Started with r229437.

Does

Index: gcc/tree-scalar-evolution.c
===================================================================
--- gcc/tree-scalar-evolution.c (revision 229481)
+++ gcc/tree-scalar-evolution.c (working copy)
@@ -1849,8 +1849,7 @@ interpret_rhs_expr (struct loop *loop, g
       chrec2 = instantiate_parameters (loop, chrec2);
 
       chrec2 = fold_build2 (LSHIFT_EXPR, type,
-                           build_int_cst (TREE_TYPE (rhs1), 1),
-                           chrec2);
+                           build_int_cst (type, 1), chrec2);
       res = chrec_fold_multiply (type, chrec1, chrec2);
       break;
 

fix it?

Probably not.

(In reply to Richard Biener from comment #3)
> Probably not.

Yes, it doesn't help.

*** Bug 68135 has been marked as a duplicate of this bug. ***

Hmm, it looks like r229437 may be innocent after all.
This morning I've hit another ICE that goes away if I add --save-temps 
to the command line:

trippels@gcc2-power8 tools % ~/gcc_6/usr/local/bin/g++ -ftemplate-depth-128 -O3 -finline-functions -Wno-inline -Wall -m64 -Winvalid-pch -DBOOST_ALL_NO_LIB=1 -DBOOST_BUILD_PCH_ENABLED -DBOOST_CHRONO_STATIC_LINK=1 -DBOOST_CHRONO_THREAD_DISABLED -DBOOST_HAS_ICU=1 -DBOOST_SYSTEM_NO_DEPRECATED -DBOOST_SYSTEM_STATIC_LINK=1 -DBOOST_TEST_NO_AUTO_LINK=1 -DBOOST_TIMER_STATIC_LINK=1 -DBOOST_UBLAS_UNSUPPORTED_COMPILER=0 -DNDEBUG -I"/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/gcc-6.0.0/release/link-static" -I".." -I"../libs/math/include_private" -I"../libs/math/test" -c -o "/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/test_bessel_y_prime.test/gcc-6.0.0/release/link-static/test_bessel_y_prime.o" "../libs/math/test/test_bessel_y_prime.cpp"                                                                                  
In file included from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/vector:65:0,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/random.h:34,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/random:49,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_algo.h:66,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/algorithm:62,
                 from ../boost/math/tools/config.hpp:17,
                 from ../boost/math/tools/promotion.hpp:26,
                 from ../boost/math/special_functions/detail/round_fwd.hpp:12,
                 from ../boost/math/special_functions/math_fwd.hpp:26,
                 from ../libs/math/test/pch_light.hpp:9,
                 from ../libs/math/test/test_bessel_y_prime.cpp:6:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h: In function ‘void std::fill(std::_Bit_iterator, std::_Bit_iterator, const bool&)’:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h:398:3: internal compiler error: in fold_convert_loc, at fold-const.c:2201
   fill(_Bit_iterator __first, _Bit_iterator __last, const bool& __x)
   ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
trippels@gcc2-power8 tools % ~/gcc_6/usr/local/bin/g++ --save-temps -ftemplate-depth-128 -O3 -finline-functions -Wno-inline -Wall -m64 -Winvalid-pch -DBOOST_ALL_NO_LIB=1 -DBOOST_BUILD_PCH_ENABLED -DBOOST_CHRONO_STATIC_LINK=1 -DBOOST_CHRONO_THREAD_DISABLED -DBOOST_HAS_ICU=1 -DBOOST_SYSTEM_NO_DEPRECATED -DBOOST_SYSTEM_STATIC_LINK=1 -DBOOST_TEST_NO_AUTO_LINK=1 -DBOOST_TIMER_STATIC_LINK=1 -DBOOST_UBLAS_UNSUPPORTED_COMPILER=0 -DNDEBUG -I"/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/gcc-6.0.0/release/link-static" -I".." -I"../libs/math/include_private" -I"../libs/math/test" -c -o "/home/trippels/boost_testing/results/boost/bin.v2/libs/math/test/test_bessel_y_prime.test/gcc-6.0.0/release/link-static/test_bessel_y_prime.o" "../libs/math/test/test_bessel_y_prime.cpp"
trippels@gcc2-power8 tools %  

Any hints on how to debug this further?
Looks like memory is corrupted somehow.

