[Bug middle-end/45484] New: r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[Bug middle-end/45484] New: r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

The commit of r163660...

Author: ebotcazou
Date: Mon Aug 30 20:04:49 2010
New Revision: 163660

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=163660
Log:
        Stack usage support
        * common.opt (-fstack-usage): New option.
        * doc/invoke.texi (Debugging options): Document it.
        * builtins.c (expand_builtin_apply): Pass TRUE as 4th argument to
        allocate_dynamic_stack_space.
        (expand_builtin_alloca): Add 4th bool parameter CANNOT_ACCUMULATE
        and propagate it to allocate_dynamic_stack_space.
        (expand_builtin) <BUILT_IN_ALLOCA>: Adjust for above change.
        * calls.c (initialize_argument_information): Pass TRUE as 4th
        argument to allocate_dynamic_stack_space.
        (expand_call): Set current_function_has_unbounded_dynamic_stack_size
        to 1 when pushing a variable-sized argument onto the stack.  Pass
        TRUE as 4th argument to allocate_dynamic_stack_space.
        Update current_function_pushed_stack_size.
        (emit_library_call_value_1): Likewise.
        * explow.c (allocate_dynamic_stack_space): Add 4th bool parameter
        CANNOT_ACCUMULATE.  If flag_stack_usage, look into the size and
        attempt to find an upper bound.  Remove redundant code for the
        SETJMP_VIA_SAVE_AREA case.
        * expr.h (allocate_dynamic_stack_space): Add 4th bool parameter.
        * function.h (struct stack_usage): New structure.
        (current_function_static_stack_size): New macro.
        (current_function_dynamic_stack_size): Likewise.
        (current_function_pushed_stack_size): Likewise.
        (current_function_dynamic_alloc_count): Likewise.
        (current_function_has_unbounded_dynamic_stack_size): Likewise.
        (current_function_allocates_dynamic_stack_space): Likewise.
        (struct function): Add new field 'su'.
        * function.c (instantiate_virtual_regs): If SETJMP_VIA_SAVE_AREA,
        add the value of the dynamic offset to the dynamic stack usage.
        (gimplify_parameters): Set ALLOCA_FOR_VAR_P on call to BUILT_IN_ALLOCA
        for variable-sized objects.
        (prepare_function_start): Allocate cfun->su if flag_stack_usage.
        (rest_of_handle_thread_prologue_and_epilogue): Call output_stack_usage.
        * gimplify.c (gimplify_decl_expr): Set ALLOCA_FOR_VAR_P on call to
        BUILT_IN_ALLOCA for variable-sized objects.
        * output.h (output_stack_usage): Declare.
        * toplev.c (stack_usage_file): New file pointer.
        (output_stack_usage): New function.
        (open_auxiliary_file): Likewise.
        (lang_dependent_init): Open file if flag_stack_usage is set.
        (finalize): Close file if stack_usage_file is not null.
        * tree.h (ALLOCA_FOR_VAR_P): New macro.
        * config/alpha/alpha.c (compute_frame_size): New function.
        (alpha_expand_prologue): Use it.
        (alpha_start_function): Likewise.
        (alpha_expand_epilogue): Likewise.  Set stack usage info.
        * config/i386/i386.c (ix86_expand_prologue): Likewise.
        * config/ia64/ia64.c (ia64_expand_prologue): Likewise.
        * config/mips/mips.c (mips_expand_prologue): Likewise.
        * config/pa/pa.c (hppa_expand_prologue): Likewise.
        * config/rs6000/rs6000.c (rs6000_emit_prologue): Likewise.
        * config/sparc/sparc.c (sparc_expand_prologue): Likewise.
testsuite/
        * lib/gcc-dg.exp (cleanup-stack-usage): New procedure.
        * lib/scanasm.exp (scan-stack-usage): Likewise.
        (scan-stack-usage-not): Likewise.
        * gcc.dg/stack-usage-1.c: New test.
        * gcc.target/i386/stack-usage-realign.c: Likewise.

causes the regression...

