[Bug c/13379] New: 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[Bug c/13379] New: 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

tree-ssa miscompiles the 2.6.0-test11 Linux kernel.

the kernel to fails very early during bootup. (which shows up as a 'hang'.)

after some debugging and binary searching i narrowed down the problem to
mm/bootmem.c's __alloc_bootmem_core() function. If i split out that function
into a separate module and compile that module with -fno-tree-pre then the
kernel boots and works just fine. Removing the -fno-tree-pre flag from that
module alone causes a boot failure again.

I've attached the .i and .s outputs of bootmem.c, and the cflags. You ought to
be able to compile this file standalone, without having to download the kernel tree.

-- 
           Summary: 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux
                    kernel
           Product: gcc
           Version: tree-ssa
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: mingo at elte dot hu
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug c/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2003-12-10 20:02 -------
Created an attachment (id=5310)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=5310&action=view)
bootmem.c miscompilation

tarball attached.

the precise gcc version used:

Reading specs from /lib/ssa/gcc/i686-redhat-linux/3.5-tree-ssa/specs
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man
--infodir=/usr/share/info --libdir=/lib/ssa --libexecdir=/lib/ssa
--host=i686-redhat-linux --enable-shared --enable-threads=posix
--enable-checking --enable-languages=c,c++,java,objc,f95 --with-system-zlib
--enable-__cxa_atexit --disable-multilib
Thread model: posix
gcc version 3.5-tree-ssa 20031210 (Fedora Core Rawhide 3.5ssa-snapshot)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug c/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-10 20:25 -------
PRE is dberlin's.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |dberlin at gcc dot gnu dot
                   |dot org                     |org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2003-12-10 20:25:08
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-10 20:25 -------
dberlin said this should be in waiting as the problem is most likely an aliasing problem in the code.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |WAITING
          Component|c                           |optimization
           Keywords|                            |wrong-code
   Target Milestone|---                         |tree-ssa


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

Re: [Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[Diego Novillo]

On Wed, 2003-12-10 at 15:26, pinskia at gcc dot gnu dot org wrote:
> ------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-10 20:25 -------
> dberlin said this should be in waiting as the problem is most likely an aliasing problem in the code.
>
Not quite.  The chat on IRC was more along the lines of "I can't see
anything obviously wrong with what's coming out of PRE".  But IRC is
notoriously noisy.


Diego.

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[dnovillo at redhat dot com]

------- Additional Comments From dnovillo at redhat dot com  2003-12-10 20:31 -------
Subject: Re:  3.5-tree-ssa 20031210 miscompiles
	2.6.0-test11 Linux kernel

On Wed, 2003-12-10 at 15:26, pinskia at gcc dot gnu dot org wrote:
> ------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-10 20:25 -------
> dberlin said this should be in waiting as the problem is most likely an aliasing problem in the code.
>
Not quite.  The chat on IRC was more along the lines of "I can't see
anything obviously wrong with what's coming out of PRE".  But IRC is
notoriously noisy.


Diego.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[rth at gcc dot gnu dot org]

------- Additional Comments From rth at gcc dot gnu dot org  2003-12-10 20:31 -------
Note that the linux kernel is compiled with -fno-strict-aliasing.
So the "normal" aliasing bugs should not apply.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2003-12-10 21:22 -------
Diego suggested a few other flags to try. Here's the matrix:

 -fno-tree-ccp:              crash
                                                                               
                                                                               
                       -fno-tree-dce:              crash
                                                                               
                                                                               
                       -fno-tree-dominator-opts:   works!
                                                                               
                                                                               
                       -fno-tree-must-alias:       crash
                                                                               
                                                                               
                       -fno-tree-sra:              crash
                                                                               
           
ie. tree-dominator-opts seems to have a problem. (the flags were tried in
isolation.)


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[dnovillo at gcc dot gnu dot org]

------- Additional Comments From dnovillo at gcc dot gnu dot org  2003-12-10 21:33 -------
I have a DOM change that may be related to this.  I'll take it for now.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|dberlin at gcc dot gnu dot  |dnovillo at gcc dot gnu dot
                   |org                         |org
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[dnovillo at gcc dot gnu dot org]

------- Additional Comments From dnovillo at gcc dot gnu dot org  2003-12-10 23:03 -------

Could you try one more flag?  It's very unlikely that this will work (there are
no loop optimizations yet), but it does affect the CFG .