...
==123276== Conditional jump or move depends on uninitialised value(s)
==123276==    at 0x10B3FFB8: extract_range_from_binary_expr_1(value_range*, tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10AE79FF: extract_range_from_unary_expr_1(value_range*, tree_code, tree_node*, value_range*, tree_node*) [clone .lto_priv.6507] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10A58D57: vrp_visit_stmt(gimple*, edge_def**, tree_node**) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x108BE377: ssa_propagate(ssa_prop_result (*)(gimple*, edge_def**, tree_node**), ssa_prop_result (*)(gphi*)) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10A45E97: (anonymous namespace)::pass_vrp::execute(function*) [clone .lto_priv.2433] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10633147: execute_one_pass(opt_pass*) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10736D8F: execute_pass_list(function*, opt_pass*) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10661947: cgraph_node::expand() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10630303: symbol_table::compile() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1064A783: symbol_table::finalize_compilation_unit() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x105E7B4B: compile_file() [clone .lto_priv.3048] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10538363: toplev::main(int, char**) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==  Uninitialised value was created by a stack allocation
==123276==    at 0x10B3D598: extract_range_from_binary_expr_1(value_range*, tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==
==123276== Conditional jump or move depends on uninitialised value(s)
==123276==    at 0x10B3FFB8: extract_range_from_binary_expr_1(value_range*, tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10AE79FF: extract_range_from_unary_expr_1(value_range*, tree_code, tree_node*, value_range*, tree_node*) [clone .lto_priv.6507] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10BF8217: simplify_stmt_for_jump_threading(gimple*, gimple*, avail_exprs_stack*) [clone .lto_priv.6342] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10BF5DF3: record_temporary_equivalences_from_stmts_at_dest(edge_def*, const_and_copies*, avail_exprs_stack*, tree_node* (*)(gimple*, gimple*, avail_exprs_stack*), bool) [clone .isra.44] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10BE8C6B: thread_across_edge(gcond*, edge_def*, bool, const_and_copies*, avail_exprs_stack*, tree_node* (*)(gimple*, gimple*, avail_exprs_stack*)) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10A46B7F: (anonymous namespace)::pass_vrp::execute(function*) [clone .lto_priv.2433] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10633147: execute_one_pass(opt_pass*) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10736D8F: execute_pass_list(function*, opt_pass*) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10661947: cgraph_node::expand() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10630303: symbol_table::compile() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1064A783: symbol_table::finalize_compilation_unit() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x105E7B4B: compile_file() [clone .lto_priv.3048] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==  Uninitialised value was created by a stack allocation
==123276==    at 0x10B3D598: extract_range_from_binary_expr_1(value_range*, tree_code, tree_node*, value_range*, value_range*) [clone .lto_priv.6782] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==
==123276== Conditional jump or move depends on uninitialised value(s)
==123276==    at 0x109F79FC: estimate_numbers_of_iterations_loop(loop*) [clone .lto_priv.6542] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x109F6993: estimate_numbers_of_iterations() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x109F1723: tree_unroll_loops_completely(bool, bool) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1090259B: (anonymous namespace)::pass_complete_unrolli::execute(function*) [clone .lto_priv.2414] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10633147: execute_one_pass(opt_pass*) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10736D8F: execute_pass_list(function*, opt_pass*) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10661947: cgraph_node::expand() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10630303: symbol_table::compile() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x1064A783: symbol_table::finalize_compilation_unit() (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x105E7B4B: compile_file() [clone .lto_priv.3048] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10538363: toplev::main(int, char**) (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==    by 0x10536DEF: main (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==  Uninitialised value was created by a stack allocation
==123276==    at 0x109F6FD4: estimate_numbers_of_iterations_loop(loop*) [clone .lto_priv.6542] (in /home/trippels/gcc_6/usr/local/libexec/gcc/powerpc64le-unknown-linux-gnu/6.0.0/cc1plus)
==123276==
In file included from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/vector:65:0,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/random.h:34,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/random:49,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_algo.h:66,
                 from /home/trippels/gcc_6/usr/local/include/c++/6.0.0/algorithm:62,
                 from ../boost/math/tools/config.hpp:17,
                 from ../boost/math/tools/promotion.hpp:26,
                 from ../boost/math/special_functions/detail/round_fwd.hpp:12,
                 from ../boost/math/special_functions/math_fwd.hpp:26,
                 from ../libs/math/test/pch_light.hpp:9,
                 from ../libs/math/test/test_bessel_y_prime.cpp:6:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h: In function ‘void std::fill(std::_Bit_iterator, std::_Bit_iterator, const bool&)’:
/home/trippels/gcc_6/usr/local/include/c++/6.0.0/bits/stl_bvector.h:398:3: internal compiler error: in fold_convert_loc, at fold-const.c:2201

Does it only reproduce with a LTO built compiler?  Usually gc-checking with
always-collect might help tracking down GC issues (which this looks like one).

(In reply to Richard Biener from comment #8)
> Does it only reproduce with a LTO built compiler?  Usually gc-checking with
> always-collect might help tracking down GC issues (which this looks like
> one).

It also happens with a --disable-bootstrap compiler.

Valgrind points to r228599:

==114559== Invalid write of size 8
==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned int) (tree-phinodes.c:382)
==114559==    by 0x109A814F: flush_pending_stmts(edge_def*) (tree-ssa.c:195)
==114559==    by 0x103B94C3: loop_version(loop*, void*, basic_block_def**, unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1753)
==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int) (tree-ssa-loop-unswitch.c:383)
==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops() (tree-ssa-loop-unswitch.c:106)
==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*) (passes.c:2402)
==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
==114559==
==114559== Invalid write of size 8
==114559==    at 0x108665C0: delink_imm_use (ssa-iterators.h:248)
==114559==    by 0x108665C0: remove_phi_arg_num (tree-phinodes.c:400)
==114559==    by 0x108665C0: remove_phi_args(edge_def*) (tree-phinodes.c:433)
==114559==    by 0x107EA977: gimple_execute_on_shrinking_pred(edge_def*) (tree-cfg.c:8193)
==114559==    by 0x103AA707: execute_on_shrinking_pred(edge_def*) (cfghooks.c:1207)
==114559==    by 0x10D2C813: redirect_edge_succ(edge_def*, basic_block_def*) (cfg.c:361)
==114559==    by 0x103A8D8B: redirect_edge_succ_nodup(edge_def*, basic_block_def*) (cfghooks.c:444)
==114559==    by 0x109A8C27: ssa_redirect_edge(edge_def*, basic_block_def*) (tree-ssa.c:166)
==114559==    by 0x107FBEDB: gimple_redirect_edge_and_branch(edge_def*, basic_block_def*) (tree-cfg.c:5677)
==114559==    by 0x103A89F3: redirect_edge_and_branch(edge_def*, basic_block_def*) (cfghooks.c:358)
==114559==    by 0x107F4C57: gimple_split_edge(edge_def*) (tree-cfg.c:2747)
==114559==    by 0x103A92B7: split_edge(edge_def*) (cfghooks.c:629)
==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**, unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int) (tree-ssa-loop-unswitch.c:383)
==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
==114559==
==114559== Invalid write of size 8
==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned int) (tree-phinodes.c:382)
==114559==    by 0x107F4D0F: reinstall_phi_args (tree-cfg.c:2698)
==114559==    by 0x107F4D0F: gimple_split_edge(edge_def*) (tree-cfg.c:2749)
==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**, unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int) (tree-ssa-loop-unswitch.c:383)
==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops() (tree-ssa-loop-unswitch.c:106)
==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*) (passes.c:2402)
==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
==114559==

On Thu, 29 Oct 2015, trippels at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117
> 
> Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>                  CC|                            |ienkovich at gcc dot gnu.org
> 
> --- Comment #9 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
> (In reply to Richard Biener from comment #8)
> > Does it only reproduce with a LTO built compiler?  Usually gc-checking with
> > always-collect might help tracking down GC issues (which this looks like
> > one).
> 
> It also happens with a --disable-bootstrap compiler.
>
> Valgrind points to r228599:

Nothing obvious but does removing

  mark_virtual_operands_for_renaming (cfun);

help?  It's the only thing that may end up releasing SSA names
(if only virtuals).
 
