[Bug tree-optimization/26570] New: -fprofile-generate -fprofile-use cause memory corruption immediately

[Bug tree-optimization/26570] New: -fprofile-generate -fprofile-use cause memory corruption immediately

[ahu at ds9a dot nl]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2418 bytes --]

This is reported: 

recursor_cache.hh:58: warning: comparison between signed and unsigned integer
expressions
syncres.cc: In function â(static destructors for syncres.cc)â:
syncres.cc:649: note: file syncres.gcda not found, execution counts estimated
*** glibc detected *** corrupted double-linked list: 0xa7fba938 ***

When compiling only with -fprofile-generate, no errors get emitted. When adding
-fprofile-use later on when the program has been run once, the following
happens:
if g++ -DHAVE_CONFIG_H -I. -I. -I..  -Ibackends/bind -pthread 
-DSYSCONFDIR=\"/usr/local/etc\" -DLIBDIR=\"/usr/local/lib\"
-DLOCALSTATEDIR=\"/var/run\" -Ibackends/bind  -D_GNU_SOURCE  -Wall -O2
-fprofile-generate  -fprofile-use -MT syncres.o -MD -MP -MF ".deps/syncres.Tpo"
-c -o syncres.o syncres.cc; \
then mv -f ".deps/syncres.Tpo" ".deps/syncres.Po"; else rm -f
".deps/syncres.Tpo"; exit 1; fi
recursor_cache.hh: In member function âbool
MemRecursorCache::predicate::operator()(const MemRecursorCache::StoredRecord&)
constâ:
recursor_cache.hh:58: warning: comparison between signed and unsigned integer
expressions
*** glibc detected *** corrupted double-linked list: 0xa7f55938 ***
syncres.cc: In function â_EuclideanRingElement
std::__gcd(_EuclideanRingElement, _EuclideanRingElement) [with
_EuclideanRingElement = int]â:
syncres.cc:649: internal compiler error: Aborted
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.
make: *** [syncres.o] Error 1

To repeat, check out the latest revision of PowerDNS as described on
http://wiki.powerdns.com, run ./configure, cd pdns, edit CXXFLAGS in Makefile
so it includes -fprofile-generate and/or -fprofile-use, then run 'make
pdns_recursor'. Error should appear immediately.

Confirmed on Ubuntu Breezy, FreeBSD 6.0, Debian Sid crosscompiling to x86_64.


-- 
           Summary: -fprofile-generate -fprofile-use cause memory corruption
                    immediately
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: ahu at ds9a dot nl
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug tree-optimization/26570] -fprofile-generate -fprofile-use cause memory corruption immediately

[nmiell at comcast dot net]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1314 bytes --]



------- Comment #1 from nmiell at comcast dot net  2006-03-05 23:31 -------
On FC4 AMD64, compiling:

#include <algorithm>

void rotate(int x[3])
{ 
        std::rotate(&x[0], &x[1], &x[2]);
}

int main(int argc, char* argv[])
{
        int x[3] = { 0, 1, 2 };

        rotate(x);

        return 0;
}

with: g++ -O2 -fprofile-use rotate.cpp -o rotate
using: g++ (GCC) 4.0.2 20051125 (Red Hat 4.0.2-8)
results in:
/usr/lib/gcc/x86_64-redhat-linux/4.0.2/../../../../include/c++/4.0.2/bits/stl_algo.h:
In function ‘_EuclideanRingElement std::__gcd(_EuclideanRingElement,
_EuclideanRingElement) [with _EuclideanRingElement = long int]’:
/usr/lib/gcc/x86_64-redhat-linux/4.0.2/../../../../include/c++/4.0.2/bits/stl_algo.h:1523:
internal compiler error: Floating point exception
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://bugzilla.redhat.com/bugzilla> for instructions.
Preprocessed source stored into /tmp/cctkWvyt.out file, please attach this to
your bugreport.


-- 

nmiell at comcast dot net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nmiell at comcast dot net


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] -fprofile-generate -fprofile-use cause memory corruption immediately

[pinskia at gcc dot gnu dot org]

------- Comment #2 from pinskia at gcc dot gnu dot org  2006-03-05 23:39 -------
(In reply to comment #1)
> On FC4 AMD64, compiling:

This is a different issue for sure as the ICE is in
rtl_value_profile_transformations which does not exist in 4.1.0.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] -fprofile-generate -fprofile-use cause memory corruption immediately

[ahu at ds9a dot nl]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1684 bytes --]



------- Comment #3 from ahu at ds9a dot nl  2006-03-05 23:42 -------
Thanks Nicholas,

I can run the command you suggest without errors (I saved the file as
exploit.cc). However, if I compile first with -fprofile-generate, then run it
once, and then add -fprofile-use, it reports:
$ g++ -O2 -fprofile-use -fprofile-generate exploit.cc -o exploit
*** glibc detected *** double free or corruption (fasttop): 0x085c7e78 ***
exploit.cc: In function â_ForwardIterator2 std::swap_ranges(_ForwardIterator1,
_ForwardIterator1, _ForwardIterator2) [with _ForwardIterator1 = int*,
_ForwardIterator2 = int*]â:
exploit.cc:14: internal compiler error: Aborted
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.

