public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
* [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. @ 2008-09-30 17:31 luisgpm at linux dot vnet dot ibm dot com 2008-10-01 10:55 ` [Bug regression/37686] [4.4 Regression] " rguenth at gcc dot gnu dot org ` (21 more replies) 0 siblings, 22 replies; 24+ messages in thread From: luisgpm at linux dot vnet dot ibm dot com @ 2008-09-30 17:31 UTC (permalink / raw) To: gcc-bugs After this patch: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=140660 Building bzip2 with peak flags AND -mcpu=power4 for ppc (-O3 -mcpu=power4 -ffast-math -funroll-loops -ftree-loop-linear -fpeel-loops) started ICE'ing. Here is the backtrace: #0 0x103a2c3c in gimple_bb (g=0x4) at /home/luis/src/gcc/HEAD/gcc/gimple.h:1071 #1 0x103a2b80 in gsi_start (seq=0xf76882b0) at /home/luis/src/gcc/HEAD/gcc/gimple.h:4298 #2 0x103a5a48 in gsi_start_phis (bb=0xf7664b40) at /home/luis/src/gcc/HEAD/gcc/gimple-iterator.c:770 #3 0x105e601c in verify_stmts () at /home/luis/src/gcc/HEAD/gcc/tree-cfg.c:4177 #4 0x107e80cc in verify_ssa (check_modified_stmt=1 '\001') at /home/luis/src/gcc/HEAD/gcc/tree-ssa.c:750 #5 0x10476c30 in execute_function_todo (data=0x4043) at /home/luis/src/gcc/HEAD/gcc/passes.c:999 #6 0x1047657c in do_per_function (callback=0x10476898 <execute_function_todo>, data=0x4043) at /home/luis/src/gcc/HEAD/gcc/passes.c:841 #7 0x10476d38 in execute_todo (flags=16451) at /home/luis/src/gcc/HEAD/gcc/passes.c:1025 #8 0x10477c54 in execute_one_pass (pass=0x10eeabd4) at /home/luis/src/gcc/HEAD/gcc/passes.c:1301 #9 0x10477ec4 in execute_pass_list (pass=0x10eeabd4) at /home/luis/src/gcc/HEAD/gcc/passes.c:1327 #10 0x10477ef0 in execute_pass_list (pass=0x10eeaa9c) at /home/luis/src/gcc/HEAD/gcc/passes.c:1328 #11 0x10477ef0 in execute_pass_list (pass=0x10eea494) at /home/luis/src/gcc/HEAD/gcc/passes.c:1328 #12 0x106656a8 in tree_rest_of_compilation (fndecl=0xf7e74180) at /home/luis/src/gcc/HEAD/gcc/tree-optimize.c:418 #13 0x10930d78 in cgraph_expand_function (node=0xf7e78300) at /home/luis/src/gcc/HEAD/gcc/cgraphunit.c:1038 #14 0x10930fe0 in cgraph_expand_all_functions () at /home/luis/src/gcc/HEAD/gcc/cgraphunit.c:1097 #15 0x109317a8 in cgraph_optimize () at /home/luis/src/gcc/HEAD/gcc/cgraphunit.c:1302 #16 0x10033998 in c_write_global_declarations () at /home/luis/src/gcc/HEAD/gcc/c-decl.c:8073 #17 0x105c9624 in compile_file () at /home/luis/src/gcc/HEAD/gcc/toplev.c:979 #18 0x105cc214 in do_compile () at /home/luis/src/gcc/HEAD/gcc/toplev.c:2190 #19 0x105cc2a8 in toplev_main (argc=30, argv=0xff880e44) at /home/luis/src/gcc/HEAD/gcc/toplev.c:2222 #20 0x100f90fc in main (argc=30, argv=0xff880e44) at /home/luis/src/gcc/HEAD/gcc/main.c:35 The failing line is "return g->gsbase.bb;", because "g" isn't really a valid pointer: (gdb) p g $1 = (const_gimple) 0x4 -- Summary: Building of CPU2000's bzip2 with peak flags with - mcpu=power4 fails with an ICE. Product: gcc Version: 4.4.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: regression AssignedTo: unassigned at gcc dot gnu dot org ReportedBy: luisgpm at linux dot vnet dot ibm dot com GCC build triplet: powerpc*-*-* GCC host triplet: powerpc*-*-* GCC target triplet: powerpc*-*-* http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 10:55 ` rguenth at gcc dot gnu dot org 2008-10-01 13:11 ` luisgpm at linux dot vnet dot ibm dot com ` (20 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: rguenth at gcc dot gnu dot org @ 2008-10-01 10:55 UTC (permalink / raw) To: gcc-bugs ------- Comment #1 from rguenth at gcc dot gnu dot