> ==114559== Invalid write of size 8
> ==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
> ==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
> ==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
> ==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned
> int) (tree-phinodes.c:382)
> ==114559==    by 0x109A814F: flush_pending_stmts(edge_def*) (tree-ssa.c:195)
> ==114559==    by 0x103B94C3: loop_version(loop*, void*, basic_block_def**,
> unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1753)
> ==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
> ==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
> (tree-ssa-loop-unswitch.c:383)
> ==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops()
> (tree-ssa-loop-unswitch.c:106)
> ==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
> ==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*)
> (passes.c:2402)
> ==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
> ==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
> ==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
> ==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
> ==114559==
> ==114559== Invalid write of size 8
> ==114559==    at 0x108665C0: delink_imm_use (ssa-iterators.h:248)
> ==114559==    by 0x108665C0: remove_phi_arg_num (tree-phinodes.c:400)
> ==114559==    by 0x108665C0: remove_phi_args(edge_def*) (tree-phinodes.c:433)
> ==114559==    by 0x107EA977: gimple_execute_on_shrinking_pred(edge_def*)
> (tree-cfg.c:8193)
> ==114559==    by 0x103AA707: execute_on_shrinking_pred(edge_def*)
> (cfghooks.c:1207)
> ==114559==    by 0x10D2C813: redirect_edge_succ(edge_def*, basic_block_def*)
> (cfg.c:361)
> ==114559==    by 0x103A8D8B: redirect_edge_succ_nodup(edge_def*,
> basic_block_def*) (cfghooks.c:444)
> ==114559==    by 0x109A8C27: ssa_redirect_edge(edge_def*, basic_block_def*)
> (tree-ssa.c:166)
> ==114559==    by 0x107FBEDB: gimple_redirect_edge_and_branch(edge_def*,
> basic_block_def*) (tree-cfg.c:5677)
> ==114559==    by 0x103A89F3: redirect_edge_and_branch(edge_def*,
> basic_block_def*) (cfghooks.c:358)
> ==114559==    by 0x107F4C57: gimple_split_edge(edge_def*) (tree-cfg.c:2747)
> ==114559==    by 0x103A92B7: split_edge(edge_def*) (cfghooks.c:629)
> ==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**,
> unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
> ==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
> ==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
> (tree-ssa-loop-unswitch.c:383)
> ==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
> ==114559==
> ==114559== Invalid write of size 8
> ==114559==    at 0x10866488: link_imm_use_to_list (ssa-iterators.h:261)
> ==114559==    by 0x10866488: link_imm_use (ssa-iterators.h:278)
> ==114559==    by 0x10866488: set_ssa_use_from_ptr (ssa-iterators.h:288)
> ==114559==    by 0x10866488: add_phi_arg(gphi*, tree_node*, edge_def*, unsigned
> int) (tree-phinodes.c:382)
> ==114559==    by 0x107F4D0F: reinstall_phi_args (tree-cfg.c:2698)
> ==114559==    by 0x107F4D0F: gimple_split_edge(edge_def*) (tree-cfg.c:2749)
> ==114559==    by 0x103B94FB: loop_version(loop*, void*, basic_block_def**,
> unsigned int, unsigned int, unsigned int, bool) (cfgloopmanip.c:1782)
> ==114559==    by 0x1090F687: tree_unswitch_loop (tree-ssa-loop-unswitch.c:423)
> ==114559==    by 0x1090F687: tree_unswitch_single_loop(loop*, int)
> (tree-ssa-loop-unswitch.c:383)
> ==114559==    by 0x1090FF0F: tree_ssa_unswitch_loops()
> (tree-ssa-loop-unswitch.c:106)
> ==114559==    by 0x106D856B: execute_one_pass(opt_pass*) (passes.c:2338)
> ==114559==    by 0x106D8AB3: execute_pass_list_1(opt_pass*) (passes.c:2391)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8ACB: execute_pass_list_1(opt_pass*) (passes.c:2392)
> ==114559==    by 0x106D8B53: execute_pass_list(function*, opt_pass*)
> (passes.c:2402)
> ==114559==    by 0x103DDECB: cgraph_node::expand() (cgraphunit.c:1976)
> ==114559==    by 0x103DFA57: expand_all_functions (cgraphunit.c:2112)
> ==114559==    by 0x103DFA57: symbol_table::compile() (cgraphunit.c:2461)
> ==114559==  Address 0x24039848 is not stack'd, malloc'd or (recently) free'd
> ==114559==
> 
>

(In reply to rguenther@suse.de from comment #10)
> >
> > Valgrind points to r228599:
> 
> Nothing obvious but does removing
> 
>   mark_virtual_operands_for_renaming (cfun);
> 
> help?  It's the only thing that may end up releasing SSA names
> (if only virtuals).

No, it doesn't help. But reverting r228760 and r228599 fixes the issue.

(In reply to Markus Trippelsdorf from comment #11)
> (In reply to rguenther@suse.de from comment #10)
> > >
> > > Valgrind points to r228599:
> > 
> > Nothing obvious but does removing
> > 
> >   mark_virtual_operands_for_renaming (cfun);
> > 
> > help?  It's the only thing that may end up releasing SSA names
> > (if only virtuals).
> 
> No, it doesn't help. But reverting r228760 and r228599 fixes the issue.

No, reverting  r228760 and r228599 doesn't help. So back to square one.

trippels@gcc2-power8 shell % ~//gcc_test/usr/local/bin/c++ -o js -Wall -Wignored-qualifiers -Wsign-compare -Wtype-limits -Werror=char-subscripts -Werror=comment -Werror=empty-body -Werror=endif-labels -Werror=int-to-pointer-cast -Werror=missing-braces -Werror=overloaded-virtual -Werror=pointer-arith -Werror=reorder -Werror=return-type -Werror=sequence-point -Werror=switch -Werror=trigraphs -Werror=unknown-pragmas -Werror=unused-label -Werror=unused-value -Werror=write-strings -Werror=conversion-null -Wno-invalid-offsetof -Wcast-align -std=c++1z -w -flto=80 --param lto-partitions=80 -ffunction-sections -fdata-sections -fno-rtti -fno-exceptions -fno-math-errno -std=gnu++0x -pthread -pipe -DNDEBUG -DTRIMMED -O3 -fomit-frame-pointer Unified_cpp_js_src_shell0.o ../../../mozglue/build/dummy.o ../../../mfbt/Compression.o ../../../mfbt/Decimal.o ../../../mfbt/Unified_cpp_mfbt0.o -lpthread -Wl,--hash-style=gnu,--as-needed,--gc-sections,--icf=all -Wl,-z,noexecstack -Wl,-z,text -Wl,--build-id -Wl,-rpath-link,../../../dist/bin -Wl,-rpath-link,/home/trippels/moz-build-dir/dist/lib ../libjs_static.a -rdynamic -lm -ldl -lffi -licui18n -licuuc -licudata -L/usr/lib64 -lplds4 -lplc4 -lnspr4 -lz -lm -ldl   
/home/trippels/gecko-dev/js/src/builtin/SIMD.cpp: In function ‘simd_float32x4_reciprocal’:
/home/trippels/gecko-dev/js/src/builtin/SIMD.cpp:1221:1: error: incompatible types in PHI argument 0
 FLOAT32X4_FUNCTION_LIST(DEFINE_SIMD_FLOAT32X4_FUNCTION)
 ^