FAIL: gcc.c-torture/execute/builtins/sprintf-chk.c compilation,  -Os  (internal
compiler error)
UNRESOLVED: gcc.c-torture/execute/builtins/sprintf-chk.c execution,  -Os 

at -m32 on x86_64-apple-darwin10 as well as the failure of its new test
cases...

FAIL: gcc.dg/stack-usage-1.c scan-file foo\\t(256|264)\\tstatic
FAIL: gcc.target/i386/stack-usage-realign.c scan-file
main\\t48\\tdynamic,bounded

at -m32 as well. The sprintf error appears as...

/fink.build/gcc46-4.6.0-1000/gcc-4.6-20100901/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk-lib.c
/sw/src/fink.build/gcc46-4.6.0-1000/gcc-4.6-20100901/gcc/testsuite/gcc.c-torture/execute/builtins/lib/main.c
 -w  -Os   -lm   -m32 -o
/sw/src/fink.build/gcc46-4.6.0-1000/darwin_objdir/gcc/testsuite/gcc/sprintf-chk.x7
   (timeout =
300)/sw/src/fink.build/gcc46-4.6.0-1000/gcc-4.6-20100901/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk.c:197:1:
internal compiler error: in div_data_align, at dwarf2out.c:595
Please submit a full bug report,
with preprocessed source if appropriate.See <http://gcc.gnu.org/bugs.html> for
instructions.
compiler exited with status 1
output
is:/sw/src/fink.build/gcc46-4.6.0-1000/gcc-4.6-20100901/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk.c:197:1:
internal compiler error: in div_data_align, at dwarf2out.c:595Please submit a
full bug report,with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Attempting to run this failing compilation through gdb oddly causes the ICE to
disappear and the expected and functional sprintf-chk.x7 is created.


Using built-in specs.
COLLECT_GCC=gcc-4
COLLECT_LTO_WRAPPER=/sw/lib/gcc4.6/libexec/gcc/x86_64-apple-darwin10.5.0/4.6.0/lto-wrapper
Target: x86_64-apple-darwin10.5.0
Configured with: ../gcc-4.6-20100901/configure --prefix=/sw
--prefix=/sw/lib/gcc4.6 --mandir=/sw/share/man --infodir=/sw/lib/gcc4.6/info
--enable-languages=c,c++,fortran,objc,obj-c++,java --with-gmp=/sw
--with-libiconv-prefix=/sw --with-ppl=/sw --with-cloog=/sw --with-mpc=/sw
--with-system-zlib --x-includes=/usr/X11R6/include --x-libraries=/usr/X11R6/lib
--program-suffix=-fsf-4.6 --enable-lto --enable-checking=yes
Thread model: posix
gcc version 4.6.0 20100901 (experimental) (GCC)


-- 
           Summary: r163660 ICEs gcc.c-torture/execute/builtins/sprintf-
                    chk.c compilation,  -Os at -m32
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: howarth at nitro dot med dot uc dot edu
 GCC build triplet: x86_64-apple-darwin10
  GCC host triplet: x86_64-apple-darwin10
GCC target triplet: x86_64-apple-darwin10


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #1 from howarth at nitro dot med dot uc dot edu  2010-09-01 16:21 -------
Original patch submitted with
http://gcc.gnu.org/ml/gcc-patches/2010-08/msg00440.html.
Test cases added with http://gcc.gnu.org/ml/gcc-patches/2010-08/msg00503.html.


-- 

howarth at nitro dot med dot uc dot edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|r163660 ICEs gcc.c-         |r163660 ICEs gcc.c-
                   |torture/execute/builtins/spr|torture/execute/builtins/spr
                   |intf-chk.c compilation,  -Os|intf-chk.c compilation,  -Os
                   |at -m32                     |at -m32


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #2 from howarth at nitro dot med dot uc dot edu  2010-09-01 19:26 -------
I am finding in current gcc trunk that these tests randomly pass and fail if
you repeat them enough times. This correlates with Richard Henderson
observation that the failures at r163660 looks like random memory corruption.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[ebotcazou at gcc dot gnu dot org]

------- Comment #3 from ebotcazou at gcc dot gnu dot org  2010-09-01 20:57 -------
> Original patch submitted with
> http://gcc.gnu.org/ml/gcc-patches/2010-08/msg00440.html.

