[tree-ssa] Out of SSA bug

Fri Jun 20 05:20:00 GMT 2003

In message <1056072939.27396.42.camel@frodo.toronto.redhat.com>, Diego Novillo 
writes:
 >On Thu, 2003-06-19 at 20:28, Jeff Sturm wrote:
 >
 >> (gdb) frame
 >> #1  0x08397ec7 in bsi_insert_after (curr_bsi=0xbffff558, t=0x402bee8c,
 >> mode=BSI_NEW_STMT) at ../../gcc/tree-cfg.c:3485
 >> 3485	        abort ();
 >> 
 >> (gdb) p *curr_bb
 >> $16 = {head = 0x0, end = 0x0, head_tree_p = 0x0, end_tree_p = 0x0,
 >>   pred = 0x85eb4c4, succ = 0x85eab24, local_set = 0x0, cond_local_set = 0x0
 >,
 >>   global_live_at_start = 0x0, global_live_at_end = 0x0, aux = 0x85e8988,
 >>   index = 92, prev_bb = 0x85e655c, next_bb = 0x85e64b4, loop_depth = 0,
 >>   loop_father = 0x0, count = 0, frequency = 0, flags = 2}
 >> 
 >
 >That looks odd.  Could you set a breakpoint in create_bb() for
 >n_basic_blocks == 92?  Is it being created by tree_split_edge?  That
 >block ought to have something in head_tree_p and end_tree_p.
Note, I'm definitely tracking a bug in the new insertion code.   I
don't know if it's the same bug Jeff is triggering though.  It's (of course)
blocking the next EH clean up patch :(

Consider the following before the out-of-ssa pass:

ffeexpr_declare_unadorned_ (t, maybe_intrin)
{
  int T.94;
  struct _ffesymbol_ * T.95;
  int T.96;
  ffesymbolState T.97;
  unsigned int T.98;
  struct _ffesymbol_ * T.99;
  void understood = <<< error >>>;
  struct _ffesymbol_ * s;
  extern  ffeexpr_context_outer_;

  # BLOCK 0 (j.c:9346).  PRED: -1.  SUCC: 2 1.
  T.94_4 = (int)maybe_intrin_3;

  #   .GLOBAL_VAR_8 = VDEF <.GLOBAL_VAR_7>;
  T.95_6 = ffesymbol_declare_local (t_5, T.94_4);
  (void)0;

  #   .GLOBAL_VAR_11 = VDEF <.GLOBAL_VAR_8>;
  #   VUSE <.GLOBAL_VAR_8>;
  T.96_10 = ffeexpr_context_outer_ (ffeexpr_stack_);
  switch (T.96_10)
    {
      {

        # BLOCK 1 (j.c:9349).  PRED: 0.  SUCC: -2.
        case 51:;
        case 56:;

        #   struct _ffesymbol_ *_13 = VDEF <struct _ffesymbol_ *_12>;
        return T.95_6;;

        # BLOCK 2 (j.c:9352).  PRED: 0.  SUCC: 3.
        default :;
        goto <UL94d0>;
      }
    };

  # BLOCK 3.  PRED: 2.  SUCC: 5 4 -2.
  <UL94d0>:;;

  #   VUSE <.GLOBAL_VAR_11>;
  T.97_14 = T.95_6->state;
  T.98_15 = (unsigned int)T.97_14;
  switch (T.98_15)
    {
      {

        # BLOCK 4 (j.c:9357).  PRED: 3.  SUCC: 5.
        case 2:;

        #   .GLOBAL_VAR_17 = VDEF <.GLOBAL_VAR_11>;
        T.99_16 = ffeexpr_sym_rhs_let_ (T.95_6, t_5);
        (void)0;

        # BLOCK 5 (j.c:9359).  PRED: 3 4.  SUCC: 6.
        #   .GLOBAL_VAR_1 = PHI <.GLOBAL_VAR_11(3), .GLOBAL_VAR_17(4)>;
        #   s_2 = PHI <T.95_6(3), T.99_16(4)>;
        case 3:;

        # BLOCK 6.  PRED: 5.  SUCC: -2.
        understood:;;

        #   struct _ffesymbol_ *_19 = VDEF <struct _ffesymbol_ *_12>;
        return s_2;
      }
    }
}

Assume we take the default case in the first switch and case #3 in the second
switch.    We can see that s_2 should get a value from 

s_2 = PHI <T.95_6, T.99_16)

Now let's look at the dump after we've finished our out of ssa translation:

ffeexpr_declare_unadorned_ (t, maybe_intrin)
{
  int T.94;
  struct _ffesymbol_ * T.95;
  int T.96;
  ffesymbolState T.97;
  unsigned int T.98;
  struct _ffesymbol_ * T.99;
  void understood = <<< error >>>;
  struct _ffesymbol_ * s;
  extern  ffeexpr_context_outer_;

  # BLOCK 0 (j.c:9346).  PRED: -1.  SUCC: 2 1.
  T.94 = (int)maybe_intrin;

  #   .GLOBAL_VAR_8 = VDEF <.GLOBAL_VAR_7>;
  T.95 = ffesymbol_declare_local (t, T.94);
  (void)0;

  #   .GLOBAL_VAR_11 = VDEF <.GLOBAL_VAR_8>;
  #   VUSE <.GLOBAL_VAR_8>;
  T.96 = ffeexpr_context_outer_ (ffeexpr_stack_);
  switch (T.96)
    {
      {

        # BLOCK 1 (j.c:9349).  PRED: 0.  SUCC: -2.
        case 51:;
        case 56:;

        #   struct _ffesymbol_ *_13 = VDEF <struct _ffesymbol_ *_12>;
        return T.95;;

        # BLOCK 2 (j.c:9352).  PRED: 0.  SUCC: 3.
        default :;
        goto <UL94d0>;
      }
    };

  # BLOCK 3.  PRED: 2.  SUCC: 7 4 -2.
  <UL94d0>:;;

  #   VUSE <.GLOBAL_VAR_11>;
  T.97 = T.95->state;
  T.98 = (unsigned int)T.97;
  switch (T.98)
    {
      {

        # BLOCK 4 (j.c:9357).  PRED: 3.  SUCC: 5.
        case 2:;

        #   .GLOBAL_VAR_17 = VDEF <.GLOBAL_VAR_11>;
        T.99 = ffeexpr_sym_rhs_let_ (T.95, t);
        (void)0;
        s = T.99;
        goto <ULe770>;;

        # BLOCK 7 (j.c:9359).  PRED: 3.  SUCC: 5.
        case 3:;

        # BLOCK 5.  PRED: 7 4.  SUCC: 6.
        <ULe770>:;;

        # BLOCK 7 (j.c:9359).  PRED: 3.  SUCC: 5.
        understood:;;

        #   struct _ffesymbol_ *_19 = VDEF <struct _ffesymbol_ *_12>;
        return s;;
        s = T.95
      }
    }
}

Follow the same path through the code -- note carefully "s" is never
initialized if you take the default in the first switch and case #3
in the second switch.

The only interesting tidbit I've noticed so far is that the problem goes
away if the "understood:" label is removed.

Anyway, I'm probably done for today....  

Jeff

ps.  Andrew -- this is the cause of the massive g77 failures I touched on
privately.  It turns out to trigger this bug you have to have code which
puts the result of function calls into a temporary before assigning it to
a user variable to trigger this bug.