org 2008-10-01 10:54 ------- Preprocessed source? -- rguenth at gcc dot gnu dot org changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |WAITING Keywords| |ice-on-valid-code Summary|Building of CPU2000's bzip2 |[4.4 Regression] Building of |with peak flags with - |CPU2000's bzip2 with peak |mcpu=power4 fails with an |flags with -mcpu=power4 |ICE. |fails with an ICE. Target Milestone|--- |4.4.0 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com 2008-10-01 10:55 ` [Bug regression/37686] [4.4 Regression] " rguenth at gcc dot gnu dot org @ 2008-10-01 13:11 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:12 ` luisgpm at linux dot vnet dot ibm dot com ` (19 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 13:11 UTC (permalink / raw) To: gcc-bugs ------- Comment #2 from luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:10 ------- Created an attachment (id=16439) --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=16439&action=view) Preprocessed source for reduced bzip2.c Preprocessed source. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com 2008-10-01 10:55 ` [Bug regression/37686] [4.4 Regression] " rguenth at gcc dot gnu dot org 2008-10-01 13:11 ` luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 13:12 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:14 ` luisgpm at linux dot vnet dot ibm dot com ` (18 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 13:12 UTC (permalink / raw) To: gcc-bugs ------- Comment #3 from luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:10 ------- Created an attachment (id=16440) --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=16440&action=view) Reduced source for bzip2.c Source reduced with delta -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (2 preceding siblings ...) 2008-10-01 13:12 ` luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 13:14 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:21 ` luisgpm at linux dot vnet dot ibm dot com ` (17 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 13:14 UTC (permalink / raw) To: gcc-bugs ------- Comment #4 from luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:13 ------- Created an attachment (id=16441) --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=16441&action=view) Reduced source for bzip2.c Indented reduced source. -- luisgpm at linux dot vnet dot ibm dot com changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #16440|0 |1 is obsolete| | http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (3 preceding siblings ...) 2008-10-01 13:14 ` luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 13:21 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 14:14 ` rguenth at gcc dot gnu dot org ` (16 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 13:21 UTC (permalink / raw) To: gcc-bugs ------- Comment #5 from luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:19 ------- I'm still trying to minimize even further the source. Will attach when i have something better. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (4 preceding siblings ...) 2008-10-01 13:21 ` luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 14:14 ` rguenth at gcc dot gnu dot org 2008-10-01 17:46 ` luisgpm at linux dot vnet dot ibm dot com ` (15 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: rguenth at gcc dot gnu dot org @ 2008-10-01 14:14 UTC (permalink / raw) To: gcc-bugs ------- Comment #6 from rguenth at gcc dot gnu dot org 2008-10-01 14:12 ------- Doesn't ICE for me with a cross from x86_64, ./cc1 -quiet bzip2-reduced.i -O3 -ffast-math -funroll-loops -ftree-loop-linear -fpeel-loops -mcpu=power4 {,-m32,-m64} -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (5 preceding siblings ...) 