I think I can prove that my patch doesn't affect code generation, except
possibly on the SPARC, so I'm a little skeptical about your diagnosis.  Are you
sure it's not r163679 instead?

> Test cases added with http://gcc.gnu.org/ml/gcc-patches/2010-08/msg00503.html.

I'll adjust them for Darwin.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #4 from howarth at nitro dot med dot uc dot edu  2010-09-01 23:11 -------
(In reply to comment #3)
> 
> I think I can prove that my patch doesn't affect code generation, except
> possibly on the SPARC, so I'm a little skeptical about your diagnosis.  Are you
> sure it's not r163679 instead?
> 

Clean bootstrap of r163659 followed by 20 instances of...

make -k check-gcc RUNTESTFLAGS="builtins.exp=sprintf-chk.c
--target_board=unix'{-m32,-m64}'"

produce 20 instances of all 40 tests passing. Repeated clean bootstrap for
r163660 and 20 instances
of the same make check statement produced 10 out of 20 times the failure...

FAIL: gcc.c-torture/execute/builtins/sprintf-chk.c compilation,  -Os  (internal
compiler error)

The evidence of r163660 being to blame looks pretty convincing to me.

Using built-in specs.
COLLECT_GCC=../../dist/bin/gcc
COLLECT_LTO_WRAPPER=/Users/howarth/dist/libexec/gcc/x86_64-apple-darwin10.4.0/4.6.0/lto-wrapper
Target: x86_64-apple-darwin10.4.0
Configured with: ../gcc/configure --prefix=/Users/howarth/dist --with-gmp=/sw
--with-libiconv-prefix=/sw --with-ppl=/sw --with-cloog=/sw --with-mpc=/sw
--with-system-zlib --x-includes=/usr/X11R6/include --x-libraries=/usr/X11R6/lib
--enable-checking=yes --enable-languages=c --enable-lto
Thread model: posix
gcc version 4.6.0 20100830 (experimental) (GCC) 


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #5 from howarth at nitro dot med dot uc dot edu  2010-09-01 23:17 -------
The code generate IS random. I repeatedly execute...

/Users/howarth/darwin_objdir/gcc/xgcc -B/Users/howarth/darwin_objdir/gcc/
/Users/howarth/gcc/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk.c
/Users/howarth/gcc/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk-lib.c
/Users/howarth/gcc/gcc/testsuite/gcc.c-torture/execute/builtins/lib/main.c -w
-Os -lm -m32 --save-temps -o
/Users/howarth/darwin_objdir/gcc/testsuite/gcc/sprintf-chk.x7

in individual directories and diff there contents, eventually I get this...

