[Bug rtl-optimization/55158] New: ICE: [4.8 Regreesion] [IA64] segv in schedule_region

[gary at intrepid dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

             Bug #: 55158
           Summary: ICE: [4.8 Regreesion] [IA64] segv in schedule_region
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassig...@gcc.gnu.org
        ReportedBy: g...@intrepid.com


Created attachment 28587
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28587
Test case: gcc segv when compiled at -O3 on IA64

See attached test case.

$ bld/gcc/cc1 -O3 gcc-ice-schedule-region.c -o gcc-ice-schedule-region.o
 gasneti_check_node_list
Analyzing compilation unit
Performing interprocedural optimizations
 <*free_lang_data> <visibility> <early_local_cleanups> <*free_inline_summary>
<whole-program> <profile_estimate> <cp> <inline> <pure-const>
<static-var>Assembling functions:
 gasneti_check_node_list
gcc-ice-schedule-region.c: In function ‘gasneti_check_node_list’:
gcc-ice-schedule-region.c:53:1: internal compiler error: Segmentation fault
 }
 ^
0x4000000000b7b22f crash_signal
        src/gcc/toplev.c:333
0x4000000000ac2aaf schedule_region
        src/gcc/sched-rgn.c:2998
0x4000000000ac2aaf schedule_insns()
        src/gcc/sched-rgn.c:3343

Here is the schedule_region source at that location.

2993              f = find_fallthru_edge (last_bb->succs);
2994              if (f && f->probability * 100 / REG_BR_PROB_BASE >=
2995                  PARAM_VALUE (PARAM_SCHED_STATE_EDGE_PROB_CUTOFF))
2996                {
2997                  memcpy (bb_state[f->dest->index], curr_state,
2998                          dfa_state_size);
2999                  if (sched_verbose >= 5)
3000                    fprintf (sched_dump, "saving state for edge %d->%d\n",
3001                             f->src->index, f->dest->index);
3002                }

Here is the value of f->dest->index at the pointed and the value of the
selected element of bb_state.

(gdb) p f->dest->index
$1 = 23
(gdb) p bb_state[23]
$2 = (state_t) 0x431

Clearly not a valid address.

(gdb) p bb_state[22]
$3 = (state_t) 0x60000000002f3d58

While the element before it looks OK.

This issue seemed to be introduced by this check in.

2012-10-08  Bernd Schmidt  <ber...@codesourcery.com>

        * sched-int.h (schedule_block): Adjust declaration.
        * sched-rgn.c (bb_state_array, bb_state): New static variables.
        (sched_rgn_init): Initialize them.
        (sched_rgn_free): Free them.
        (schedule_region): Save scheduling state for future blocks, and

which is svn revision 192203.