.

	2014-11-27  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/64083
	* gcc.dg/torture/pr64083.c: New testcase.


Added:
    branches/linaro/gcc-4_9-branch/gcc/testsuite/gcc.dg/torture/pr64083.c
    branches/linaro/gcc-4_9-branch/gcc/testsuite/gcc.dg/torture/pr64284.c
    branches/linaro/gcc-4_9-branch/gcc/testsuite/gcc.dg/tree-ssa/ssa-dom-thread-8.c
    branches/linaro/gcc-4_9-branch/gcc/testsuite/gnat.dg/opt46.adb
    branches/linaro/gcc-4_9-branch/gcc/testsuite/gnat.dg/opt46.ads
    branches/linaro/gcc-4_9-branch/gcc/testsuite/gnat.dg/opt46_pkg.adb
    branches/linaro/gcc-4_9-branch/gcc/testsuite/gnat.dg/opt46_pkg.ads
Modified:
    branches/linaro/gcc-4_9-branch/gcc/ChangeLog.linaro
    branches/linaro/gcc-4_9-branch/gcc/cfghooks.c
    branches/linaro/gcc-4_9-branch/gcc/cfgloop.c
    branches/linaro/gcc-4_9-branch/gcc/cfgloop.h
    branches/linaro/gcc-4_9-branch/gcc/except.c
    branches/linaro/gcc-4_9-branch/gcc/loop-init.c
    branches/linaro/gcc-4_9-branch/gcc/omp-low.c
    branches/linaro/gcc-4_9-branch/gcc/testsuite/ChangeLog.linaro
    branches/linaro/gcc-4_9-branch/gcc/tree-eh.c
    branches/linaro/gcc-4_9-branch/gcc/tree-inline.c
    branches/linaro/gcc-4_9-branch/gcc/tree-ssa-threadedge.c
    branches/linaro/gcc-4_9-branch/gcc/tree-ssa-threadupdate.c