[Bug c++/23651] New: ICE in GC

[Bug c++/23651] New: ICE in GC

[snyder at fnal dot gov]

>Release:       gcc (GCC) 4.1.0 20050831 (experimental)
>Environment:
System: Linux karma 2.6.12.1sss #2 Thu Jul 7 00:28:21 EDT 2005 i686 i686 i386
GNU/Linux
Architecture: i686

        <machine, os, target, libraries (multiple lines)>
host: i686-pc-linux-gnu
build: i686-pc-linux-gnu
target: i686-pc-linux-gnu
configured with: /home/sss/gcc/gcc/configure --prefix=/usr/local/gcc
--enable-threads=posix --enable-long-long --enable-languages=c,c++,f95

On the attached source, g++ dies with an ICE in garbage collection
when it is compiled as follows:

$ g++ -c -O3 -fPIC -g  y.cc
y.cc: In function 'int foo()':
y.cc:14681: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.
$

Here's where it's crashing:

Program received signal SIGSEGV, Segmentation fault.
0x08505e77 in gt_ggc_mx_basic_block_def (x_p=0xb7384960) at gtype-desc.c:445
445           gt_ggc_m_9tree_node ((*x).stmt_list);
#0  0x08505e77 in gt_ggc_mx_basic_block_def (x_p=0xb7384960)
    at gtype-desc.c:445
#1  0x08508634 in gt_ggc_mx_rtx_def (x_p=0xb7350258) at gtype-desc.c:1369
#2  0x08508434 in gt_ggc_mx_rtx_def (x_p=0xb722ee7c) at gtype-desc.c:1341
#3  0x085064b8 in gt_ggc_mx_function (x_p=0xb74a9400) at gtype-desc.c:624
#4  0x081d8774 in gt_ggc_mx_lang_tree_node (x_p=0xb7564a50)
    at ./gt-cp-tree.h:320
#5  0x0820d235 in gt_ggc_mx_cp_binding_level (x_p=0xb7e01190)
    at ./gt-cp-name-lookup.h:65
#6  0x0820d3f4 in gt_ggc_mx_cxx_binding (x_p=0xb7df87c8)
    at ./gt-cp-name-lookup.h:91
#7  0x081d940e in gt_ggc_mx_lang_tree_node (x_p=0xb7e09ed4)
    at ./gt-cp-tree.h:521
#8  0x081d8451 in gt_ggc_mx_lang_tree_node (x_p=0xb7e11270)
    at ./gt-cp-tree.h:285
#9  0x081d88c4 in gt_ggc_mx_lang_tree_node (x_p=0xb7e0a2e0)
    at ./gt-cp-tree.h:344
#10 0x081d8a22 in gt_ggc_mx_lang_tree_node (x_p=0xb7e0b000)
    at ./gt-cp-tree.h:362
#11 0x081d87d7 in gt_ggc_mx_lang_tree_node (x_p=0xb7e0a000)
    at ./gt-cp-tree.h:326
#12 0x081d744a in gt_ggc_mx_lang_tree_node (x_p=0xb7df8540)
    at ./gt-cp-tree.h:85
...

Apologies for the large size of the test case, but i've already spent
a huge amount of time reducing it.  Almost any perturbation in either
the test case or the compiler is likely to make the crash go away.

To further pinpoint the version of the compiler i'm using,
here are the most recent entries in gcc/ChangeLog and gcc/cp/ChangeLog
that i have checked out:

2005-08-30  Richard Henderson  <rth@redhat.com>

	PR target/23630
	* expr.c (expand_expr_real_1) <VIEW_CONVERT_EXPR>: Use gen_lowpart
	whenever the mode sizes match.


2005-08-30  Volker Reichelt  <reichelt@igpm.rwth-aachen.de>

	PR c++/23586
	* parser.c (cp_parser_namespace_name): Move diagnostic for
	invalid namespace-name to here from ...
	* name-lookup.c (do_namespace_alias): ... here and ...
	(do_using_directive): ... here.  Remove dead code.

-- 
           Summary: ICE in GC
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: snyder at fnal dot gov
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug c++/23651] ICE in GC

[snyder at fnal dot gov]

------- Additional Comments From snyder at fnal dot gov  2005-08-31 09:44 -------
Created an attachment (id=9630)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=9630&action=view)
test case


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug c++/23651] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-31 12:00 -------
Reducing using --param ggc-min-expand=0 ggc-min-heapsize=0.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug c++/23651] ICE in GC