unsigned int

struct BarrieredBase *

i_38 = PHI <v_4(D)(10), i_61(12)>
/home/trippels/gecko-dev/js/src/builtin/SIMD.cpp:1221:1: internal compiler error: verify_gimple failed
0x107448cb verify_gimple_in_cfg(function*, bool)
        ../../gcc/gcc/tree-cfg.c:5082
0x105ecabf execute_function_todo
        ../../gcc/gcc/passes.c:1945
0x105ed773 do_per_function
        ../../gcc/gcc/passes.c:1632
0x105eda9f execute_todo
        ../../gcc/gcc/passes.c:2000
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
make: *** [/home/trippels/tmp/ccL2JcUK.ltrans5.ltrans.o] Error 1

Adding  -r -nostdlib makes it segfault instead:
trippels@gcc2-power8 shell % ~//gcc_test/usr/local/bin/c++ -r -nostdlib -o js -Wall -Wignored-qualifiers -Wsign-compare -Wtype-limits -Werror=char-subscripts -Werror=comment -Werror=empty-body -Werror=endif-labels -Werror=int-to-pointer-cast -Werror=missing-braces -Werror=overloaded-virtual -Werror=pointer-arith -Werror=reorder -Werror=return-type -Werror=sequence-point -Werror=switch -Werror=trigraphs -Werror=unknown-pragmas -Werror=unused-label -Werror=unused-value -Werror=write-strings -Werror=conversion-null -Wno-invalid-offsetof -Wcast-align -std=c++1z -w -flto=80 --param lto-partitions=80 -ffunction-sections -fdata-sections -fno-rtti -fno-exceptions -fno-math-errno -std=gnu++0x -pipe -DNDEBUG -DTRIMMED -O3 -fomit-frame-pointer Unified_cpp_js_src_shell0.o ../../../mozglue/build/dummy.o ../../../mfbt/Compression.o ../../../mfbt/Decimal.o ../../../mfbt/Unified_cpp_mfbt0.o -lpthread -Wl,-z,text -Wl,--build-id -Wl,-rpath-link,../../../dist/bin -Wl,-rpath-link,/home/trippels/moz-build-dir/dist/lib ../libjs_static.a -rdynamic -lm -ldl -lffi -licui18n -licuuc -licudata -L/usr/lib64 -lplds4 -lplc4 -lnspr4 -lz -lm -ldl
/home/trippels/gecko-dev/js/src/jsgc.cpp: In member function ‘sweepCompartments’:
/home/trippels/gecko-dev/js/src/jsgc.cpp:3420:1: error: invalid PHI argument
 Zone::sweepCompartments(FreeOp *fop, bool keepAtleastOne, bool lastGC)
 ^

<<< Unknown tree: <invalid tree code> >>>
/home/trippels/gecko-dev/js/src/jsgc.cpp:3420:1: internal compiler error: Segmentation fault
0x106eba33 crash_signal
        ../../gcc/gcc/toplev.c:336
0x10743ee4 contains_struct_check
        ../../gcc/gcc/tree.h:3030
0x10743ee4 verify_gimple_phi
        ../../gcc/gcc/tree-cfg.c:4658
0x10743ee4 verify_gimple_in_cfg(function*, bool)
        ../../gcc/gcc/tree-cfg.c:4952
0x105ecabf execute_function_todo
        ../../gcc/gcc/passes.c:1945
0x105ed773 do_per_function
        ../../gcc/gcc/passes.c:1632
0x105eda9f execute_todo
        ../../gcc/gcc/passes.c:2000
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
make: *** [/home/trippels/tmp/ccv49A7w.ltrans35.ltrans.o] Error 1
make: *** Waiting for unfinished jobs....
lto-wrapper: fatal error: make returned 2 exit status

I'll see if I can come up with a small testcase.

*** Bug 68127 has been marked as a duplicate of this bug. ***

(In reply to Markus Trippelsdorf from comment #13)
> *** Bug 68127 has been marked as a duplicate of this bug. ***

just FYI, for me (PR68127) the issue pops up in a non-deterministic way, I don't know why, but this might be useful to keep in mind while reducing / bisecting.

(In reply to Joost VandeVondele from comment #14)
> (In reply to Markus Trippelsdorf from comment #13)
> > *** Bug 68127 has been marked as a duplicate of this bug. ***
> 
> just FYI, for me (PR68127) the issue pops up in a non-deterministic way, I
> don't know why, but this might be useful to keep in mind while reducing /
> bisecting.

Yes. This is the reason why my previous bisecting attempts landed on 
commits that have probably nothing to do with this nasty heisenbug.

Just another valgrind trace below. The bug is very sensitive, I have now a non-lto case and it is a relatively small file that causes a crash. However, just moving the file to a different directory is enough to make the error disappear. 

/data/vjoost/gnu/cp2k/cp2k/makefiles/../src/cp_ddapc_methods.F:545:0:

