[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #15 from Richard Biener  ---
Author: rguenth
Date: Thu Jan 26 08:16:37 2017
New Revision: 244918

URL: https://gcc.gnu.org/viewcvs?rev=244918=gcc=rev
Log:
2017-01-26  Richard Biener  

Backport from mainline
2016-09-27  Richard Biener  

PR tree-optimization/77745
* tree-ssa-pre.c (eliminate_dom_walker::before_dom_children):
When removing redundant stores make sure to check compatibility
of the TBAA state for downstream accesses.
* tree-ssa-sccvn.c (visit_reference_op_store): Likewise for when
value-numbering virtual operands for store matches.

* g++.dg/torture/pr77745.C: New testcase.

2016-09-29  Richard Biener  

PR tree-optimization/77768
* tree-ssa-sccvn.c (visit_reference_op_store): Properly deal
with stores to a place we know has a constant value.
* tree-vrp.c (set_defs_to_varying): New helper avoiding
writing to vr_const_varying.
(vrp_initialize): Call it.
(vrp_visit_stmt): Likewise.
(evrp_dom_walker::before_dom_children): Likewise.
* tree-ssa-pre.c (eliminate_dom_walker::before_dom_children):
Handle stores to readonly memory when removing redundant stores.

* gcc.dg/torture/pr77768.c: New testcase.

Added:
branches/gcc-5-branch/gcc/testsuite/g++.dg/torture/pr77745.C
branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr77768.c
Modified:
branches/gcc-5-branch/gcc/ChangeLog
branches/gcc-5-branch/gcc/testsuite/ChangeLog
branches/gcc-5-branch/gcc/tree-ssa-pre.c
branches/gcc-5-branch/gcc/tree-ssa-sccvn.c
branches/gcc-5-branch/gcc/tree-vrp.c

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #14 from Richard Biener  ---
Author: rguenth
Date: Thu Nov  3 13:25:51 2016
New Revision: 241818

URL: https://gcc.gnu.org/viewcvs?rev=241818=gcc=rev
Log:
2016-11-03  Richard Biener  

Backport from mainline
2016-09-29  Richard Biener  

PR tree-optimization/77768
* tree-ssa-sccvn.c (visit_reference_op_store): Properly deal
with stores to a place we know has a constant value.
* tree-vrp.c (set_defs_to_varying): New helper avoiding
writing to vr_const_varying.
(vrp_initialize): Call it.
(vrp_visit_stmt): Likewise.
(evrp_dom_walker::before_dom_children): Likewise.
* tree-ssa-pre.c (eliminate_dom_walker::before_dom_children):
Handle stores to readonly memory when removing redundant stores.

* gcc.dg/torture/pr77768.c: New testcase.

Added:
branches/gcc-6-branch/gcc/testsuite/gcc.dg/torture/pr77768.c
Modified:
branches/gcc-6-branch/gcc/ChangeLog
branches/gcc-6-branch/gcc/testsuite/ChangeLog
branches/gcc-6-branch/gcc/tree-ssa-pre.c
branches/gcc-6-branch/gcc/tree-ssa-sccvn.c
branches/gcc-6-branch/gcc/tree-vrp.c

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #13 from Richard Biener  ---
*** Bug 78195 has been marked as a duplicate of this bug. ***

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

Markus Trippelsdorf  changed:

   What|Removed |Added

 Status|ASSIGNED|RESOLVED
 Resolution|--- |FIXED

--- Comment #12 from Markus Trippelsdorf  ---
Finally fixed. Thanks.

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #11 from Richard Biener  ---
Author: rguenth
Date: Thu Sep 29 12:31:02 2016
New Revision: 240617

URL: https://gcc.gnu.org/viewcvs?rev=240617=gcc=rev
Log:
2016-09-29  Richard Biener  

PR tree-optimization/77768
* tree-ssa-pre.c (eliminate_dom_walker::before_dom_children):
Handle stores to readonly memory when removing redundant stores.

* gcc.dg/torture/pr77768.c: New testcase.

Added:
trunk/gcc/testsuite/gcc.dg/torture/pr77768.c
Modified:
trunk/gcc/ChangeLog
trunk/gcc/testsuite/ChangeLog
trunk/gcc/tree-ssa-pre.c