--- pr45484/sprintf-chk.s       2010-09-01 19:13:24.000000000 -0400
+++ pr45484_2/sprintf-chk.s     2010-09-01 19:14:11.000000000 -0400
@@ -776,7 +776,6 @@
 LCFI191:
        call    _abort
 L56:
-LCFI192:
        call    ___i686.get_pc_thunk.bx
 L57:
        addl    $24, %ebp
@@ -785,34 +784,33 @@
        movl    $0, (%eax)
        leal    -12(%ebp), %esp
        popl    %ebx
-LCFI193:
+LCFI192:
        popl    %esi
-LCFI194:
+LCFI193:
        popl    %edi
-LCFI195:
+LCFI194:
        popl    %ebp
-LCFI196:
+LCFI195:
        ret
-LCFI197:
 L73:
-LCFI198:
+LCFI196:
        addl    $32, %esp
-LCFI199:
+LCFI197:
        call    _abort
 LFE2:
        .globl _main_test
 _main_test:
 LFB3:
        pushl   %ebp
-LCFI200:
+LCFI198:
        movl    %esp, %ebp
-LCFI201:
+LCFI199:
        pushl   %ebx
-LCFI202:
+LCFI200:
        call    ___i686.get_pc_thunk.bx
 L00000000004$pb:
        subl    $4, %esp
-LCFI203:
+LCFI201:
        movl    _s2-L00000000004$pb(%ebx), %eax
        leal    _p-L00000000004$pb(%ebx), %edx
        movl    %eax, _s2-L00000000004$pb(%ebx)
@@ -825,11 +823,11 @@
        call    _test1
        call    _test2
        popl    %eax
-LCFI204:
+LCFI202:
        popl    %ebx
-LCFI205:
+LCFI203:
        popl    %ebp
-LCFI206:
+LCFI204:
        jmp     _test3
 LFE3:
        .globl _ptr
@@ -1855,74 +1853,62 @@
        .byte   0x4
        .set L$set$189,LCFI192-LCFI190
        .long L$set$189
-       .byte   0x2e
-       .byte   0x8
+       .byte   0xa
+       .byte   0xc3
        .byte   0x4
        .set L$set$190,LCFI193-LCFI192
        .long L$set$190
-       .byte   0xa
-       .byte   0xc3
+       .byte   0xc6
        .byte   0x4
        .set L$set$191,LCFI194-LCFI193
        .long L$set$191
-       .byte   0xc6
+       .byte   0xc7
        .byte   0x4
        .set L$set$192,LCFI195-LCFI194
        .long L$set$192
-       .byte   0xc7
-       .byte   0x4
-       .set L$set$193,LCFI196-LCFI195
-       .long L$set$193
        .byte   0xc
        .byte   0x5
        .byte   0x4
        .byte   0xc4
        .byte   0x4
-       .set L$set$194,LCFI197-LCFI196
-       .long L$set$194
-       .byte   0x13
-       .byte   0x1
-       .byte   0x2e
-       .byte   0
-       .byte   0x4
-       .set L$set$195,LCFI198-LCFI197
-       .long L$set$195
+       .set L$set$193,LCFI196-LCFI195
+       .long L$set$193
        .byte   0xb
        .align 2
 LEFDE5:
 LSFDE7:
-       .set L$set$196,LEFDE7-LASFDE7
-       .long L$set$196
+       .set L$set$194,LEFDE7-LASFDE7
+       .long L$set$194
 LASFDE7:
        .long   LASFDE7-EH_frame1
        .long   LFB3-.
-       .set L$set$197,LFE3-LFB3
-       .long L$set$197
+       .set L$set$195,LFE3-LFB3
+       .long L$set$195
        .byte   0
        .byte   0x4
-       .set L$set$198,LCFI200-LFB3
-       .long L$set$198
+       .set L$set$196,LCFI198-LFB3
+       .long L$set$196
        .byte   0xe
        .byte   0x8
        .byte   0x84
        .byte   0x2
        .byte   0x4
-       .set L$set$199,LCFI201-LCFI200
-       .long L$set$199
+       .set L$set$197,LCFI199-LCFI198
+       .long L$set$197
        .byte   0xd
        .byte   0x4
        .byte   0x4
-       .set L$set$200,LCFI202-LCFI201
-       .long L$set$200
+       .set L$set$198,LCFI200-LCFI199
+       .long L$set$198
        .byte   0x83
        .byte   0x3
        .byte   0x4
-       .set L$set$201,LCFI205-LCFI202
-       .long L$set$201
+       .set L$set$199,LCFI203-LCFI200
+       .long L$set$199
        .byte   0xc3
        .byte   0x4
-       .set L$set$202,LCFI206-LCFI205
-       .long L$set$202
+       .set L$set$200,LCFI204-LCFI203
+       .long L$set$200
        .byte   0xc
        .byte   0x5
        .byte   0x4
@@ -1930,13 +1916,13 @@
        .align 2
 LEFDE7:
 LSFDE9:
-       .set L$set$203,LEFDE9-LASFDE9
-       .long L$set$203
+       .set L$set$201,LEFDE9-LASFDE9
+       .long L$set$201
 LASFDE9:
        .long   LASFDE9-EH_frame1
        .long   LFB4-.
-       .set L$set$204,LFE4-LFB4
-       .long L$set$204
+       .set L$set$202,LFE4-LFB4
+       .long L$set$202
        .byte   0
        .align 2
 LEFDE9:


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #6 from howarth at nitro dot med dot uc dot edu  2010-09-01 23:21 -------
I should also note that sometimes the test in comment 5 does produce identical
code between two instances of executing the compile command whereas other times
I get a crash...