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |GC, ice-on-valid-code


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-31 13:28 -------
Confirmed, reduced testcase:
namespace std
{
  struct allocator
  {
    ~allocator() throw(){}
  };
  struct string    
  {
    struct _Alloc_hider : allocator {};
    _Alloc_hider _M_dataplus;
    string();
    string(const char* __s, const allocator& __a = allocator());
  };
}
struct Strptrmap
{
  bool insert (const std::string& key, unsigned val){}
};
struct Indptr_Base
{
  virtual ~Indptr_Base ();
  void decref ();
  unsigned short _refcount;
};
inline void Indptr_Base::decref ()
{
  if (_refcount == 2)
    delete this;
  else
    _refcount -= 2;
}
struct d0_Ref_Base
{
  ~d0_Ref_Base ();
  bool is_null() const;
  void* ptr1 () const;
  mutable const void* _ptr;
  Indptr_Base* _indptr;
  Strptrmap* operator->() const;
};
inline d0_Ref_Base::~d0_Ref_Base ()
{
  if (_indptr)
    _indptr->decref ();
}
inline bool d0_Ref_Base::is_null () const
{
  return (_ptr == 0 && _indptr == 0);
}
inline Strptrmap* d0_Ref_Base::operator->() const
{
  if (is_null())     return 0;
  return reinterpret_cast<Strptrmap*> (ptr1 ());
}
int foo ()
{
  std::string fname;
  d0_Ref_Base hm1;
  for (int i = 0; i < 10;  i++)
    hm1->insert ("", 0);
  hm1->insert ("", 0);
  return 0;
}

---
It worked with 20050823.  Note my reduced testcase is from powerpc-darwin.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|c++                         |middle-end
     Ever Confirmed|                            |1
  GCC build triplet|i686-pc-linux-gnu           |
   GCC host triplet|i686-pc-linux-gnu           |
 GCC target triplet|i686-pc-linux-gnu           |
   Last reconfirmed|0000-00-00 00:00:00         |2005-08-31 13:28:51
               date|                            |
            Summary|ICE in GC                   |[4.1 Regression] ICE in GC
   Target Milestone|---                         |4.1.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |critical


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-09-16 19:59 -------
Rereducing on the mainline for x86_64-pc-linux with -m32.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug c++/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-09-16 22:58 -------
lets look at the backtrace:
gt_ggc_mx_cp_binding_level
gt_ggc_mx_cxx_binding

Why are there are references to C++ front-end stuff.  This is a front-end bug make us still reference a 
BasicBlock.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|middle-end                  |c++


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Comment #12 from pinskia at gcc dot gnu dot org  2005-10-06 22:14 -------
Fixed.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[cvs-commit at gcc dot gnu dot org]

------- Comment #11 from cvs-commit at gcc dot gnu dot org  2005-10-06 22:14 -------
Subject: Bug 23651

CVSROOT:        /cvs/gcc
Module name:    gcc
Changes by:     pinskia@gcc.gnu.org     2005-10-06 22:14:37

Modified files:
        gcc            : ChangeLog cfgexpand.c 

Log message:
        2005-10-06  Andrew Pinski  <pinskia@physics.uc.edu>

        PR middle-end/22216
        PR middle-end/23651
        * cfgexpand.c (tree_expand_cfg): After expanding the functions, clear
        out return_label and naked_return_label.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&r1=2.10110&r2=2.10111
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cfgexpand.c.diff?cvsroot=gcc&r1=2.50&r2=2.51


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Comment #10 from pinskia at gcc dot gnu dot org  2005-10-06 15:06 -------
Patch posted:
http://gcc.gnu.org/ml/gcc-patches/2005-10/msg00280.html


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |http://gcc.gnu.org/ml/gcc-
                   |                            |patches/2005-
                   |                            |10/msg00280.html
           Keywords|                            |patch


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Comment #9 from pinskia at gcc dot gnu dot org  2005-10-06 01:28 -------
(In reply to comment #6)
> I can reproduce this reliably for powerpc64-linux with -m64 using the testcase
> in comment #3; using -m32 the results are intermittent.
> 
> A regression hunt identified the following patch from hubicka@gcc.gnu.org:

Hmm, looks like that patch just exposed a latent bug as proved by my patch, I
would be it could be reproduced before his patch, just a bit harder as his
patch caused BB to be smaller which got it put in a different page.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651

[Bug middle-end/23651] [4.1 Regression] ICE in GC

[pinskia at gcc dot gnu dot org]

------- Comment #8 from pinskia at gcc dot gnu dot org  2005-10-06 01:21 -------
I have a fix for this bug, return_label and naked_return_label don't need to be
set after expand.  Hmm, maybe we could move them to global memory and not use
up 8-16 bytes in function.c since we never expand more than function at a time
now.
The simple patch is the following:
Index: cfgexpand.c
===================================================================
RCS file: /cvs/gcc/gcc/gcc/cfgexpand.c,v
retrieving revision 2.50
diff -u -p -r2.50 cfgexpand.c
--- cfgexpand.c 6 Aug 2005 13:25:56 -0000       2.50
+++ cfgexpand.c 6 Oct 2005 01:18:05 -0000
@@ -1578,6 +1578,8 @@ tree_expand_cfg (void)
     (*debug_hooks->outlining_inline_function) (current_function_decl);

   TREE_ASM_WRITTEN (current_function_decl) = 1;
+  return_label = NULL;
+  naked_return_label = NULL;
 }

 struct tree_opt_pass pass_expand =


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |pinskia at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED
          Component|c++                         |middle-end


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23651