Try -fno-tree-loop-optimize.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[dberlin at gcc dot gnu dot org]

------- Additional Comments From dberlin at gcc dot gnu dot org  2003-12-11 01:19 -------
Diego, i could add a -ftree-split-critical-edges  if you think it might help (splitting critical edges 
exposes more to the dom opts in the way of redunancies and jump threading), so that you can try 
-fno-tree-pre -fsplit-critical-edges

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2003-12-11 18:34 -------
Tried -fno-tree-loop-optimize, kernel still crashes.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[dnovillo at redhat dot com]

------- Additional Comments From dnovillo at redhat dot com  2003-12-11 18:39 -------
Subject: Re:  3.5-tree-ssa 20031210 miscompiles
	2.6.0-test11 Linux kernel

On Thu, 2003-12-11 at 13:34, mingo at elte dot hu wrote:
> ------- Additional Comments From mingo at elte dot hu  2003-12-11 18:34 -------
> Tried -fno-tree-loop-optimize, kernel still crashes.
> 
OK, I would've been very surprised if it made any difference.

Dan, want to try your edge splitting suggestion?


Diego.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] 3.5-tree-ssa 20031210 miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2003-12-12 12:36 -------
FYI, tried the 20031211 snapshot, kernel still fails. (kernel still works fine
with bootmem.c compiled specially, so there are no new regressions.)

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-01-30 11:30 -------
has anyone tried this recently? the last message in the audit trail is one and 
a half month old, which is a very long time for tree-ssa... 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2004-01-30 15:05 -------
Same problem still with the latest snapshot:

gcc version 3.5-tree-ssa 20040130 (Fedora Core Rawhide 3.5ssa-snapshot)

Linus' current tree hangs early during bootup due to miscompilation of
mm/bootmem.c. Adding -fno-tree-dominator-opts to bootmem.o's CFLAGS (and only to
that object) fixes the problem and the kernel boots in all the way and we've got
a working system.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2004-01-30 15:19 -------
for details please see the attached files i just posted.

i happen to be the author of most of the code in bootmem.c - it really does
nothing weird or unexpected. It just uses a big flat bitmap to do
page-granularity allocation at boot-time - with some additional
track-last-partially-allocated-page code to not waste too much RAM on small,
continuous allocations. (it also has multiple flat bitmaps when there are NUMA
nodes, but that code is essentially turned off on x86, where the failure
happens. On x86 we have only a single node, and thus a single bootmem bitmap.)

The hang is caused by an assert triggering in the last few lines of
__alloc_bootmem_core() [provably this is the only miscompiled function in this
module], the last BUG() hits [the bitmap has already been set] - which most
likely indicates that the bitmap arithmetics are off somewhere.

this code never triggered compiler problems before.

it is near 100% sure that the miscompilation is in __alloc_bootmem_core() itself
- the assert can only be caused by incorrect code in that function, it does not
assume anything about the bitmap or other external state.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[rth at gcc dot gnu dot org]

------- Additional Comments From rth at gcc dot gnu dot org  2004-02-03 01:52 -------
Looking at it.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|dnovillo at gcc dot gnu dot |rth at gcc dot gnu dot org
                   |org                         |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[rth at gcc dot gnu dot org]

------- Additional Comments From rth at gcc dot gnu dot org  2004-02-03 03:15 -------
I'm having trouble seeing what's getting miscompiled here.  Any chance
you could provide a dummy main() that sets up proper input to show the
BUG being triggered?

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |WAITING


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2004-02-03 09:10 -------
it's the last BUG() in the function (line 247) that triggers. Ie. the bit in the
bitmap has been set already.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-02-29 13:38 -------
Could this have been a duplicate of Bug 14272?  I don't see any comments about 
testing with -fno-tree-ter... 
 
