[Bug tree-optimization/58640] [4.9 Regression] wrong code (segfaults) at -O3 on x86_64-linux-gnu

["olegendo at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58640

Oleg Endo <olegendo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |olegendo at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org

--- Comment #11 from Oleg Endo <olegendo at gcc dot gnu.org> ---
(In reply to Jeffrey A. Law from comment #6)
> Author: law
> Date: Fri Oct 11 20:31:25 2013
> New Revision: 203463
> 
> URL: http://gcc.gnu.org/viewcvs?rev=203463&root=gcc&view=rev
> Log:
> 	PR tree-optimization/58640
> 	* tree-ssa-threadupdate.c (mark_threaded_blocks): Truncate jump threading
> 	paths that cross over two loop entry points.
> 
> 	* gcc.c-torture/execute/pr58640.c: New test.
> 
> Added:
>     trunk/gcc/testsuite/gcc.c-torture/execute/pr58640.c
> Modified:
>     trunk/gcc/ChangeLog
>     trunk/gcc/testsuite/ChangeLog
>     trunk/gcc/tree-ssa-threadupdate.c

After this commit, the SH specific test case gcc.target/sh/pr51244-18.c caught
the following sequence:

.L15:
    mov    #0,r1      // r1 = 0
    tst    r1,r1      // T = r1 == 0
    bf.s    .L7        // if (T == 0) goto .L7
    add    #-4,r9

in other words, the branch never happens.
Something causes the loop2_doloop RTL pass to create the following code, which
results in the above final code. 

(code_label 108 107 109 4 2 "" [0 uses])
(note 109 108 110 4 [bb 4] NOTE_INSN_BASIC_BLOCK)
      .
      .
      .
(insn 177 176 185 4 (set (reg:SI 304)
        (plus:SI (reg:SI 305)
            (const_int 1 [0x1]))) -1
     (nil))

(note 185 177 180 16 [bb 16] NOTE_INSN_BASIC_BLOCK)
(insn 180 185 182 16 (set (reg:SI 306)
        (plus:SI (reg/v:SI 278 [ k ])
            (const_int -8 [0xfffffffffffffff8]))) -1
     (nil))
(insn 182 180 183 16 (set (reg:SI 307)
        (const_int -8 [0xfffffffffffffff8])) -1
     (nil))
(insn 183 182 184 16 (set (reg:SI 147 t)
        (ge:SI (reg:SI 306)
            (reg:SI 307))) -1
     (nil))
(jump_insn 184 183 181 16 (set (pc)
        (if_then_else (eq (reg:SI 147 t)
                (const_int 0 [0]))
            (label_ref 181)
            (pc))) -1
     (int_list:REG_BR_PROB 0 (nil))
 -> 181)


(code_label 181 184 178 14 10 "" [1 uses])
(note 178 181 186 14 [bb 14] NOTE_INSN_BASIC_BLOCK)
(insn 186 178 179 14 (set (reg:SI 304)
        (const_int 1 [0x1])) -1
     (nil))

(note 179 186 155 15 [bb 15] NOTE_INSN_BASIC_BLOCK)
      .
      .
      .

      .
      .
      .

(code_label 149 146 150 9 5 "" [1 uses])
(note 150 149 151 9 [bb 9] NOTE_INSN_BASIC_BLOCK)
(insn 151 150 152 9 (set (reg/v:SI 261 [ k ])
        (plus:SI (reg/v:SI 261 [ k ])
            (const_int -8 [0xfffffffffffffff8]))) pr51244-18.c:48 68
{*addsi3_compact}
     (nil))
(insn 152 151 175 9 (set (reg:SI 147 t)
        (ge:SI (reg/v:SI 261 [ k ])
            (const_int 0 [0]))) pr51244-18.c:49 20 {cmpgesi_t}
     (nil))
(jump_insn 175 152 174 9 (parallel [
            (set (pc)
                (if_then_else (ne:SI (reg:SI 304)
                        (const_int 1 [0x1]))
                    (label_ref 174)
                    (pc)))
            (set (reg:SI 304)
                (plus (reg:SI 304)
                    (const_int -1 [0xffffffffffffffff])))
            (clobber (reg:SI 147 t))
        ]) pr51244-18.c:49 -1
     (int_list:REG_BR_PROB 9700 (nil))
 -> 174)


jump_insn 175 is SH's decrement-and-test pattern that is used for loops.