2008-10-01 14:14 ` rguenth at gcc dot gnu dot org @ 2008-10-01 17:46 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 20:14 ` pinskia at gcc dot gnu dot org ` (14 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 17:46 UTC (permalink / raw) To: gcc-bugs ------- Comment #7 from luisgpm at linux dot vnet dot ibm dot com 2008-10-01 17:44 ------- I still can ICE it with the same flags in a native system. Any other info you'd like to have available? I have a more reduced source, will post it soon. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (6 preceding siblings ...) 2008-10-01 17:46 ` luisgpm at linux dot vnet dot ibm dot com @ 2008-10-01 20:14 ` pinskia at gcc dot gnu dot org 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org ` (13 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: pinskia at gcc dot gnu dot org @ 2008-10-01 20:14 UTC (permalink / raw) To: gcc-bugs ------- Comment #8 from pinskia at gcc dot gnu dot org 2008-10-01 20:13 ------- I can reproduce this even with a stage1 compiler. -- pinskia at gcc dot gnu dot org changed: What |Removed |Added ---------------------------------------------------------------------------- Status|WAITING |UNCONFIRMED http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (7 preceding siblings ...) 2008-10-01 20:14 ` pinskia at gcc dot gnu dot org @ 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org ` (12 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: pinskia at gcc dot gnu dot org @ 2008-10-01 20:15 UTC (permalink / raw) To: gcc-bugs ------- Comment #10 from pinskia at gcc dot gnu dot org 2008-10-01 20:14 ------- This was with: GNU C (GCC) version 4.4.0 20080929 (experimental) [trunk revision 140763] (powerpc64-unknown-linux-gnu) -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (8 preceding siblings ...) 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org @ 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org 2008-10-01 20:24 ` pinskia at gcc dot gnu dot org ` (11 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: pinskia at gcc dot gnu dot org @ 2008-10-01 20:15 UTC (permalink / raw) To: gcc-bugs ------- Comment #9 from pinskia at gcc dot gnu dot org 2008-10-01 20:13 ------- #0 0x10195c2c in single_exit (loop=0xf7b31930) at /home/apinski/src/other/gcc/gcc/cfgloop.c:1618 #1 0x106a1208 in number_of_latch_executions (loop=0xf7b31930) at /home/apinski/src/other/gcc/gcc/tree-scalar-evolution.c:2375 #2 0x1072bc2c in canonicalize_loop_induction_variables (loop=0xf7b31930, create_iv=1 '\001', ul=UL_SINGLE_ITER, try_eval=1 '\001') at /home/apinski/src/other/gcc/gcc/tree-ssa-loop-ivcanon.c:277 #3 0x1072be84 in canonicalize_induction_variables () at /home/apinski/src/other/gcc/gcc/tree-ssa-loop-ivcanon.c:330 #4 0x1075f740 in tree_ssa_loop_ivcanon () at /home/apinski/src/other/gcc/gcc/tree-ssa-loop.c:378 #5 0x10475700 in execute_one_pass (pass=0x10ebb2c8) at /home/apinski/src/other/gcc/gcc/passes.c:1279 -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug regression/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (9 preceding siblings ...) 