   SUBROUTINE  ddapc_eval_AmI(GAmI, c0,  gfunc, w, particle_set, gcut,&
 

Error: incompatible types in PHI argument 0
integer(kind=8)

unsigned long

/data/vjoost/gnu/cp2k/cp2k/makefiles/../src/cp_ddapc_methods.F:545:0: Error: location references block not in block tree
S.96_21 = PHI <0(149), S.96_3(151)>
/data/vjoost/gnu/cp2k/cp2k/makefiles/../src/cp_ddapc_methods.F:545:0: Error: invalid PHI argument
_352
==31829== Invalid read of size 2
==31829==    at 0x8E16A8: useless_type_conversion_p(tree_node*, tree_node*) (gimple-expr.c:67)
==31829==    by 0xB95BE9: verify_gimple_phi (tree-cfg.c:4658)
==31829==    by 0xB95BE9: verify_gimple_in_cfg(function*, bool) (tree-cfg.c:4952)
==31829==    by 0xA82F7C: execute_function_todo(function*, void*) (passes.c:1945)
==31829==    by 0xA839F3: execute_todo(unsigned int) (passes.c:2000)
==31829==    by 0xA8612B: execute_one_pass(opt_pass*) (passes.c:2329)
==31829==    by 0xA866BF: execute_pass_list_1(opt_pass*) (passes.c:2389)
==31829==    by 0xA866D1: execute_pass_list_1(opt_pass*) (passes.c:2390)
==31829==    by 0xA866D1: execute_pass_list_1(opt_pass*) (passes.c:2390)
==31829==    by 0xA86714: execute_pass_list(function*, opt_pass*) (passes.c:2400)
==31829==    by 0x78C013: cgraph_node::expand() (cgraphunit.c:1965)
==31829==    by 0x78D902: expand_all_functions (cgraphunit.c:2101)
==31829==    by 0x78D902: symbol_table::compile() (cgraphunit.c:2450)
==31829==    by 0x78F86D: symbol_table::finalize_compilation_unit() (cgraphunit.c:2540)
==31829==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==31829== 
/data/vjoost/gnu/cp2k/cp2k/makefiles/../src/cp_ddapc_methods.F:545:0: internal compiler error: Segmentation fault

We're seeing this ICE on x86-64, while building the 32-bit libgfortran.
We're building the target libraries with -O3 with GCC compiler checks enabled.

libtool: compile:  /eng/upc/dev/gary/gupc-dev/bld/gupc/./gcc/xgcc -B/eng/upc/de
v/gary/gupc-dev/bld/gupc/./gcc/ -B/eng/upc/dev/gary/gupc-dev/rls/gupc/x86_64-pc
-linux-gnu/bin/ -B/eng/upc/dev/gary/gupc-dev/rls/gupc/x86_64-pc-linux-gnu/lib/
-isystem /eng/upc/dev/gary/gupc-dev/rls/gupc/x86_64-pc-linux-gnu/include -isyst
em /eng/upc/dev/gary/gupc-dev/rls/gupc/x86_64-pc-linux-gnu/sys-include -DHAVE_C
ONFIG_H -I. -I/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran -iquote/eng/upc/d
ev/gary/gupc-dev/src/gupc/libgfortran/io -I/eng/upc/dev/gary/gupc-dev/src/gupc/
libgfortran/../gcc -I/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran/../gcc/con
fig -I/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran/../libquadmath -I../../..
/./gcc -I/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran/../libgcc -I../../libg
cc -I/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran/../libbacktrace -I../../li
bbacktrace -I../libbacktrace -std=gnu11 -Wall -Wstrict-prototypes -Wmissing-pro
totypes -Wold-style-definition -Wextra -Wwrite-strings -Werror=implicit-functio
n-declaration -Werror=vla -fcx-fortran-rules -ffunction-sections -fdata-section
s -g3 -O3 -m32 -MT write.lo -MD -MP -MF .deps/write.Tpo -c /eng/upc/dev/gary/gu
pc-dev/src/gupc/libgfortran/io/write.c -o write.o >/dev/null 2>&1
make[6]: *** [write.lo] Error 1
make[6]: Leaving directory `/eng/upc/dev/gary/gupc-dev/bld/gupc/x86_64-pc-linux
-gnu/32/libgfortran'

Above, that make step sends output /dev/null.  Running the same command by hand, yields:

/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran/io/write.c: In function
‘write_a’:
/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran/io/write.c:232:1: error:
invalid PHI argument
 write_a (st_parameter_dt *dtp, const fnode *f, const char *source, int len)
 ^

<<< Unknown tree: <invalid tree code> >>>
/eng/upc/dev/gary/gupc-dev/src/gupc/libgfortran/io/write.c:232:1: internal
compiler error: tree check: expected tree that contains ‘typed’ structure, have
‘<invalid tree code>’ in verify_gimple_phi, at tree-cfg.c:4658
0xe4fbe4 tree_contains_struct_check_failed(tree_node const*,
tree_node_structure_enum, char const*, int, char const*)
        /eng/upc/dev/gary/gupc-dev/src/gupc/gcc/tree.c:9839
0xbf13bc contains_struct_check(tree_node*, tree_node_structure_enum, char
const*, int, char const*)
        /eng/upc/dev/gary/gupc-dev/src/gupc/gcc/tree.h:3173
0xbf13bc verify_gimple_phi
        /eng/upc/dev/gary/gupc-dev/src/gupc/gcc/tree-cfg.c:4658
0xbf13bc verify_gimple_in_cfg(function*, bool)
        /eng/upc/dev/gary/gupc-dev/src/gupc/gcc/tree-cfg.c:4952
0xab36f7 execute_function_todo
        /eng/upc/dev/gary/gupc-dev/src/gupc/gcc/passes.c:1945
0xab4b7a do_per_function
        /eng/upc/dev/gary/gupc-dev/src/gupc/gcc/passes.c:1632
0xab4b7a execute_todo
        /eng/upc/dev/gary/gupc-dev/src/gupc/gcc/passes.c:2000

(In reply to Gary Funck from comment #17)
> We're seeing this ICE on x86-64, while building the 32-bit libgfortran.
> We're building the target libraries with -O3 with GCC compiler checks
> enabled.

Taking garbage collection out of the picture by adding --param ggc-min-heapsize=100000 to the command line led to a successful compilation.

We see similar failure an x86-64 opensuse VM in the 32-bit libgfortran build but on a different file: eoshift.c.  After removing the .lo and .o files and re-running make, the build completed without error.  As described in earlier comments, this issue is not easily reproducible.

I haven't seen this issue since Jason's GC related C++ patches went in:
r230201 and r230202.

But of course this may well be another statistical fluke.

