ICE due to tree-sra.c vs tree-dfa.c mismatch

[Ulrich Weigand <weigand at i1 dot informatik dot uni-erlangen dot de>]

Hello,

I'm seeing an ICE in gcc.c-torture/execute/980223.c on s390(x) when building
with -O3.  The compiler crashes like so:

#0  0x005478d0 in note_addressable (var=0x40249e00, s_ann=0x4026d1b0) at ../../gcc-head/gcc/tree-ssa-operands.c:1433
#1  0x00546ee6 in add_stmt_operand (var_p=0x4024a97c, stmt=0x40268320, flags=0, prev_vops=0x0)
    at ../../gcc-head/gcc/tree-ssa-operands.c:1292
#2  0x00542978 in get_expr_operands (stmt=0x40268320, expr_p=0x4024a97c, flags=0, prev_vops=0x7fffefb8)
    at ../../gcc-head/gcc/tree-ssa-operands.c:856
#3  0x00545472 in get_expr_operands (stmt=0x40268320, expr_p=0x40268340, flags=0, prev_vops=0x7fffefb8)
    at ../../gcc-head/gcc/tree-ssa-operands.c:1111
#4  0x00541aae in get_stmt_operands (stmt=0x40268320) at ../../gcc-head/gcc/tree-ssa-operands.c:756
#5  0x00508286 in mark_def_sites (walk_data=0x7ffff328, bb=0x40267500, bsi={tsi = {ptr = 0x0, container = 0x0}, bb = 0xafafafaf})
    at ../../gcc-head/gcc/tree-into-ssa.c:357
#6  0x00572684 in walk_dominator_tree (walk_data=0x7ffff328, bb=0x40267500) at ../../gcc-head/gcc/domwalk.c:189
#7  0x005726fa in walk_dominator_tree (walk_data=0x7ffff328, bb=0x40267300) at ../../gcc-head/gcc/domwalk.c:205
#8  0x0050dc12 in rewrite_into_ssa (all=0 '\0') at ../../gcc-head/gcc/tree-into-ssa.c:1686
#9  0x004dd938 in execute_todo (flags=15) at ../../gcc-head/gcc/tree-optimize.c:350
#10 0x004ddbd4 in execute_one_pass (pass=0xa7aa08) at ../../gcc-head/gcc/tree-optimize.c:415
#11 0x004ddc9e in execute_pass_list (pass=0xa7aa08) at ../../gcc-head/gcc/tree-optimize.c:434
#12 0x004ddcc2 in execute_pass_list (pass=0xa7a53c) at ../../gcc-head/gcc/tree-optimize.c:435
#13 0x004ddf38 in tree_rest_of_compilation (fndecl=0x40249f80, nested_p=0 '\0') at ../../gcc-head/gcc/tree-optimize.c:510
#14 0x0042e550 in c_expand_body (fndecl=0x40249f80) at ../../gcc-head/gcc/c-decl.c:6347
#15 0x009181ee in cgraph_expand_function (node=0x4024d380) at ../../gcc-head/gcc/cgraphunit.c:797
#16 0x0091ab52 in cgraph_expand_all_functions () at ../../gcc-head/gcc/cgraphunit.c:1669
#17 0x0091af56 in cgraph_optimize () at ../../gcc-head/gcc/cgraphunit.c:1759
#18 0x0042f368 in c_write_global_declarations () at ../../gcc-head/gcc/c-decl.c:6653
#19 0x0088bea4 in compile_file () at ../../gcc-head/gcc/toplev.c:994
#20 0x0088e6e2 in do_compile () at ../../gcc-head/gcc/toplev.c:2066
#21 0x0088e7a8 in toplev_main (argc=3, argv=0x7ffffae4) at ../../gcc-head/gcc/toplev.c:2098
#22 0x004ab2da in main (argc=3, argv=0x7ffffae4) at ../../gcc-head/gcc/main.c:35

because of accessing a NULL var_ann of the variable 'cons2'.

This variable orginally only occurs within a static initializer:

main()
{
  object x = {(char *) &cons2, 64};
  object y = {(char *) &nil, 0};
  object three = foo(x,y);
  return 0;
}

and thus the find_referenced_vars loop in tree-dfa.c never gets to 
creating a var_ann structure for 'cons2'.

However, the scalar replacement pass replaces the initializer
with two scalar assignments:

  static struct object C.13 = {.addr=(char *)&nil, .type=0};
  static struct object C.12 = {.addr=(char *)&cons2, .type=64};
  struct object retval.29;
  struct object retval.28;

<bb 0>:
  x$addr = (char *)&cons2;
  x$type = 64;
  x$type = x$type;
  x$addr = x$addr;

and now cons2 suddenly does show up in regular code.  The rewrite_into_ssa
pass following after scalar replacement thus crashes ...


I'm not sure who's at fault here.  Should note_addressable be able to
handle variables without var_ann?  Should this never have been
scalarized?  Or should find_referenced_vars have generated annotations
for such variables as well?

Bye,
Ulrich

-- 
  Dr. Ulrich Weigand
  weigand@informatik.uni-erlangen.de