/Users/howarth/darwin_objdir/gcc/xgcc -B/Users/howarth/darwin_objdir/gcc/
/Users/howarth/gcc/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk.c
/Users/howarth/gcc/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk-lib.c
/Users/howarth/gcc/gcc/testsuite/gcc.c-torture/execute/builtins/lib/main.c -w
-Os -lm -m32 --save-temps -o
/Users/howarth/darwin_objdir/gcc/testsuite/gcc/sprintf-chk.x7
/Users/howarth/gcc/gcc/testsuite/gcc.c-torture/execute/builtins/sprintf-chk.c:197:1:
internal compiler error: in div_data_align, at dwarf2out.c:595
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #7 from howarth at nitro dot med dot uc dot edu  2010-09-02 04:59 -------
Created an attachment (id=21651)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=21651&action=view)
preprocessed source of reduced failing test case


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #8 from howarth at nitro dot med dot uc dot edu  2010-09-02 05:05 -------
At r163660, the reduced test case (of just the test3 subroutine of
sprint-chk.c) triggers the compiler ICE at high frequency on
x86-apple-darwin10...

/Users/howarth/darwin_objdir/gcc/xgcc -B/Users/howarth/darwin_objdir/gcc/ -c
./sprintf-chk.i -w -Os -m32
./sprintf-chk.c:77:1: internal compiler error: in div_data_align, at
dwarf2out.c:596
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Since this doesn't backtrace in gdb, I recompiled dwarf2out.c with the patch...

Index: gcc/dwarf2out.c
===================================================================
--- gcc/dwarf2out.c     (revision 163660)
+++ gcc/dwarf2out.c     (working copy)
@@ -592,6 +592,7 @@
 div_data_align (HOST_WIDE_INT off)
 {
   HOST_WIDE_INT r = off / DWARF_CIE_DATA_ALIGNMENT;
+  fprintf (stderr, "r = %ld DWARF_CIE_DATA_ALIGNMENT= %d and off=
%ld\n",r,DWARF_CIE_DATA_ALIGNMENT,off);
   gcc_assert (r * DWARF_CIE_DATA_ALIGNMENT == off);
   return r;
 }

using this I find that the output for a random set of failed compiles is...

r = 1 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -4
r = 2 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -8
r = 5 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -20
r = 4 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -16
r = 3 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -12
r = 0 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -2
./sprintf-chk.c:77:1: internal compiler error: in div_data_align, at
dwarf2out.c:596

r = 1 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -4
r = 2 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -8
r = 5 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -20
r = 4 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -16
r = 3 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -12
r = 1 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -7
./sprintf-chk.c:77:1: internal compiler error: in div_data_align, at
dwarf2out.c:596

r = 1 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -4
r = 2 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -8
r = 5 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -20
r = 4 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -16
r = 3 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -12
r = 0 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -3
./sprintf-chk.c:77:1: internal compiler error: in div_data_align, at
dwarf2out.c:596

whereas the non-failing compiles always show...

r = 1 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -4
r = 2 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -8
r = 5 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -20
r = 4 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -16
r = 3 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -12
r = 2 DWARF_CIE_DATA_ALIGNMENT= -4 and off= -8


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[howarth at nitro dot med dot uc dot edu]

------- Comment #9 from howarth at nitro dot med dot uc dot edu  2010-09-02 05:10 -------
Note that in current gcc trunk (r163747) with...

http://gcc.gnu.org/ml/gcc-patches/2010-08/msg01916.html

and 

http://gcc.gnu.org/bugzilla/attachment.cgi?id=21650

the frequency of the test case ICEing the compiler is very low (less than 1%)
but does still happen. I believe this bug just becomes more or less latent so
it should be debugged at revision which best exposes it.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[ubizjak at gmail dot com]

------- Comment #10 from ubizjak at gmail dot com  2010-09-02 05:47 -------
(In reply to comment #8)

> Since this doesn't backtrace in gdb, I recompiled dwarf2out.c with the patch...

You should use bigger hammer.