(In reply to Markus Trippelsdorf from comment #20)
> I haven't seen this issue since Jason's GC related C++ patches went in:
> r230201 and r230202.
> 
> But of course this may well be another statistical fluke.

likely so, since my testcase is Fortran based. For me the nightly build of CP2K now fails with 

/data/vjoost/gnu/cp2k/cp2k/makefiles/../src/pw_spline_utils.F:2303:0:

   SUBROUTINE add_fine2coarse(fine_values_pw,coarse_coeffs_pw,&


internal compiler error: Segmentation fault
0xb525df crash_signal
        ../../gcc/gcc/toplev.c:336
0x1322c4c dr_misalignment
        ../../gcc/gcc/tree-vectorizer.h:889
0x1322c4c aligned_access_p
        ../../gcc/gcc/tree-vectorizer.h:902
0x1322c4c vect_supportable_dr_alignment(data_reference*, bool)
        ../../gcc/gcc/tree-vect-data-refs.c:5863
0xd96d9f vectorizable_load
        ../../gcc/gcc/tree-vect-stmts.c:6706
0xda061d vect_transform_stmt(gimple*, gimple_stmt_iterator*, bool*, _slp_tree*, _slp_instance*)
        ../../gcc/gcc/tree-vect-stmts.c:7998
0xdc0a31 vect_schedule_slp_instance
        ../../gcc/gcc/tree-vect-slp.c:3468

not sure if it is related.

(In reply to Joost VandeVondele from comment #21)
> likely so, since my testcase is Fortran based. For me the nightly build of
> CP2K now fails with 
> 
> /data/vjoost/gnu/cp2k/cp2k/makefiles/../src/pw_spline_utils.F:2303:0:
> 
>    SUBROUTINE add_fine2coarse(fine_values_pw,coarse_coeffs_pw,&
> 
> 
> internal compiler error: Segmentation fault
> 0xb525df crash_signal
>         ../../gcc/gcc/toplev.c:336
> 0x1322c4c dr_misalignment
>         ../../gcc/gcc/tree-vectorizer.h:889
> 0x1322c4c aligned_access_p
>         ../../gcc/gcc/tree-vectorizer.h:902
> 0x1322c4c vect_supportable_dr_alignment(data_reference*, bool)
>         ../../gcc/gcc/tree-vect-data-refs.c:5863
> 0xd96d9f vectorizable_load
>         ../../gcc/gcc/tree-vect-stmts.c:6706
> 0xda061d vect_transform_stmt(gimple*, gimple_stmt_iterator*, bool*,
> _slp_tree*, _slp_instance*)
>         ../../gcc/gcc/tree-vect-stmts.c:7998
> 0xdc0a31 vect_schedule_slp_instance
>         ../../gcc/gcc/tree-vect-slp.c:3468
> 
> not sure if it is related.

No, that is PR68324 caused by Richi's recent vectorizer changes.

Unfortunately it is a ggc_collect and not a ggc_free:

Hardware watchpoint 1: *(const_tree*)0x3fff9d65aa30

Old value = (const_tree) 0x0
New value = (const_tree) 0xa5a5a5a5a5a5a5a5
0x00003fffb793bfa8 in __memset_power7 () from /lib64/libc.so.6
(gdb) bt
#0  0x00003fffb793bfa8 in __memset_power7 () from /lib64/libc.so.6
#1  0x00000000102a4bf4 in poison_pages () at ../../gcc/gcc/ggc-page.c:2085
#2  0x00000000102a6ca4 in ggc_collect () at ../../gcc/gcc/ggc-page.c:2180
#3  0x0000000010717b50 in execute_one_pass (pass=0x116e2de0) at ../../gcc/gcc/passes.c:2383
#4  0x0000000010718038 in execute_pass_list_1 (pass=0x116e2de0) at ../../gcc/gcc/passes.c:2398
#5  0x0000000010718050 in execute_pass_list_1 (pass=0x116e1d60) at ../../gcc/gcc/passes.c:2399
#6  0x00000000107180fc in execute_pass_list (fn=0x3fff9f468298, pass=<optimized out>) at ../../gcc/gcc/passes.c:2409
#7  0x0000000010351514 in cgraph_node::expand (this=0x3fff9d2d2f70) at ../../gcc/gcc/cgraphunit.c:1965
#8  0x0000000010353588 in expand_all_functions () at ../../gcc/gcc/cgraphunit.c:2101
#9  symbol_table::compile (this=0x3fffaf390000) at ../../gcc/gcc/cgraphunit.c:2450
#10 0x0000000010355c5c in symbol_table::finalize_compilation_unit (this=0x3fffaf390000) at ../../gcc/gcc/cgraphunit.c:2540
#11 0x0000000010812f30 in compile_file () at ../../gcc/gcc/toplev.c:491
#12 0x0000000010153288 in do_compile () at ../../gcc/gcc/toplev.c:1954
#13 toplev::main (this=<optimized out>, argc=107, argv=0x3fffffffe188) at ../../gcc/gcc/toplev.c:2061
#14 0x00000000101551e8 in main (argc=<optimized out>, argv=0x3fffffffe188) at ../../gcc/gcc/main.c:39

Forgot to mention: ggc_collect happens during pass_reload.

I think the issue is caused by Richi's r229405.

In this patch the following two lines were accidentally removed from 
 tree-ssa.c (delete_tree_ssa):

-  /* We no longer need the edge variable maps.  */
-  redirect_edge_var_map_destroy ();

Restoring them fixes the bug for me:

diff --git a/gcc/tree-ssa.c b/gcc/tree-ssa.c
index 84a4d5b..02fca4c 100644
--- a/gcc/tree-ssa.c
+++ b/gcc/tree-ssa.c
@@ -1126,6 +1126,9 @@ delete_tree_ssa (struct function *fn)
   fn->gimple_df->decls_to_pointers = NULL;
   fn->gimple_df->modified_noreturn_calls = NULL;
   fn->gimple_df = NULL;
+
+  /* We no longer need the edge variable maps.  */
+  redirect_edge_var_map_destroy ();
 }

 /* Return true if EXPR is a useless type conversion, otherwise return

On Sun, 15 Nov 2015, trippels at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117
> 
> --- Comment #25 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
> I think the issue is caused by Richi's r229405.
> 
> In this patch the following two lines were accidentally removed from 
>  tree-ssa.c (delete_tree_ssa):
> 
> -  /* We no longer need the edge variable maps.  */
> -  redirect_edge_var_map_destroy ();
> 
> Restoring them fixes the bug for me:

Hmm, they were removed "intentionally" (the function destroys
a global map which should never be non-NULL after a patch finished).
Of course I failed to add an assert for that ;)