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org @ 2008-10-01 20:24 ` pinskia at gcc dot gnu dot org 2008-10-01 21:57 ` [Bug tree-optimization/37686] " pinskia at gcc dot gnu dot org ` (10 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: pinskia at gcc dot gnu dot org @ 2008-10-01 20:24 UTC (permalink / raw) To: gcc-bugs ------- Comment #11 from pinskia at gcc dot gnu dot org 2008-10-01 20:23 ------- If I change the GC Parameters, I get a different backtrace: #0 0x105c9abc in gsi_stmt (i=Cannot access memory at address 0x4 ) at /home/apinski/src/other/gcc/gcc/gimple.h:4392 #1 0x105dd4fc in verify_stmts () at /home/apinski/src/other/gcc/gcc/tree-cfg.c:4179 #2 0x107dec80 in verify_ssa (check_modified_stmt=1 '\001') at /home/apinski/src/other/gcc/gcc/tree-ssa.c:750 So this looks GC related. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (10 preceding siblings ...) 2008-10-01 20:24 ` pinskia at gcc dot gnu dot org @ 2008-10-01 21:57 ` pinskia at gcc dot gnu dot org 2008-10-01 22:22 ` jakub at gcc dot gnu dot org ` (9 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: pinskia at gcc dot gnu dot org @ 2008-10-01 21:57 UTC (permalink / raw) To: gcc-bugs ------- Comment #12 from pinskia at gcc dot gnu dot org 2008-10-01 21:55 ------- This is far as reduced testcase I could get, if I remove anything that is unrelated the ICE goes away: unsigned char inUse[256]; unsigned char len[6][258]; int code[6][258]; unsigned int crc32Table[256] = { }; unsigned int getGlobalCRC (void) { } int bsLive; void bsW (int n, unsigned int v) { while (bsLive >= 8) {} } void hbAssignCodes (int * code, unsigned char * length, int minLen, int maxLen, int alphaSize) { int n, vec, i; for (n = minLen;n <= maxLen;n++) for (i = 0; i < alphaSize;i++) code[i] = vec; } void sendMTFValues (void) { int v, t, i, j, gs, ge, totc, bt, bc, iter; int nSelectors, alphaSize, minLen, maxLen, selCtr; int nGroups, nBytes; { while (1) { break; } hbAssignCodes (&code[t][0], &len[t][0], minLen, maxLen, alphaSize); unsigned char inUse16[16]; for (i = 0;i < 16;i++) if (inUse16[i]) { for (j = 0;j < 16;j++) if (inUse[i * 16 + j]) { } } } for (i = 0; i < nSelectors;i++) { } for (t = 0; t < nGroups;t++) { int curr = len[t][0]; for (i = 0; i < alphaSize;i++) while (curr < len[t][i]) { } } while (1) for (i = gs; i <= ge;i++) { } } --- CUT --- I had to use -m64 to get the ICE. I was able to get the ICE with: -mcpu=power4 -m64 -mtune=cell -O3 -ftree-loop-linear --param ggc-min-expand=0 --param ggc-min-heapsize=0 -funroll-loops -fpreprocessed Note -fpreprocessed is really needed, I don't know why though. -- pinskia at gcc dot gnu dot org changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW Ever Confirmed|0 |1 Last reconfirmed|0000-00-00 00:00:00 |2008-10-01 21:55:56 date| | http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (11 preceding siblings ...) 2008-10-01 21:57 ` [Bug tree-optimization/37686] " pinskia at gcc dot gnu dot org @ 2008-10-01 22:22 ` jakub at gcc dot gnu dot org 2008-10-02 8:52 ` jakub at gcc dot gnu dot org ` (8 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: jakub at gcc dot gnu dot org @ 2008-10-01 22:22 UTC (permalink / raw) To: gcc-bugs ------- Comment #13 from jakub at gcc dot gnu dot org 2008-10-01 22:20 ------- Thanks, finally #c12 is something I can reproduce in native stage1. Will investigate this morning. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (12 preceding siblings ...) 