This w/o any profiling information present:
ahu@intel:~/work/pdns/pdns/pdns$ rm exploit.gc*
ahu@intel:~/work/pdns/pdns/pdns$ g++ -O2 -fprofile-use -fprofile-generate
exploit.cc -o exploit
exploit.cc: In function âvoid std::iter_swap(_ForwardIterator1,
_ForwardIterator2) [with _ForwardIterator1 = int*, _ForwardIterator2 = int*]â:
exploit.cc:14: note: file exploit.gcda not found, execution counts estimated
*** glibc detected *** double free or corruption (fasttop): 0x085f2438 ***
exploit.cc: In function â_ForwardIterator2 std::swap_ranges(_ForwardIterator1,
_ForwardIterator1, _ForwardIterator2) [with _ForwardIterator1 = int*,
_ForwardIterator2 = int*]â:
exploit.cc:14: internal compiler error: Aborted
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] -fprofile-generate -fprofile-use cause memory corruption immediately

[pinskia at gcc dot gnu dot org]

------- Comment #4 from pinskia at gcc dot gnu dot org  2006-03-05 23:53 -------
Ok, compiling comment #1 with -O2 -fprofile-generate -fprofile-use, I do get
the failures.
Here is the valgrid report:
==5355== Invalid free() / delete / delete[]
==5355==    at 0x11B1DA33: free (vg_replace_malloc.c:235)
==5355==    by 0x6E915D: value_profile_transformations (value-prof.h:65)
==5355==    by 0x74E3CB: tree_profiling (tree-profile.c:250)
==5355==    by 0x74CD55: execute_one_pass (passes.c:827)
==5355==    by 0x74CE4B: execute_pass_list (passes.c:859)
==5355==    by 0x74CED5: execute_ipa_pass_list (passes.c:881)
==5355==    by 0x787409: cgraph_optimize (cgraphunit.c:1223)
==5355==    by 0x43F3AE: cp_finish_file (decl2.c:3115)
==5355==    by 0x4AD1B9: c_common_parse_file (c-opts.c:1144)
==5355==    by 0x7303C7: toplev_main (toplev.c:991)
==5355==    by 0x11C4F47A: __libc_start_main (in /lib/libc-2.3.5.so)
==5355==    by 0x402659: ??? (start.S:113)
==5355==  Address 0x11FFA378 is 0 bytes inside a block of size 40 free'd
==5355==    at 0x11B1DA33: free (vg_replace_malloc.c:235)
==5355==    by 0x6E8D2A: branch_prob (value-prof.h:65)
==5355==    by 0x74E3A8: tree_profiling (tree-profile.c:246)
==5355==    by 0x74CD55: execute_one_pass (passes.c:827)
==5355==    by 0x74CE4B: execute_pass_list (passes.c:859)
==5355==    by 0x74CED5: execute_ipa_pass_list (passes.c:881)
==5355==    by 0x787409: cgraph_optimize (cgraphunit.c:1223)
==5355==    by 0x43F3AE: cp_finish_file (decl2.c:3115)
==5355==    by 0x4AD1B9: c_common_parse_file (c-opts.c:1144)
==5355==    by 0x7303C7: toplev_main (toplev.c:991)
==5355==    by 0x11C4F47A: __libc_start_main (in /lib/libc-2.3.5.so)
==5355==    by 0x402659: ??? (start.S:113)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] -fprofile-generate -fprofile-use cause memory corruption immediately

[pinskia at gcc dot gnu dot org]