> diff --git a/gcc/tree-ssa.c b/gcc/tree-ssa.c
> index 84a4d5b..02fca4c 100644
> --- a/gcc/tree-ssa.c
> +++ b/gcc/tree-ssa.c
> @@ -1126,6 +1126,9 @@ delete_tree_ssa (struct function *fn)
>    fn->gimple_df->decls_to_pointers = NULL;
>    fn->gimple_df->modified_noreturn_calls = NULL;
>    fn->gimple_df = NULL;
> +
> +  /* We no longer need the edge variable maps.  */
> +  redirect_edge_var_map_destroy ();
>  }
> 
>  /* Return true if EXPR is a useless type conversion, otherwise return
> 
>

Sth like

Index: gcc/tree-ssa.c
===================================================================
--- gcc/tree-ssa.c      (revision 230404)
+++ gcc/tree-ssa.c      (working copy)
@@ -125,6 +125,14 @@ redirect_edge_var_map_destroy (void)
   edge_var_maps = NULL;
 }
 
+/* Verify the edge_var_map is empty.  */
+
+void
+check_redirect_edge_var_map_empty (void)
+{
+  gcc_assert (!edge_var_maps || edge_var_maps->elements () == 0);
+}
+
 
 /* Remove the corresponding arguments from the PHI nodes in E's
    destination block and redirect it to DEST.  Return redirected edge.
Index: gcc/tree-ssa.h
===================================================================
--- gcc/tree-ssa.h      (revision 230404)
+++ gcc/tree-ssa.h      (working copy)
@@ -36,6 +36,7 @@ extern void redirect_edge_var_map_clear
 extern void redirect_edge_var_map_dup (edge, edge);
 extern vec<edge_var_map> *redirect_edge_var_map_vector (edge);
 extern void redirect_edge_var_map_destroy (void);
+extern void check_redirect_edge_var_map_empty (void);
 extern edge ssa_redirect_edge (edge, basic_block);
 extern void flush_pending_stmts (edge);
 extern void gimple_replace_ssa_lhs (gimple *, tree);
Index: gcc/passes.c
===================================================================
--- gcc/passes.c        (revision 230404)
+++ gcc/passes.c        (working copy)
@@ -2211,7 +2214,10 @@ execute_one_ipa_transform_pass (struct c
 
   /* Signal this is a suitable GC collection point.  */
   if (!(todo_after & TODO_do_not_ggc_collect))
-    ggc_collect ();
+    {
+      check_redirect_edge_var_map_empty ();
+      ggc_collect ();
+    }
 }
 
 /* For the current function, execute all ipa transforms. */
@@ -2380,7 +2386,10 @@ execute_one_pass (opt_pass *pass)
 
   /* Signal this is a suitable GC collection point.  */
   if (!((todo_after | pass->todo_flags_finish) & TODO_do_not_ggc_collect))
-    ggc_collect ();
+    {
+      check_redirect_edge_var_map_empty ();
+      ggc_collect ();
+    }
 
   return true;
 }

after all edge_var_maps is _not_ GTY marked.

(In reply to Richard Biener from comment #27)
> Sth like
> 
> Index: gcc/tree-ssa.c
> ===================================================================
> --- gcc/tree-ssa.c      (revision 230404)
> +++ gcc/tree-ssa.c      (working copy)
> @@ -125,6 +125,14 @@ redirect_edge_var_map_destroy (void)
>    edge_var_maps = NULL;
>  }
>  
> +/* Verify the edge_var_map is empty.  */
> +
> +void
> +check_redirect_edge_var_map_empty (void)
> +{
> +  gcc_assert (!edge_var_maps || edge_var_maps->elements () == 0);
> +}
> +
>  
>  /* Remove the corresponding arguments from the PHI nodes in E's
>     destination block and redirect it to DEST.  Return redirected edge.
> Index: gcc/tree-ssa.h
> ===================================================================
> --- gcc/tree-ssa.h      (revision 230404)
> +++ gcc/tree-ssa.h      (working copy)
> @@ -36,6 +36,7 @@ extern void redirect_edge_var_map_clear
>  extern void redirect_edge_var_map_dup (edge, edge);
>  extern vec<edge_var_map> *redirect_edge_var_map_vector (edge);
>  extern void redirect_edge_var_map_destroy (void);
> +extern void check_redirect_edge_var_map_empty (void);
>  extern edge ssa_redirect_edge (edge, basic_block);
>  extern void flush_pending_stmts (edge);
>  extern void gimple_replace_ssa_lhs (gimple *, tree);
> Index: gcc/passes.c
> ===================================================================
> --- gcc/passes.c        (revision 230404)
> +++ gcc/passes.c        (working copy)
> @@ -2211,7 +2214,10 @@ execute_one_ipa_transform_pass (struct c
>  
>    /* Signal this is a suitable GC collection point.  */
>    if (!(todo_after & TODO_do_not_ggc_collect))
> -    ggc_collect ();
> +    {
> +      check_redirect_edge_var_map_empty ();
> +      ggc_collect ();
> +    }
>  }
>  
>  /* For the current function, execute all ipa transforms. */
> @@ -2380,7 +2386,10 @@ execute_one_pass (opt_pass *pass)
>  
>    /* Signal this is a suitable GC collection point.  */
>    if (!((todo_after | pass->todo_flags_finish) & TODO_do_not_ggc_collect))
> -    ggc_collect ();
> +    {
> +      check_redirect_edge_var_map_empty ();
> +      ggc_collect ();
> +    }
>  
>    return true;
>  }
> 
> after all edge_var_maps is _not_ GTY marked.

triggers plenty of ICEs in my case:
/data/vjoost/clean/cp2k/cp2k/src/grid/fast.F:59:0:

 END SUBROUTINE rankup
 

internal compiler error: in check_redirect_edge_var_map_empty, at tree-ssa.c:133

Created attachment 36725 [details]
patch

Ok, that trips all over the place (a good sign that things are quite broken).
So instead of verifying we should maybe just empty the map at these points...

Like the attached which I am testing.

Ok, so we already do

void
remove_edge (edge e)
{
  if (current_loops != NULL)
    rescan_loop_exit (e, false, true);

  /* This is probably not needed, but it doesn't hurt.  */
  /* FIXME: This should be called via a remove_edge hook.  */
  if (current_ir_type () == IR_GIMPLE)
    redirect_edge_var_map_clear (e);

but we fail to clear the edge map data during RTL expansion.  So the simpler
patch

Index: gcc/cfgexpand.c
===================================================================
--- gcc/cfgexpand.c     (revision 230404)
+++ gcc/cfgexpand.c     (working copy)
@@ -6275,6 +6278,9 @@ pass_expand::execute (function *fun)
 
   expand_phi_nodes (&SA);
 
+  /* Release any stale SSA redirection data.  */
+  redirect_edge_var_map_destroy ();
+
   /* Register rtl specific functions for cfg.  */
   rtl_register_cfg_hooks ();
 
might be enough.