2008-10-01 22:22 ` jakub at gcc dot gnu dot org @ 2008-10-02 8:52 ` jakub at gcc dot gnu dot org 2008-10-02 9:07 ` jakub at gcc dot gnu dot org ` (7 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: jakub at gcc dot gnu dot org @ 2008-10-02 8:52 UTC (permalink / raw) To: gcc-bugs ------- Comment #14 from jakub at gcc dot gnu dot org 2008-10-02 08:51 ------- This is a simple buffer overflow in lambda-code.c. It is easily reproduceable everywhere with the #c12 testcase with just -O3 -ftree-loop-linear -funroll-loops if you add an assert: --- lambda-code.c.jj 2008-09-05 12:56:32.000000000 +0200 +++ lambda-code.c 2008-10-02 10:39:59.000000000 +0200 @@ -2765,6 +2765,7 @@ av_for_af (tree access_fun, lambda_vecto return false; var = am_vector_index_for_loop (am, CHREC_VARIABLE (access_fun)); + gcc_assert (var < AM_NB_COLUMNS (am)); cy[var] = int_cst_value (right); if (TREE_CODE (left) == POLYNOMIAL_CHREC) On this testcase, AM_PARAMETERS (am) == NULL and AM_NB_INDUCTION_VARS (am) == 2, so AM_NB_COLUMNS (am) == 3, yet the code overwrites cy[8]. -- jakub at gcc dot gnu dot org changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dberlin at gcc dot gnu dot | |org, spop at gcc dot gnu dot | |org http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (13 preceding siblings ...) 2008-10-02 8:52 ` jakub at gcc dot gnu dot org @ 2008-10-02 9:07 ` jakub at gcc dot gnu dot org 2008-10-02 15:04 ` jakub at gcc dot gnu dot org ` (6 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: jakub at gcc dot gnu dot org @ 2008-10-02 9:07 UTC (permalink / raw) To: gcc-bugs ------- Comment #15 from jakub at gcc dot gnu dot org 2008-10-02 09:05 ------- Given that the cy vector is supposed to have 3 parts, the first for ivs, the second for (optional) parameters and the last entry for constant column, and av_for_af_base adds stuff to constant column and to the parameters, I'd expect av_for_af means to write the ivs entries only, so the gcc_assert probably should even assert that var < AM_NB_INDUCTION_VARS (am). access_fun is {0B, +, 4}_9 and AM_LOOP_NEST_NUM (am) == 1, which is far more than the 2 ivs we have allocated space for. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (14 preceding siblings ...) 2008-10-02 9:07 ` jakub at gcc dot gnu dot org @ 2008-10-02 15:04 ` jakub at gcc dot gnu dot org 2008-10-02 19:41 ` jakub at gcc dot gnu dot org ` (5 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: jakub at gcc dot gnu dot org @ 2008-10-02 15:04 UTC (permalink / raw) To: gcc-bugs ------- Comment #16 from jakub at gcc dot gnu dot org 2008-10-02 15:03 ------- Wonder whether just am_vector_index_for_loop shouldn't be: static inline int am_vector_index_for_loop (struct access_matrix *access_matrix, int loop_num) { int depth1 = loop_depth (get_loop (loop_num)); int depth2 = loop_depth (get_loop (AM_LOOP_NEST_NUM (access_matrix))); gcc_assert (depth1 >= depth2 && depth1 - depth2 <= AM_NB_INDUCTION_VARS (access_matrix)); return depth1 - depth2; } Certainly subtracting two loop_num numbers doesn't make much sense to me. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (15 preceding siblings ...) 2008-10-02 15:04 ` jakub at gcc dot gnu dot org @ 2008-10-02 19:41 ` jakub at gcc dot gnu dot org 2008-10-03 15:50 ` spop at gcc dot gnu dot org ` (4 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: jakub at gcc dot gnu dot org @ 2008-10-02 19:41 UTC (permalink / raw) To: gcc-bugs ------- Comment #17 from jakub at gcc dot gnu dot org 2008-10-02 19:40 ------- That bootstrapped/regtested, unfortunately the <= in the assert is not right. And when I've changed the <= in the assert to <, pr29581.f90 ICEs, it has AM_NB_INDUCTION_VARS in one particular case set to 2, and AM_LOOP_NEST_NUM's loop_depth is 1, yet the inline is called with loop_depth 3. So I guess I'll leave this to Sebastian or Jan Sjodin who added all this stuff this May. -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (16 preceding siblings ...) 