re PR middle-end/78548 (ICE on valid C code on x86_64-linux-gnu at -O2 and -O3 in 64-bit mode with -Wall (*** Error in `/usr/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/7.0.0/cc1': double free or corruption (fasttop): 0x0000000003c15810 ***))

	PR middle-end/78548
	* tree-ssa-uninit.c (simplify_preds_4): Call release() instead of
	destroy_predicate_vecs.
	(uninit_uses_cannot_happen): Make uninit_preds a scalar.

From-SVN: r243289

3 files changed, 50 insertions, 14 deletions

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 8141125..3c842b6 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,5 +1,12 @@
 2016-12-06  Aldy Hernandez  <aldyh@redhat.com>
 
+	PR middle-end/78548
+	* tree-ssa-uninit.c (simplify_preds_4): Call release() instead of
+	destroy_predicate_vecs.
+	(uninit_uses_cannot_happen): Make uninit_preds a scalar.
+
+2016-12-06  Aldy Hernandez  <aldyh@redhat.com>
+
 	PR middle-end/78566
 	* tree-ssa-uninit.c (can_one_predicate_be_invalidated_p): Change
 	argument type to a pred_chain.
diff --git a/gcc/testsuite/gcc.dg/uninit-pr78548.c b/gcc/testsuite/gcc.dg/uninit-pr78548.c
new file mode 100644
index 0000000..12e06dd
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/uninit-pr78548.c
@@ -0,0 +1,24 @@
+/* { dg-do compile } */
+/* { dg-options "-Wall -w -O2" } */
+
+char a;
+int b;
+unsigned c, d;
+short e;
+int main_f;
+int main (  ) {
+L0:
+    if ( e )     goto L1;
+    b = c & d || a;
+    if ( !c )     printf ( "", ( long long ) main_f );
+    if ( d || !c )     {
+        printf ( "%llu\n", ( long long ) main );
+        goto L2;
+    }
+    unsigned g = b;
+L1:
+    b = g;
+L2:
+    if ( b )     goto L0;
+  return 0;
+}
diff --git a/gcc/tree-ssa-uninit.c b/gcc/tree-ssa-uninit.c
index a648995..b4892c7 100644
--- a/gcc/tree-ssa-uninit.c
+++ b/gcc/tree-ssa-uninit.c
@@ -1774,7 +1774,7 @@ simplify_preds_4 (pred_chain_union *preds)
 	  s_preds.safe_push ((*preds)[i]);
 	}
 
-      destroy_predicate_vecs (preds);
+      preds->release ();
       (*preds) = s_preds;
       s_preds = vNULL;
     }
@@ -2211,10 +2211,9 @@ uninit_uses_cannot_happen (gphi *phi, unsigned uninit_opnds,
 
   /* Look for the control dependencies of all the uninitialized
      operands and build guard predicates describing them.  */
-  unsigned i;
-  pred_chain_union uninit_preds[max_phi_args];
-  memset (uninit_preds, 0, sizeof (pred_chain_union) * phi_args);
-  for (i = 0; i < phi_args; ++i)
+  pred_chain_union uninit_preds;
+  bool ret = true;
+  for (unsigned i = 0; i < phi_args; ++i)
     {
       if (!MASK_TEST_BIT (uninit_opnds, i))
 	continue;
@@ -2226,26 +2225,32 @@ uninit_uses_cannot_happen (gphi *phi, unsigned uninit_opnds,
       int num_calls = 0;
 
       /* Build the control dependency chain for uninit operand `i'...  */
+      uninit_preds = vNULL;
       if (!compute_control_dep_chain (find_dom (e->src),
 				      e->src, dep_chains, &num_chains,
 				      &cur_chain, &num_calls))
-	return false;
+	{
+	  ret = false;
+	  break;
+	}
       /* ...and convert it into a set of predicates.  */
       convert_control_dep_chain_into_preds (dep_chains, num_chains,
-					    &uninit_preds[i]);
+					    &uninit_preds);
       for (size_t j = 0; j < num_chains; ++j)
 	dep_chains[j].release ();
-      simplify_preds (&uninit_preds[i], NULL, false);
-      uninit_preds[i]
-	= normalize_preds (uninit_preds[i], NULL, false);
+      simplify_preds (&uninit_preds, NULL, false);
+      uninit_preds = normalize_preds (uninit_preds, NULL, false);
 
       /* Can the guard for this uninitialized operand be invalidated
 	 by the PHI use?  */
-      if (!can_chain_union_be_invalidated_p (uninit_preds[i],
-					     phi_use_guards[0]))
-	return false;
+      if (!can_chain_union_be_invalidated_p (uninit_preds, phi_use_guards[0]))
+	{
+	  ret = false;
+	  break;
+	}
     }
-  return true;
+  destroy_predicate_vecs (&uninit_preds);
+  return ret;
 }
 
 /* Computes the predicates that guard the use and checks