Try valgrind using following procedure:

a) Create a preprocessed source
   "~/gcc-build/gcc/xgcc -B ~/gcc-build/gcc -Os -S -save-temps sprintf-chk.c"

b) fire up valgrind:
   "valgrind ~/gcc-build/gcc/cc1 -Os -quiet sprintf-chk.i"

==3664== Memcheck, a memory error detector
==3664== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==3664== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info
==3664== Command: /home/uros/gcc-build/gcc/cc1 -Os -quiet sprintf-chk.i
==3664== 
==3664== Invalid read of size 8
==3664==    at 0xC71730: search_line_sse2 (lex.c:394)
==3664==    by 0xC71919: _cpp_clean_line (lex.c:665)
==3664==    by 0xC72317: _cpp_get_fresh_line (lex.c:1878)
==3664==    by 0xC73AA1: _cpp_lex_direct (lex.c:1943)
==3664==    by 0xC74896: _cpp_lex_token (lex.c:1817)
==3664==    by 0xC76FC7: cpp_get_token (macro.c:1240)
==3664==    by 0xC7727F: cpp_get_token_with_location (macro.c:1352)
==3664==    by 0x51684C: c_lex_with_flags (c-lex.c:302)
==3664==    by 0x4CFAA7: c_lex_one_token (c-parser.c:204)
==3664==    by 0x4DC468: c_parser_compound_statement_nostart (c-parser.c:320)
==3664==    by 0x4DEA18: c_parser_compound_statement (c-parser.c:3545)
==3664==    by 0x4DBDC2: c_parser_declaration_or_fndef (c-parser.c:1375)
==3664==  Address 0x5331f50 is 5,808 bytes inside a block of size 5,815 alloc'd
==3664==    at 0x4A05255: realloc (vg_replace_malloc.c:476)
==3664==    by 0xC9ADAC: xrealloc (xmalloc.c:179)
==3664==    by 0xC6659F: _cpp_convert_input (charset.c:1734)
==3664==    by 0xC6EFA2: read_file (files.c:648)
==3664==    by 0xC6F9CA: _cpp_stack_file (files.c:723)
==3664==    by 0xC71190: cpp_read_main_file (init.c:570)
==3664==    by 0x51B58A: c_common_post_options (c-opts.c:1124)
==3664==    by 0x7DACA4: toplev_main (toplev.c:1826)
==3664==    by 0x369861EC5C: (below main) (in /lib64/libc-2.12.so)
==3664== 
==3664== Invalid read of size 8
==3664==    at 0xC71723: search_line_sse2 (lex.c:382)
==3664==    by 0xC71919: _cpp_clean_line (lex.c:665)
==3664==    by 0xC72317: _cpp_get_fresh_line (lex.c:1878)
==3664==    by 0xC73AA1: _cpp_lex_direct (lex.c:1943)
==3664==    by 0xC74896: _cpp_lex_token (lex.c:1817)
==3664==    by 0xC76FC7: cpp_get_token (macro.c:1240)
==3664==    by 0xC7727F: cpp_get_token_with_location (macro.c:1352)
==3664==    by 0x51684C: c_lex_with_flags (c-lex.c:302)
==3664==    by 0x4CFAA7: c_lex_one_token (c-parser.c:204)
==3664==    by 0x4DC468: c_parser_compound_statement_nostart (c-parser.c:320)
==3664==    by 0x4DEA18: c_parser_compound_statement (c-parser.c:3545)
==3664==    by 0x4DBDC2: c_parser_declaration_or_fndef (c-parser.c:1375)
==3664==  Address 0x5331f50 is 5,808 bytes inside a block of size 5,815 alloc'd
==3664==    at 0x4A05255: realloc (vg_replace_malloc.c:476)
==3664==    by 0xC9ADAC: xrealloc (xmalloc.c:179)
==3664==    by 0xC6659F: _cpp_convert_input (charset.c:1734)
==3664==    by 0xC6EFA2: read_file (files.c:648)
==3664==    by 0xC6F9CA: _cpp_stack_file (files.c:723)
==3664==    by 0xC71190: cpp_read_main_file (init.c:570)
==3664==    by 0x51B58A: c_common_post_options (c-opts.c:1124)
==3664==    by 0x7DACA4: toplev_main (toplev.c:1826)
==3664==    by 0x369861EC5C: (below main) (in /lib64/libc-2.12.so)
==3664== 

==3680== ERROR SUMMARY: 4 errors from 2 contexts (suppressed: 6 from 6)

Woo-hoo?