2008-10-02 19:41 ` jakub at gcc dot gnu dot org @ 2008-10-03 15:50 ` spop at gcc dot gnu dot org 2008-10-03 20:15 ` Sebastian Pop 2008-10-03 20:17 ` sebpop at gmail dot com ` (3 subsequent siblings) 21 siblings, 1 reply; 24+ messages in thread From: spop at gcc dot gnu dot org @ 2008-10-03 15:50 UTC (permalink / raw) To: gcc-bugs ------- Comment #18 from spop at gcc dot gnu dot org 2008-10-03 15:49 ------- Mine. We should do exactly what graphite is doing: register loops belonging to the loop nest in a VEC, then iterate over the loop nest to find the index in the Access Matrix. -- spop at gcc dot gnu dot org changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|unassigned at gcc dot gnu |spop at gcc dot gnu dot org |dot org | Status|NEW |ASSIGNED Last reconfirmed|2008-10-01 21:55:56 |2008-10-03 15:49:06 date| | http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-10-03 15:50 ` spop at gcc dot gnu dot org @ 2008-10-03 20:15 ` Sebastian Pop 0 siblings, 0 replies; 24+ messages in thread From: Sebastian Pop @ 2008-10-03 20:15 UTC (permalink / raw) To: gcc-bugzilla; +Cc: gcc-bugs [-- Attachment #1: Type: text/plain, Size: 98 bytes --] Here is a patch that should fix this bug. Can somebody test that it fixes it? Thanks, Sebastian [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #2: 1238_pr37686.diff --] [-- Type: text/x-diff; name=1238_pr37686.diff, Size: 4494 bytes --] Index: tree-loop-linear.c =================================================================== --- tree-loop-linear.c (revision 140668) +++ tree-loop-linear.c (working copy) @@ -333,11 +333,16 @@ linear_transform_loops (void) lambda_loopnest before, after; lambda_trans_matrix trans; struct obstack lambda_obstack; + struct loop *loop; + VEC(loop_p,heap) *nest = VEC_alloc (loop_p, heap, 3); depth = perfect_loop_nest_depth (loop_nest); if (depth == 0) continue; + for (loop = loop_nest; loop; loop = loop->inner) + VEC_safe_push (loop_p, heap, nest, loop); + gcc_obstack_init (&lambda_obstack); VEC_truncate (tree, oldivs, 0); VEC_truncate (tree, invariants, 0); @@ -350,8 +355,7 @@ linear_transform_loops (void) goto free_and_continue; lambda_collect_parameters (datarefs, &lambda_parameters); - if (!lambda_compute_access_matrices (datarefs, lambda_parameters, - loop_nest->num)) + if (!lambda_compute_access_matrices (datarefs, lambda_parameters, nest)) goto free_and_continue; if (dump_file && (dump_flags & TDF_DETAILS)) @@ -410,6 +414,7 @@ linear_transform_loops (void) obstack_free (&lambda_obstack, NULL); free_dependence_relations (dependence_relations); free_data_refs (datarefs); + VEC_free (loop_p, heap, nest); } for (i = 0; VEC_iterate (gimple, remove_ivs, i, oldiv_stmt); i++) Index: tree-data-ref.h =================================================================== --- tree-data-ref.h (revision 140668) +++ tree-data-ref.h (working copy) @@ -128,13 +128,13 @@ typedef struct scop *scop_p; */ struct access_matrix { - int loop_nest_num; + VEC (loop_p, heap) *loop_nest; int nb_induction_vars; VEC (tree, heap) *parameters; VEC (lambda_vector, heap) *matrix; }; -#define AM_LOOP_NEST_NUM(M) (M)->loop_nest_num +#define AM_LOOP_NEST(M) (M)->loop_nest #define AM_NB_INDUCTION_VARS(M) (M)->nb_induction_vars #define AM_PARAMETERS(M) (M)->parameters #define AM_MATRIX(M) (M)->matrix @@ -149,8 +149,14 @@ struct access_matrix static inline int am_vector_index_for_loop (struct access_matrix *access_matrix, int loop_num) { - gcc_assert (loop_num >= AM_LOOP_NEST_NUM (access_matrix)); - return loop_num - AM_LOOP_NEST_NUM (access_matrix); + int i; + loop_p l; + + for (i = 