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #10 from rguenther at suse dot de  ---
On Thu, 29 Sep 2016, trippels at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768
> 
> --- Comment #8 from Markus Trippelsdorf  ---
> Looks like tree-ssa-pre.c also needs to be guarded:
> 
> 0x10c3a273 crash_signal
> ../../gcc/gcc/toplev.c:337
> 0x10f30e2c eliminate_dom_walker::before_dom_children(basic_block_def*)
> ../../gcc/gcc/tree-ssa-pre.c:4448
> 0x11807427 dom_walker::walk(basic_block_def*)
> ../../gcc/gcc/domwalk.c:265
> 0x10f2a9a7 eliminate
> ../../gcc/gcc/tree-ssa-pre.c:4709
> 0x10f3e31f execute
> ../../gcc/gcc/tree-ssa-pre.c:5055
> 
> 
> diff --git a/gcc/tree-ssa-pre.c b/gcc/tree-ssa-pre.c
> index 3675fb9..cc008c2 100644
> --- a/gcc/tree-ssa-pre.c
> +++ b/gcc/tree-ssa-pre.c
> @@ -4445,8 +4445,8 @@ eliminate_dom_walker::before_dom_children (basic_block 
> b)
>   /* We can only remove the later store if the former aliases
>  at least all accesses the later one does.  */
>   alias_set_type set = get_alias_set (lhs);
> - if (vnresult->set == set
> - || alias_set_subset_of (set, vnresult->set))
> + if (vnresult && (vnresult->set == set
> + || alias_set_subset_of (set, vnresult->set)))
> {
>   if (dump_file && (dump_flags & TDF_DETAILS))
> {

I'm testing ! vnresult || vnresult->set == ... instead, we can remove
stores to readonly memory if it stores the same value as present.

Richard.

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #9 from Richard Biener  ---
Author: rguenth
Date: Thu Sep 29 07:15:13 2016
New Revision: 240610

URL: https://gcc.gnu.org/viewcvs?rev=240610=gcc=rev
Log:
2016-09-29  Richard Biener  

PR tree-optimization/77768
* tree-ssa-sccvn.c (visit_reference_op_store): Properly deal
with stores to a place we know has a constant value.

Modified:
trunk/gcc/ChangeLog
trunk/gcc/tree-ssa-sccvn.c

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #8 from Markus Trippelsdorf  ---
Looks like tree-ssa-pre.c also needs to be guarded:

0x10c3a273 crash_signal
../../gcc/gcc/toplev.c:337
0x10f30e2c eliminate_dom_walker::before_dom_children(basic_block_def*)
../../gcc/gcc/tree-ssa-pre.c:4448
0x11807427 dom_walker::walk(basic_block_def*)
../../gcc/gcc/domwalk.c:265
0x10f2a9a7 eliminate
../../gcc/gcc/tree-ssa-pre.c:4709
0x10f3e31f execute
../../gcc/gcc/tree-ssa-pre.c:5055


diff --git a/gcc/tree-ssa-pre.c b/gcc/tree-ssa-pre.c
index 3675fb9..cc008c2 100644
--- a/gcc/tree-ssa-pre.c
+++ b/gcc/tree-ssa-pre.c
@@ -4445,8 +4445,8 @@ eliminate_dom_walker::before_dom_children (basic_block b)
  /* We can only remove the later store if the former aliases
 at least all accesses the later one does.  */
  alias_set_type set = get_alias_set (lhs);
- if (vnresult->set == set
- || alias_set_subset_of (set, vnresult->set))
+ if (vnresult && (vnresult->set == set
+ || alias_set_subset_of (set, vnresult->set)))
{
  if (dump_file && (dump_flags & TDF_DETAILS))
{

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

Markus Trippelsdorf  changed:

   What|Removed |Added

 CC||chengniansun at gmail dot com

--- Comment #7 from Markus Trippelsdorf  ---
*** Bug 8 has been marked as a duplicate of this bug. ***

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

Richard Biener  changed:

   What|Removed |Added

 Status|UNCONFIRMED |ASSIGNED
   Last reconfirmed||2016-09-28
   Assignee|unassigned at gcc dot gnu.org  |rguenth at gcc dot 
gnu.org
 Ever confirmed|0   |1

--- Comment #6 from Richard Biener  ---
So somebody is writing to vr_const_varying declared here:

static value_range *
get_value_range (const_tree var)
{
  static const value_range vr_const_varying
= { VR_VARYING, NULL_TREE, NULL_TREE, NULL };
...
  /* If we query the range for a new SSA name return an unmodifiable VARYING.
 We should get here at most from the substitute-and-fold stage which
 will never try to change values.  */
  if (ver >= num_vr_values)
return CONST_CAST (value_range *, _const_varying);

I wonder if this is related to early VRP or latent.  Yeah,

  FOR_EACH_SSA_TREE_OPERAND (def, stmt, iter, SSA_OP_DEF)
set_value_range_to_varying (get_value_range (def));

those callers are certainly prone of hitting this after we eventually allocated
new SSA names (early VRP folds and thus does).