Author: rguenth
Date: Mon Nov 16 14:06:08 2015
New Revision: 230424

URL: https://gcc.gnu.org/viewcvs?rev=230424&root=gcc&view=rev
Log:
2015-11-16  Richard Biener  <rguenther@suse.de>

	PR middle-end/68117
	* cfgexpand.c (pass_expand::execute): Destroy the edge
	redirection var map before setting RTL CFG hooks.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/cfgexpand.c

(In reply to Gary Funck from comment #17)
> We're seeing this ICE on x86-64, while building the 32-bit libgfortran.
> We're building the target libraries with -O3 with GCC compiler checks
> enabled.

The recent r230424 commit did *not* fix this regression.  Note that we're building with CFLAGS_FOR_TARGET='-O3 -g'.

(In reply to Gary Funck from comment #32)
> (In reply to Gary Funck from comment #17)
> > We're seeing this ICE on x86-64, while building the 32-bit libgfortran.
> > We're building the target libraries with -O3 with GCC compiler checks
> > enabled.
> 
> The recent r230424 commit did *not* fix this regression.  Note that we're
> building with CFLAGS_FOR_TARGET='-O3 -g'.

Can you try the patch attached to comment #29?

(In reply to Richard Biener from comment #33)
> Can you try the patch attached to comment #29?

That seemed to fix the issue in 32/libgfortran, though I haven't tried a build from scratch yet.

Regarding the patch, in cfgexpand.c, I had to change the call to redirect_edge_var_map_empty() (was: redirect_edge_var_map_destroy).
Note there is no ggc_collect() call there, it appears in other places
in the patch.

On Tue, 17 Nov 2015, gary at intrepid dot com wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68117
> 
> --- Comment #34 from Gary Funck <gary at intrepid dot com> ---
> (In reply to Richard Biener from comment #33)
> > Can you try the patch attached to comment #29?
> 
> That seemed to fix the issue in 32/libgfortran, though I haven't tried a build
> from scratch yet.
> 
> Regarding the patch, in cfgexpand.c, I had to change the call to
> redirect_edge_var_map_empty() (was: redirect_edge_var_map_destroy).
> Note there is no ggc_collect() call there, it appears in other places
> in the patch.

Yes, I thought the cfgexpand.c place is a better one and the only one
that would be related to the place where I removed the old
redirect_edge_var_map_destroy call.

Hmm.  Maybe not for functions removed by cgraph code.

Does

Index: gcc/function.c
===================================================================
--- gcc/function.c      (revision 230428)
+++ gcc/function.c      (working copy)
@@ -75,6 +75,7 @@ along with GCC; see the file COPYING3.
 #include "tree-chkp.h"
 #include "rtl-chkp.h"
 #include "tree-dfa.h"
+#include "tree-ssa.h"
 
 /* So we can assign to cfun in this file.  */
 #undef cfun
@@ -4759,6 +4760,7 @@ set_cfun (struct function *new_cfun)
   if (cfun != new_cfun)
     {
       cfun = new_cfun;
+      redirect_edge_var_map_destroy ();
       invoke_set_current_function_hook (new_cfun ? new_cfun->decl : 
NULL_TREE);
     }
 }

help?  (without the comment #29 patch)

Does the patch in comment #25 help?

(In reply to rguenther@suse.de from comment #35)
> Yes, I thought the cfgexpand.c place is a better one and the only one
> that would be related to the place where I removed the old
> redirect_edge_var_map_destroy call.
> 
> Hmm.  Maybe not for functions removed by cgraph code.
> 
> Does
> [... patch ..]
> help?  (without the comment #29 patch)
> 
> Does the patch in comment #25 help?

It is getting a bit confusing.  Can you post a single patch to a given trunk reviiosn?

(In reply to Gary Funck from comment #36)
> (In reply to rguenther@suse.de from comment #35)
> > Yes, I thought the cfgexpand.c place is a better one and the only one
> > that would be related to the place where I removed the old
> > redirect_edge_var_map_destroy call.
> > 
> > Hmm.  Maybe not for functions removed by cgraph code.
> > 
> > Does
> > [... patch ..]
> > help?  (without the comment #29 patch)
> > 
> > Does the patch in comment #25 help?
> 
> It is getting a bit confusing.  Can you post a single patch to a given trunk
> reviiosn?

Does the following help on r230428 or newer?

Index: gcc/tree-ssa.c
===================================================================
--- gcc/tree-ssa.c      (revision 230428)
+++ gcc/tree-ssa.c      (working copy)
@@ -1126,6 +1145,9 @@ delete_tree_ssa (struct function *fn)
   fn->gimple_df->decls_to_pointers = NULL;
   fn->gimple_df->modified_noreturn_calls = NULL;
   fn->gimple_df = NULL;
+
+  /* We no longer need the edge variable maps.  */
+  redirect_edge_var_map_destroy ();
 }
 
 /* Return true if EXPR is a useless type conversion, otherwise return

(In reply to Richard Biener from comment #37)
>
> Does the following help on r230428 or newer?
> 
> Index: gcc/tree-ssa.c
> ===================================================================
> --- gcc/tree-ssa.c      (revision 230428)
> +++ gcc/tree-ssa.c      (working copy)
> @@ -1126,6 +1145,9 @@ delete_tree_ssa (struct function *fn)
>    fn->gimple_df->decls_to_pointers = NULL;
>    fn->gimple_df->modified_noreturn_calls = NULL;
>    fn->gimple_df = NULL;
> +
> +  /* We no longer need the edge variable maps.  */
> +  redirect_edge_var_map_destroy ();
>  }
>  
>  /* Return true if EXPR is a useless type conversion, otherwise return

Yes, was able to do a full bootstrap at -O3 of all languages.

Author: rguenth
Date: Thu Nov 19 08:47:16 2015
New Revision: 230594

URL: https://gcc.gnu.org/viewcvs?rev=230594&root=gcc&view=rev
Log:
2015-11-19  Richard Biener  <rguenther@suse.de>

	PR middle-end/68117
	* tree-ssa.c (delete_tree_ssa): Revert removal of call to
	redirect_edge_var_map_destroy.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/tree-ssa.c

Fixed.