0; VEC_iterate (loop_p, AM_LOOP_NEST (access_matrix), i, l); i++) + if (l->num == loop_num) + return i; + + gcc_unreachable(); } int access_matrix_get_index_for_parameter (tree, struct access_matrix *); @@ -581,7 +587,7 @@ bool lambda_transform_legal_p (lambda_tr void lambda_collect_parameters (VEC (data_reference_p, heap) *, VEC (tree, heap) **); bool lambda_compute_access_matrices (VEC (data_reference_p, heap) *, - VEC (tree, heap) *, int); + VEC (tree, heap) *, VEC (loop_p, heap) *); /* In tree-data-ref.c */ void split_constant_offset (tree , tree *, tree *); Index: lambda-code.c =================================================================== --- lambda-code.c (revision 140668) +++ lambda-code.c (working copy) @@ -2786,17 +2786,15 @@ av_for_af (tree access_fun, lambda_vecto static bool build_access_matrix (data_reference_p data_reference, - VEC (tree, heap) *parameters, int loop_nest_num) + VEC (tree, heap) *parameters, VEC (loop_p, heap) *nest) { struct access_matrix *am = GGC_NEW (struct access_matrix); unsigned i, ndim = DR_NUM_DIMENSIONS (data_reference); - struct loop *loop = gimple_bb (DR_STMT (data_reference))->loop_father; - struct loop *loop_nest = get_loop (loop_nest_num); - unsigned nivs = loop_depth (loop) - loop_depth (loop_nest) + 1; + unsigned nivs = VEC_length (loop_p, nest); unsigned lambda_nb_columns; lambda_vector_vec_p matrix; - AM_LOOP_NEST_NUM (am) = loop_nest_num; + AM_LOOP_NEST (am) = nest; AM_NB_INDUCTION_VARS (am) = nivs; AM_PARAMETERS (am) = parameters; @@ -2824,13 +2822,13 @@ build_access_matrix (data_reference_p da bool lambda_compute_access_matrices (VEC (data_reference_p, heap) *datarefs, VEC (tree, heap) *parameters, - int loop_nest_num) + VEC (loop_p, heap) *nest) { data_reference_p dataref; unsigned ix; for (ix = 0; VEC_iterate (data_reference_p, datarefs, ix, dataref); ix++) - if (!build_access_matrix (dataref, parameters, loop_nest_num)) + if (!build_access_matrix (dataref, parameters, nest)) return false; return true; ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (17 preceding siblings ...) 2008-10-03 15:50 ` spop at gcc dot gnu dot org @ 2008-10-03 20:17 ` sebpop at gmail dot com 2008-10-03 21:00 ` luisgpm at linux dot vnet dot ibm dot com ` (2 subsequent siblings) 21 siblings, 0 replies; 24+ messages in thread From: sebpop at gmail dot com @ 2008-10-03 20:17 UTC (permalink / raw) To: gcc-bugs ------- Comment #19 from sebpop at gmail dot com 2008-10-03 20:15 ------- Subject: Re: [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. Here is a patch that should fix this bug. Can somebody test that it fixes it? Thanks, Sebastian ------- Comment #20 from sebpop at gmail dot com 2008-10-03 20:15 ------- Created an attachment (id=16459) --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=16459&action=view) -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (18 preceding siblings ...) 2008-10-03 20:17 ` sebpop at gmail dot com @ 2008-10-03 21:00 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-15 16:15 ` spop at gcc dot gnu dot org 2008-10-15 16:16 ` spop at gcc dot gnu dot org 21 siblings, 0 replies; 24+ messages in thread From: luisgpm at linux dot vnet dot ibm dot com @ 2008-10-03 21:00 UTC (permalink / raw) To: gcc-bugs ------- Comment #21 from luisgpm at linux dot vnet dot ibm dot com 2008-10-03 20:59 ------- It fixes the bzip2 ICE. Thanks, Luis -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (19 preceding siblings ...) 2008-10-03 21:00 ` luisgpm at linux dot vnet dot ibm dot com @ 2008-10-15 16:15 ` spop at gcc dot gnu dot org 2008-10-15 16:16 ` spop at gcc dot gnu dot org 21 siblings, 0 replies; 24+ messages in thread From: spop at gcc dot gnu dot org @ 2008-10-15 16:15 UTC (permalink / raw) To: gcc-bugs ------- Comment #22 from spop at gcc dot gnu dot org 2008-10-15 16:14 ------- Fixed. -- spop at gcc dot gnu dot org changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
