[Bug tree-optimization/61529] New: ICE on valid code at -O3 on x86_64-linux-gnu in check_probability, at basic-block.h:953

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

Bug ID: 61529
Summary: ICE on valid code at -O3 on x86_64-linux-gnu in
check_probability, at basic-block.h:953
Product: gcc
Version: 4.10.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: su at cs dot ucdavis.edu

The following code causes an ICE when compiled with the current gcc trunk at
-O3 on x86_64-linux-gnu in both 32-bit and 64-bit modes.

It is a regression from 4.9.x.

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.10.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 4.10.0 20140616 (experimental) [trunk revision 211707] (GCC)
$
$ gcc-trunk -O2 small.c; a.out
$ gcc-4.9 -O3 small.c; a.out
$
$ gcc-trunk -O3 small.c
small.c: In function ‘fn1’:
small.c:4:1: internal compiler error: in check_probability, at
basic-block.h:953
fn1 ()
^
0xb905e6 check_probability
../../gcc-trunk/gcc/basic-block.h:953
0xb8dde1 check_probability
../../gcc-trunk/gcc/tree-vect-loop-manip.c:653
0xb8dde1 combine_probabilities
../../gcc-trunk/gcc/basic-block.h:962
0xb8dde1 slpeel_tree_peel_loop_to_edge
../../gcc-trunk/gcc/tree-vect-loop-manip.c:1371
0xb8e154 vect_do_peeling_for_loop_bound(_loop_vec_info*, tree_node*,
tree_node*, unsigned int, bool)
../../gcc-trunk/gcc/tree-vect-loop-manip.c:1761
0xb7f3a7 vect_transform_loop(_loop_vec_info*)
../../gcc-trunk/gcc/tree-vect-loop.c:5852
0xb9c286 vectorize_loops()
../../gcc-trunk/gcc/tree-vectorizer.c:476
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$


----------------------------


char a, b, c, d, e, f, g;

void
fn1 ()
{
char h = 0;
lbl:
for (c = 0; c; c = 0)
for (; a;)
for (d = 1; d; d++)
if ((b & ((g > 0) >= h)) ^ 2)
goto lbl;
for (f = 1; f; f++)
e ^= 1;
}

int
main ()
{
fn1 ();
return 0;
}

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

Richard Biener <rguenth at gcc dot gnu.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P1
Status|UNCONFIRMED |NEW
Last reconfirmed| |2014-06-17
Component|tree-optimization |middle-end
Target Milestone|--- |4.10.0
Summary|ICE on valid code at -O3 on |[4.10 Regression] ICE on
|x86_64-linux-gnu in |valid code at -O3 on
|check_probability, at |x86_64-linux-gnu in
|basic-block.h:953 |check_probability, at
| |basic-block.h:953
Ever confirmed|0 |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

--- Comment #2 from Zhendong Su <su at cs dot ucdavis.edu> ---
Here is another test case that triggers the same ICE:

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.10.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 4.10.0 20140804 (experimental) [trunk revision 213529] (GCC)
$
$ gcc-trunk -O3 small.c
small.c: In function ‘main’:
small.c:9:1: internal compiler error: in check_probability, at
basic-block.h:956
main ()
^
0xbb3e56 check_probability
../../gcc-trunk/gcc/basic-block.h:956
0xbb1631 check_probability
../../gcc-trunk/gcc/tree-vect-loop-manip.c:653
0xbb1631 combine_probabilities
../../gcc-trunk/gcc/basic-block.h:965
0xbb1631 slpeel_tree_peel_loop_to_edge
../../gcc-trunk/gcc/tree-vect-loop-manip.c:1371
0xbb19a4 vect_do_peeling_for_loop_bound(_loop_vec_info*, tree_node*,
tree_node*, unsigned int, bool)
../../gcc-trunk/gcc/tree-vect-loop-manip.c:1761
0xba2b07 vect_transform_loop(_loop_vec_info*)
../../gcc-trunk/gcc/tree-vect-loop.c:5853
0xbbfae6 vectorize_loops()
../../gcc-trunk/gcc/tree-vectorizer.c:478
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$


--------------------------


struct
{
unsigned int f0;
} a;

int b, c;

int
main ()
{
unsigned int d;
int e[5];

for (; b < 1; b++)
d = 0;
for (; d < 1; d++)
a.f0 = 0;
for (; a.f0 < 1; a.f0++)
;
for (c = 0; c < 5; c++)
e[c] = 1;
if (e[0])
c = 0;

return 0;
}

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |dehao at gcc dot gnu.org,
| |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r210538.

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Jakub Jelinek from comment #3)

Post by jakub at gcc dot gnu.org
Started with r210538.

I am seeing something similar when compiling glibc
with trunk 20141001 with only -O2.

../iconv/skeleton.c: In function ‘gconv’:
../iconv/skeleton.c:792:1: internal compiler error: in check_probability, at
basic-block.h:959
}
^
0x10685aa check_probability
../../src/trunk/gcc/basic-block.h:959
0x10685aa apply_probability
../../src/trunk/gcc/basic-block.h:988
0x10685aa compute_outgoing_frequencies
../../src/trunk/gcc/cfgbuild.c:545
0x10685aa find_many_sub_basic_blocks(simple_bitmap_def*)
../../src/trunk/gcc/cfgbuild.c:636

Code ok with 20140927.

[renlin.li at arm dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

Renlin Li <renlin.li at arm dot com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |renlin.li at arm dot com

--- Comment #5 from Renlin Li <renlin.li at arm dot com> ---
Confirm same problem while compiling glibc using arm toolchain with
-march=armv7-a -O2 configuration.


(In reply to David Binderman from comment #4)

Post by dcb314 at hotmail dot com
(In reply to Jakub Jelinek from comment #3)

Post by jakub at gcc dot gnu.org
Started with r210538.

I am seeing something similar when compiling glibc
with trunk 20141001 with only -O2.
../iconv/skeleton.c:792:1: internal compiler error: in check_probability, at
basic-block.h:959
}
^
0x10685aa check_probability
../../src/trunk/gcc/basic-block.h:959
0x10685aa apply_probability
../../src/trunk/gcc/basic-block.h:988
0x10685aa compute_outgoing_frequencies
../../src/trunk/gcc/cfgbuild.c:545
0x10685aa find_many_sub_basic_blocks(simple_bitmap_def*)
../../src/trunk/gcc/cfgbuild.c:636
Code ok with 20140927.

[renlin.li at arm dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

--- Comment #6 from Renlin Li <renlin.li at arm dot com> ---
emit_case_nodes calls conditional_probability with a very large first argument.

After GCOV_COMPUTE_SCALE calculation, the result overflows into a negative
number.

It's recorded into the cmp_and_jump rtx as a note which is later read and
trigger the assertion.

[ktkachov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

ktkachov at gcc dot gnu.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Keywords| |ice-on-valid-code
Target| |x86_64*, arm*
CC| |ktkachov at gcc dot gnu.org
Known to work| |4.9.2
Known to fail| |5.0

--- Comment #7 from ktkachov at gcc dot gnu.org ---
Filling out some fields

[renlin.li at arm dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61529

--- Comment #8 from Renlin Li <renlin.li at arm dot com> ---
I believe we observed the same behavior, and the first commit to cause the ICE
is r215739.

The newly introduced recompute_probabilities will set the probability back to
REG_BR_PROB_BASE. I will further dig into it.