-- 

ubizjak at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2010-09-02 05:47:57
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[pinskia at gmail dot com]

------- Comment #11 from pinskia at gmail dot com  2010-09-02 05:55 -------
Subject: Re:  r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c
compilation,  -Os at -m32



On Sep 1, 2010, at 10:47 PM, "ubizjak at gmail dot com"
<gcc-bugzilla@gcc.gnu.org 
 > wrote:

>
>
> ------- Comment #10 from ubizjak at gmail dot com  2010-09-02 05:47  
> -------
> (In reply to comment #8)
>
>> Since this doesn't backtrace in gdb, I recompiled dwarf2out.c with  
>> the patch...
>
> You should use bigger hammer.
>
> Try valgrind using following procedure:
>
> a) Create a preprocessed source
>   "~/gcc-build/gcc/xgcc -B ~/gcc-build/gcc -Os -S -save-temps  
> sprintf-chk.c"
>
> b) fire up valgrind:
>   "valgrind ~/gcc-build/gcc/cc1 -Os -quiet sprintf-chk.i"
>
> ==3664== Memcheck, a memory error detector
> ==3664== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et  
> al.
> ==3664== Using Valgrind-3.5.0 and LibVEX; rerun with -h for  
> copyright info
> ==3664== Command: /home/uros/gcc-build/gcc/cc1 -Os -quiet sprintf- 
> chk.i
> ==3664==
> ==3664== Invalid read of size 8
> ==3664==    at 0xC71730: search_line_sse2 (lex.c:394)
> ==3664==    by 0xC71919: _cpp_clean_line (lex.c:665)
> ==3664==    by 0xC72317: _cpp_get_fresh_line (lex.c:1878)
> ==3664==    by 0xC73AA1: _cpp_lex_direct (lex.c:1943)
> ==3664==    by 0xC74896: _cpp_lex_token (lex.c:1817)
> ==3664==    by 0xC76FC7: cpp_get_token (macro.c:1240)
> ==3664==    by 0xC7727F: cpp_get_token_with_location (macro.c:1352)
> ==3664==    by 0x51684C: c_lex_with_flags (c-lex.c:302)
> ==3664==    by 0x4CFAA7: c_lex_one_token (c-parser.c:204)
> ==3664==    by 0x4DC468: c_parser_compound_statement_nostart (c- 
> parser.c:320)
> ==3664==    by 0x4DEA18: c_parser_compound_statement (c-parser.c:3545)
> ==3664==    by 0x4DBDC2: c_parser_declaration_or_fndef (c-parser.c: 
> 1375)
> ==3664==  Address 0x5331f50 is 5,808 bytes inside a block of size  
> 5,815 alloc'd
> ==3664==    at 0x4A05255: realloc (vg_replace_malloc.c:476)
> ==3664==    by 0xC9ADAC: xrealloc (xmalloc.c:179)
> ==3664==    by 0xC6659F: _cpp_convert_input (charset.c:1734)
> ==3664==    by 0xC6EFA2: read_file (files.c:648)
> ==3664==    by 0xC6F9CA: _cpp_stack_file (files.c:723)
> ==3664==    by 0xC71190: cpp_read_main_file (init.c:570)
> ==3664==    by 0x51B58A: c_common_post_options (c-opts.c:1124)
> ==3664==    by 0x7DACA4: toplev_main (toplev.c:1826)
> ==3664==    by 0x369861EC5C: (below main) (in /lib64/libc-2.12.so)
> ==3664==
> ==3664== Invalid read of size 8
> ==3664==    at 0xC71723: search_line_sse2 (lex.c:382)
> ==3664==    by 0xC71919: _cpp_clean_line (lex.c:665)
> ==3664==    by 0xC72317: _cpp_get_fresh_line (lex.c:1878)
> ==3664==    by 0xC73AA1: _cpp_lex_direct (lex.c:1943)
> ==3664==    by 0xC74896: _cpp_lex_token (lex.c:1817)
> ==3664==    by 0xC76FC7: cpp_get_token (macro.c:1240)
> ==3664==    by 0xC7727F: cpp_get_token_with_location (macro.c:1352)
> ==3664==    by 0x51684C: c_lex_with_flags (c-lex.c:302)
> ==3664==    by 0x4CFAA7: c_lex_one_token (c-parser.c:204)
> ==3664==    by 0x4DC468: c_parser_compound_statement_nostart (c- 
> parser.c:320)
> ==3664==    by 0x4DEA18: c_parser_compound_statement (c-parser.c:3545)
> ==3664==    by 0x4DBDC2: c_parser_declaration_or_fndef (c-parser.c: 
> 1375)
> ==3664==  Address 0x5331f50 is 5,808 bytes inside a block of size  
> 5,815 alloc'd
> ==3664==    at 0x4A05255: realloc (vg_replace_malloc.c:476)
> ==3664==    by 0xC9ADAC: xrealloc (xmalloc.c:179)
> ==3664==    by 0xC6659F: _cpp_convert_input (charset.c:1734)
> ==3664==    by 0xC6EFA2: read_file (files.c:648)
> ==3664==    by 0xC6F9CA: _cpp_stack_file (files.c:723)
> ==3664==    by 0xC71190: cpp_read_main_file (init.c:570)
> ==3664==    by 0x51B58A: c_common_post_options (c-opts.c:1124)
> ==3664==    by 0x7DACA4: toplev_main (toplev.c:1826)
> ==3664==    by 0x369861EC5C: (below main) (in /lib64/libc-2.12.so)
> ==3664==
>
> ==3680== ERROR SUMMARY: 4 errors from 2 contexts (suppressed: 6 from  
> 6)
>
> Woo-hoo?


