[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

Richard Biener  changed:

   What|Removed |Added

   Priority|P1  |P2
  Known to work||8.0
   Target Milestone|8.0 |7.4
Summary|[8 Regression] ICE on valid |[7 Regression] ICE on valid
   |code at -O2 and -O3:|code at -O2 and -O3:
   |Segmentation fault  |Segmentation fault
   Priority|P2  |P1
  Known to work|8.0 |
   Target Milestone|7.4 |8.0
Summary|[7 Regression] ICE on valid |[8 Regression] ICE on valid
   |code at -O2 and -O3:|code at -O2 and -O3:
   |Segmentation fault  |Segmentation fault

--- Comment #8 from Richard Biener  ---
Fixed on trunk, I'm eventually going to backport a variant of this.

--- Comment #9 from Richard Biener  ---
Author: rguenth
Date: Thu Mar  8 09:23:44 2018
New Revision: 258361

URL: https://gcc.gnu.org/viewcvs?rev=258361=gcc=rev
Log:
2018-03-08  Richard Biener  

PR tree-optimization/84746
* tree-ssa-pre.c (find_leader_in_sets): Deal with SET1 being NULL.
(phi_translate): Pass in destination ANTIC_OUT set.
(phi_translate_1): Likewise.  For a simplified result lookup
a leader in ANTIC_OUT and AVAIL_OUT, not the ANTIC_IN sets.
(phi_translate_set): Adjust.
(do_pre_regular_insertion): Likewise.
(do_pre_partial_partial_insertion): Likewise.

* gcc.dg/torture/pr84746.c: New testcase.

Added:
trunk/gcc/testsuite/gcc.dg/torture/pr84746.c
Modified:
trunk/gcc/ChangeLog
trunk/gcc/testsuite/ChangeLog
trunk/gcc/tree-ssa-pre.c

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

Richard Biener  changed:

   What|Removed |Added

   Priority|P1  |P2
  Known to work||8.0
   Target Milestone|8.0 |7.4
Summary|[8 Regression] ICE on valid |[7 Regression] ICE on valid
   |code at -O2 and -O3:|code at -O2 and -O3:
   |Segmentation fault  |Segmentation fault
   Priority|P2  |P1
  Known to work|8.0 |
   Target Milestone|7.4 |8.0
Summary|[7 Regression] ICE on valid |[8 Regression] ICE on valid
   |code at -O2 and -O3:|code at -O2 and -O3:
   |Segmentation fault  |Segmentation fault

--- Comment #8 from Richard Biener  ---
Fixed on trunk, I'm eventually going to backport a variant of this.

--- Comment #9 from Richard Biener  ---
Author: rguenth
Date: Thu Mar  8 09:23:44 2018
New Revision: 258361

URL: https://gcc.gnu.org/viewcvs?rev=258361=gcc=rev
Log:
2018-03-08  Richard Biener  

PR tree-optimization/84746
* tree-ssa-pre.c (find_leader_in_sets): Deal with SET1 being NULL.
(phi_translate): Pass in destination ANTIC_OUT set.
(phi_translate_1): Likewise.  For a simplified result lookup
a leader in ANTIC_OUT and AVAIL_OUT, not the ANTIC_IN sets.
(phi_translate_set): Adjust.
(do_pre_regular_insertion): Likewise.
(do_pre_partial_partial_insertion): Likewise.

* gcc.dg/torture/pr84746.c: New testcase.

Added:
trunk/gcc/testsuite/gcc.dg/torture/pr84746.c
Modified:
trunk/gcc/ChangeLog
trunk/gcc/testsuite/ChangeLog
trunk/gcc/tree-ssa-pre.c

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

--- Comment #7 from Richard Biener  ---
This is also latent on the GCC 7 branch.

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

--- Comment #6 from Richard Biener  ---
The issue is PRE inserted a PHI with a SSA name argument that is not available
there.  The reason is that

constant = fully_constant_expression (expr);
...
if (constant->kind != CONSTANT)
  {
...
unsigned value_id = get_expr_value_id (constant);
constant = find_leader_in_sets (value_id, set1, set2,
AVAIL_OUT (pred));

is wrong in using the ANTIC sets to find a leader.  See the original fix I
pasted into PR84670.  This fix regresses some testcase(s) though
(gcc.dg/tree-ssa/pr35287.c at least).  Trying to recover with sth more clever
regressed sth else.  As the other fix (for the assert) fixed all testcases
I had I didn't pursue this further.

Looking again.

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

Richard Biener  changed:

   What|Removed |Added

   Priority|P3  |P1
 Status|NEW |ASSIGNED
Version|unknown |8.0
   Assignee|unassigned at gcc dot gnu.org  |rguenth at gcc dot 
gnu.org

--- Comment #5 from Richard Biener  ---
Mine.

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

--- Comment #4 from Jakub Jelinek  ---
The SSA_NAME has been freed in:
#1  0x01291cfd in release_ssa_name_fn (fn=0x7fffefd9b000,
var=) at ../../gcc/tree-ssanames.c:579
#2  0x010b76eb in release_ssa_name (name=)
at ../../gcc/tree-ssanames.h:141
#3  0x010b8590 in remove_phi_node (gsi=0x7fffdb50,
release_lhs_p=true) at ../../gcc/tree-phinodes.c:449
#4  0x01221501 in vn_eliminate (inserted_exprs=0x2b51008) at
../../gcc/tree-ssa-sccvn.c:5928
#5  0x011e94a2 in (anonymous namespace)::pass_pre::execute
(this=0x2ae9720, fun=0x7fffefd9b000) at ../../gcc/tree-ssa-pre.c:4173
#6  0x00e735c5 in execute_one_pass (pass=) at ../../gcc/passes.c:2497

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

Jakub Jelinek  changed:

   What|Removed |Added

 CC||jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek  ---
We are calling update_dep_bb on a in-freelist SSA_NAME.

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

--- Comment #2 from Marek Polacek  ---
Started with r258124.

[Bug tree-optimization/84746] [8 Regression] ICE on valid code at -O2 and -O3: Segmentation fault

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84746

Marek Polacek  changed:

   What|Removed |Added

   Keywords||ice-on-valid-code
 Status|UNCONFIRMED |NEW
   Last reconfirmed||2018-03-07
 CC||mpolacek at gcc dot gnu.org
   Target Milestone|--- |8.0
Summary|ICE on valid code at -O2|[8 Regression] ICE on valid
   |and -O3: Segmentation fault |code at -O2 and -O3:
   ||Segmentation fault
 Ever confirmed|0   |1

--- Comment #1 from Marek Polacek  ---
Confirmed.