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #5 from Markus Trippelsdorf  ---
(gdb) p vnresult
$1 = (vn_reference_s *) 0x0

(gdb) p debug_tree(lhs) 
 
unit size 
align 32 symtab 0 alias set -1 canonical type 0x3fffaf63bc58
precision 3 min  max >
unsigned SI size  unit size 
align 32 symtab 0 alias set -1 canonical type 0x3fffaf590738 precision
32 min  max 
values  value

chain  value

chain 
value 
chain 
value 
chain  value > context 
chain >

arg 0 
unit size 
align 64 symtab 0 alias set -1 canonical type 0x3fffaffaabf0 fields
 context 
pointer_to_this  reference_to_this
>
readonly addressable public static BLK file ../../gcc/gcc/tree-vrp.c
line 646 col 0 size  unit size 
align 64 context  initial

chain 
unsigned DI file ../../gcc/gcc/tree-vrp.c line 648 col 0
size 
unit size 
align 64 context 
chain >>
arg 1 
unsigned nonlocal SI file ../../gcc/gcc/tree-vrp.h line 30 col 0 size
 unit size 
align 32 offset_align 128
offset 
bit offset  context 
chain 
unsigned nonlocal DI file ../../gcc/gcc/tree-vrp.h line 43 col 0
size  unit size 
align 64 offset_align 128 offset  bit
offset  context  chain >>
../../gcc/gcc/tree-vrp.c:339:0 start: ../../gcc/gcc/tree-vrp.c:339:0
finish: ../../gcc/gcc/tree-vrp.c:339:0>
$3 = void

(gdb) p debug_tree(0x3fffa6ee5e80)  
 >
var 
def_stmt .MEM_834 = PHI <.MEM_258(504), .MEM_1232(486)>
version 834>
$9 = void

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #4 from Richard Biener  ---
Interesting.  This means vnresult is NULL.  I see we can arrive here through

tree
vn_reference_lookup (tree op, tree vuse, vn_lookup_kind kind,
 vn_reference_t *vnresult, bool tbaa_p)
{
  vec operands;
  struct vn_reference_s vr1;
  tree cst;
  bool valuezied_anything;

  if (vnresult)
*vnresult = NULL;

  vr1.vuse = vuse_ssa_val (vuse);
  vr1.operands = operands
= valueize_shared_reference_ops_from_ref (op, _anything);
  vr1.type = TREE_TYPE (op);
  vr1.set = tbaa_p ? get_alias_set (op) : 0;
  vr1.hashcode = vn_reference_compute_hash ();
  if ((cst = fully_constant_vn_reference_p ()))
return cst;

but somehow this means that we have sth like

static const int i[5] = { 1, 2, 3, };

  i[1] = 2;

which should prevent the initializer from being constant ...  A really odd
case I'd like to see a testcase for (trying to reproduce on x86_64 right now).

A simple "fix" is to guard the code for the vnresult == NULL, erring on
the safe side.

Can you dump me the stmt and maybe also the stored decl (with debug_tree)?

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #3 from Markus Trippelsdorf  ---
So it looks like r240534 is causing this issue.

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

--- Comment #2 from Markus Trippelsdorf  ---
0x10c39b13 crash_signal
../../gcc/gcc/toplev.c:337
0x10f818d8 visit_reference_op_store
../../gcc/gcc/tree-ssa-sccvn.c:3613
0x10f818d8 visit_use
../../gcc/gcc/tree-ssa-sccvn.c:3858
0x10f8378f process_scc
../../gcc/gcc/tree-ssa-sccvn.c:4142
0x10f8378f extract_and_process_scc_for_name
../../gcc/gcc/tree-ssa-sccvn.c:4198
0x10f8378f DFS
../../gcc/gcc/tree-ssa-sccvn.c:4250
0x10f84f6b sccvn_dom_walker::before_dom_children(basic_block_def*)
../../gcc/gcc/tree-ssa-sccvn.c:4703
0x11806c07 dom_walker::walk(basic_block_def*)
../../gcc/gcc/domwalk.c:265
0x10f7f1e3 run_scc_vn(vn_lookup_kind)
../../gcc/gcc/tree-ssa-sccvn.c:4827
0x10f3d653 execute
../../gcc/gcc/tree-ssa-pre.c:5021
Please submit a full bug report,

[Bug bootstrap/77768] [7 Regression] LTO/PGO -O3 bootstrap broken: tree-vrp.c:11053:0: internal compiler error: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77768

Richard Biener  changed:

   What|Removed |Added

   Keywords||lto
 CC||rguenth at gcc dot gnu.org
   Target Milestone|--- |7.0

--- Comment #1 from Richard Biener  ---
Hmpf, that's little information.  I guess it's caused by

  /* Pick up flags from a devirtualization target.  */
  tree fn = gimple_call_fn (stmt);
  int extra_fnflags = 0;
  if (fn && TREE_CODE (fn) == SSA_NAME)
{
  fn = SSA_VAL (fn);
  if (TREE_CODE (fn) == ADDR_EXPR
  && TREE_CODE (TREE_OPERAND (fn, 0)) == FUNCTION_DECL)
extra_fnflags = flags_from_decl_or_type (TREE_OPERAND (fn, 0));
}

but I cant' see what the issue is whith this (how it can even segfault).