If this is the same problem then it should be fixed now.  Testing 
-fno-tree-ter seems like a good idea either way. 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2004-03-01 07:22 -------
i tried -fno-tree-ter, and it does not work around the bug - so this seems to be
a separate thing.

so we still cannot compile the 2.6 kernel with tree-ssa.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2004-03-01 07:34 -------
ok, did some debugging. The first time the function is called, it breaks.

it's the final loop (that does the test_and_set_bit()) that is broken. It gets
'areasize' of 1 and 'start' of 2, but still it loops indefinitely until it hits
a bit 1 in the bitmap and triggers the assert.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2004-03-01 07:37 -------
i've printk'd 'start+areasize' and it grows together with 'i' - which is clearly
buggy. Ie. 'start' somehow gets aliased to 'i'.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-03-01 07:58 -------
<L39>:;
  j = i.1144 + 1;
  pretmp.1152 = i.1144 + areasize;
  if (pretmp.1152 > j) goto <L40>; else goto found;

Wow, it does, I do not know if this is a PRE bug though or something else.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[dnovillo at gcc dot gnu dot org]

------- Additional Comments From dnovillo at gcc dot gnu dot org  2004-03-01 18:23 -------

I just tried with today's snapshot and I don't seem to be able to reproduce the bug:

$ gcc/xgcc -Bgcc -O2 main.c -o main
$ ./13379
__alloc_bootmem_core(0xbfffe450, 00001000, 00001000, 00000000)
bm2, found: 0.
0/1
reserve 1 bits, starting at 0.
0/1: 0
 => (nil).

Is that the expected output?  I get the same output with the system's compiler.


Diego.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[dnovillo at redhat dot com]

------- Additional Comments From dnovillo at redhat dot com  2004-03-01 18:25 -------
Subject: Re:  [tree-ssa] miscompiles 2.6.0-test11
	Linux kernel

On Mon, 2004-03-01 at 13:23, dnovillo at gcc dot gnu dot org wrote:
> ------- Additional Comments From dnovillo at gcc dot gnu dot org  2004-03-01 18:23 -------
> 
> I just tried with today's snapshot and I don't seem to be able to reproduce the bug:
> 
> $ gcc/xgcc -Bgcc -O2 main.c -o main
> $ ./13379
>
s/13379/main/


Diego.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-03-01 18:31 -------
I tried this and still can't reproduce it with the standalone testcase.  
  
GNU C version 3.5-tree-ssa 20040301 (merged 20040211) (i686-pc-linux-gnu)  
        compiled by GNU C version 3.5-tree-ssa 20040301 (merged 20040211).  
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096  
  
Output is the same at -O0, -O1, -O2, and -O3:  
---------------------------------------------------------------  
__alloc_bootmem_core(0xbffff250, 00001000, 00001000, 00000000)  
bm2, found: 0.  
0/1  
reserve 1 bits, starting at 0.  
0/1: 0  
 => (nil).  
---------------------------------------------------------------  
  
The program always exits with code 0.  
  
I'll take a look at the original test case.  
  

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[mingo at elte dot hu]

------- Additional Comments From mingo at elte dot hu  2004-03-02 01:12 -------

tried the 20040301 tree-ssa snapshot and indeed the 2.6.3 bootmem.c does not
crash anymore!

the previous one i tried was 20040130 (~1 month old). So it must have been
solved by one of the fixes in the past 30 days.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379

[Bug optimization/13379] [tree-ssa] miscompiles 2.6.0-test11 Linux kernel

[dnovillo at redhat dot com]

------- Additional Comments From dnovillo at redhat dot com  2004-03-02 02:20 -------
Subject: Re:  [tree-ssa] miscompiles 2.6.0-test11
	Linux kernel

On Mon, 2004-03-01 at 20:12, mingo at elte dot hu wrote:

> tried the 20040301 tree-ssa snapshot and indeed the 2.6.3 bootmem.c does not
> crash anymore!
> 
> the previous one i tried was 20040130 (~1 month old). So it must have been
> solved by one of the fixes in the past 30 days.
>
Excellent.  Thanks Ingo.

Now that I look at the test cases again, I wonder if this wasn't fixed
by Andrew's volatile fixes.  We were recombining expressions with
volatile variables that were wreaking havoc in other targets.


Diego.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13379