------- Comment #5 from pinskia at gcc dot gnu dot org  2006-03-05 23:56 -------
It does not ICE on the mainline but valgrind is still unhappy:
==5383== Invalid free() / delete / delete[]
==5383==    at 0x11B1DA33: free (vg_replace_malloc.c:235)
==5383==    by 0x80680D: value_profile_transformations (value-prof.h:65)
==5383==    by 0x888F5B: tree_profiling (tree-profile.c:244)
==5383==    by 0x88764A: execute_one_pass (passes.c:862)
==5383==    by 0x8877BB: execute_pass_list (passes.c:909)
==5383==    by 0x887840: execute_ipa_pass_list (passes.c:931)
==5383==    by 0x8D8023: cgraph_optimize (cgraphunit.c:1372)
==5383==    by 0x47DFE9: cp_finish_file (decl2.c:3110)
==5383==    by 0x52A9B9: c_common_parse_file (c-opts.c:1165)
==5383==    by 0x858E4D: toplev_main (toplev.c:999)
==5383==    by 0x11C4F47A: __libc_start_main (in /lib/libc-2.3.5.so)
==5383==    by 0x402769: ??? (start.S:113)
==5383==  Address 0x12050238 is 0 bytes inside a block of size 40 free'd
==5383==    at 0x11B1DA33: free (vg_replace_malloc.c:235)
==5383==    by 0x80669A: branch_prob (value-prof.h:65)
==5383==    by 0x888F38: tree_profiling (tree-profile.c:240)
==5383==    by 0x88764A: execute_one_pass (passes.c:862)
==5383==    by 0x8877BB: execute_pass_list (passes.c:909)
==5383==    by 0x887840: execute_ipa_pass_list (passes.c:931)
==5383==    by 0x8D8023: cgraph_optimize (cgraphunit.c:1372)
==5383==    by 0x47DFE9: cp_finish_file (decl2.c:3110)
==5383==    by 0x52A9B9: c_common_parse_file (c-opts.c:1165)
==5383==    by 0x858E4D: toplev_main (toplev.c:999)
==5383==    by 0x11C4F47A: __libc_start_main (in /lib/libc-2.3.5.so)
==5383==    by 0x402769: ??? (start.S:113)


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu dot
                   |                            |org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[pinskia at gcc dot gnu dot org]

-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu dot
                   |                            |org
           Keywords|                            |ice-on-valid-code
            Summary|-fprofile-generate -        |[4.1/4.2 Regression] -
                   |fprofile-use cause memory   |fprofile-generate -fprofile-
                   |corruption immediately      |use cause memory corruption
                   |                            |immediately
   Target Milestone|---                         |4.1.1


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[pinskia at gcc dot gnu dot org]

------- Comment #6 from pinskia at gcc dot gnu dot org  2006-03-06 00:04 -------
Confirmed.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2006-03-06 00:04:47
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[ahu at ds9a dot nl]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 913 bytes --]



------- Comment #7 from ahu at ds9a dot nl  2006-03-06 00:10 -------
The crasher bugs go away from release 4.1.0 when never running with
-fprofile-use and -fprofile-generate simultaneously. 

There is another 'checksum mismatch' issue with PowerDNS:
base64.cc: In function âchar<unnamed>::B64Encode1(unsigned char)â:
base64.cc:220: error: coverage mismatch for function
â_ZN38_GLOBAL__N_base64.cc_00000000_B36B9A3210B64Encode1Ehâ while reading
counter âarcsâ
base64.cc:220: error: checksum is 913e4cf0 instead of e0c8a426
base64.cc: In function âchar<unnamed>::B64Decode1(char)â:
base64.cc:220: error: coverage mismatch for function
â_ZN38_GLOBAL__N_base64.cc_00000000_B36B9A3210B64Decode1Ecâ while reading
counter âarcsâ
base64.cc:220: error: checksum is 93e2f130 instead of e21419e6

These go away when I delete the relevant .gc* files. 


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[mmitchel at gcc dot gnu dot org]

-- 

mmitchel at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[mmitchel at gcc dot gnu dot org]

------- Comment #8 from mmitchel at gcc dot gnu dot org  2006-05-25 02:34 -------
Will not be fixed in 4.1.1; adjust target milestone to 4.1.2.


-- 

mmitchel at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.1.1                       |4.1.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[hubicka at gcc dot gnu dot org]

-- 

hubicka at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |rakdver at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[rakdver at gcc dot gnu dot org]

------- Comment #9 from rakdver at gcc dot gnu dot org  2006-08-12 08:20 -------
Patch: http://gcc.gnu.org/ml/gcc-patches/2006-08/msg00386.html


-- 

rakdver at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |http://gcc.gnu.org/ml/gcc-
                   |                            |patches/2006-
                   |                            |08/msg00386.html
           Keywords|                            |patch


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1/4.2 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[patchapp at dberlin dot org]

------- Comment #10 from patchapp at dberlin dot org  2006-08-16 07:06 -------
Subject: Bug number PR 26570

A patch for this bug has been added to the patch tracker.
The mailing list url for the patch is
http://gcc.gnu.org/ml/gcc-patches/2006-08/msg00399.html


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov/profile/26570] [4.1 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[pinskia at gcc dot gnu dot org]

------- Comment #11 from pinskia at gcc dot gnu dot org  2006-08-17 02:02 -------
Fixed at least on the mainline.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[4.1/4.2 Regression] -      |[4.1 Regression] -fprofile-
                   |fprofile-generate -fprofile-|generate -fprofile-use cause
                   |use cause memory corruption |memory corruption
                   |immediately                 |immediately


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570

[Bug gcov-profile/26570] [4.1 Regression] -fprofile-generate -fprofile-use cause memory corruption immediately

[rguenth at gcc dot gnu dot org]

------- Comment #12 from rguenth at gcc dot gnu dot org  2006-10-18 09:24 -------
Fixed.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26570