* [Bug tree-optimization/37686] [4.4 Regression] Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE. 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com ` (20 preceding siblings ...) 2008-10-15 16:15 ` spop at gcc dot gnu dot org @ 2008-10-15 16:16 ` spop at gcc dot gnu dot org 21 siblings, 0 replies; 24+ messages in thread From: spop at gcc dot gnu dot org @ 2008-10-15 16:16 UTC (permalink / raw) To: gcc-bugs ------- Comment #23 from spop at gcc dot gnu dot org 2008-10-15 16:14 ------- Subject: Bug 37686 Author: spop Date: Wed Oct 15 16:13:33 2008 New Revision: 141141 URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=141141 Log: 2008-10-15 Sebastian Pop <sebastian.pop@amd.com> PR tree-optimization/37686 * testsuite/gcc.dg/tree-ssa/pr37686.c: New. * tree-loop-linear.c (linear_transform_loops): Build a loop nest vector. Pass it to lambda_compute_access_matrices. * tree-data-ref.h (struct access_matrix): Store the loop nest relative to which it encodes the information. (AM_LOOP_NEST_NUM): Renamed AM_LOOP_NEST. (am_vector_index_for_loop): Reimplemented: iterate over the loop nest for finding the loop index in the access matrix. (lambda_compute_access_matrices): Update declaration. * lambda-code.c (build_access_matrix): Pass the loop nest and record it. (lambda_compute_access_matrices): Same. Added: trunk/gcc/testsuite/gcc.dg/tree-ssa/pr37686.c Modified: trunk/gcc/ChangeLog trunk/gcc/lambda-code.c trunk/gcc/testsuite/ChangeLog trunk/gcc/tree-data-ref.h trunk/gcc/tree-loop-linear.c -- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37686 ^ permalink raw reply [flat|nested] 24+ messages in thread
end of thread, other threads:[~2008-10-15 16:16 UTC | newest] Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2008-09-30 17:31 [Bug regression/37686] New: Building of CPU2000's bzip2 with peak flags with -mcpu=power4 fails with an ICE luisgpm at linux dot vnet dot ibm dot com 2008-10-01 10:55 ` [Bug regression/37686] [4.4 Regression] " rguenth at gcc dot gnu dot org 2008-10-01 13:11 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:12 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:14 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 13:21 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 14:14 ` rguenth at gcc dot gnu dot org 2008-10-01 17:46 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-01 20:14 ` pinskia at gcc dot gnu dot org 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org 2008-10-01 20:15 ` pinskia at gcc dot gnu dot org 2008-10-01 20:24 ` pinskia at gcc dot gnu dot org 2008-10-01 21:57 ` [Bug tree-optimization/37686] " pinskia at gcc dot gnu dot org 2008-10-01 22:22 ` jakub at gcc dot gnu dot org 2008-10-02 8:52 ` jakub at gcc dot gnu dot org 2008-10-02 9:07 ` jakub at gcc dot gnu dot org 2008-10-02 15:04 ` jakub at gcc dot gnu dot org 2008-10-02 19:41 ` jakub at gcc dot gnu dot org 2008-10-03 15:50 ` spop at gcc dot gnu dot org 2008-10-03 20:15 ` Sebastian Pop 2008-10-03 20:17 ` sebpop at gmail dot com 2008-10-03 21:00 ` luisgpm at linux dot vnet dot ibm dot com 2008-10-15 16:15 ` spop at gcc dot gnu dot org 2008-10-15 16:16 ` spop at gcc dot gnu dot org
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).