Actually those can be safely ignored. The loads will not cross page  
boundaries and then the code does not depend on the extra parts if the  
buffer has correctly a null character at the end. So it is a non bug  
that valgrind picks up but does not know how to handle when processing  
strings with vector instructions.

>
>
> -- 
>
> ubizjak at gmail dot com changed:
>
>           What    |Removed                     |Added
> --- 
> --- 
> ----------------------------------------------------------------------
>             Status|UNCONFIRMED                 |NEW
>     Ever Confirmed|0                           |1
>   Last reconfirmed|0000-00-00 00:00:00         |2010-09-02 05:47:57
>               date|                            |
>
>
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484
>


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

Re: [Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[Andrew Pinski]

On Sep 1, 2010, at 10:47 PM, "ubizjak at gmail dot com" <gcc-bugzilla@gcc.gnu.org 
 > wrote:

>
>
> ------- Comment #10 from ubizjak at gmail dot com  2010-09-02 05:47  
> -------
> (In reply to comment #8)
>
>> Since this doesn't backtrace in gdb, I recompiled dwarf2out.c with  
>> the patch...
>
> You should use bigger hammer.
>
> Try valgrind using following procedure:
>
> a) Create a preprocessed source
>   "~/gcc-build/gcc/xgcc -B ~/gcc-build/gcc -Os -S -save-temps  
> sprintf-chk.c"
>
> b) fire up valgrind:
>   "valgrind ~/gcc-build/gcc/cc1 -Os -quiet sprintf-chk.i"
>
> ==3664== Memcheck, a memory error detector
> ==3664== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et  
> al.
> ==3664== Using Valgrind-3.5.0 and LibVEX; rerun with -h for  
> copyright info
> ==3664== Command: /home/uros/gcc-build/gcc/cc1 -Os -quiet sprintf- 
> chk.i
> ==3664==
> ==3664== Invalid read of size 8
> ==3664==    at 0xC71730: search_line_sse2 (lex.c:394)
> ==3664==    by 0xC71919: _cpp_clean_line (lex.c:665)
> ==3664==    by 0xC72317: _cpp_get_fresh_line (lex.c:1878)
> ==3664==    by 0xC73AA1: _cpp_lex_direct (lex.c:1943)
> ==3664==    by 0xC74896: _cpp_lex_token (lex.c:1817)
> ==3664==    by 0xC76FC7: cpp_get_token (macro.c:1240)
> ==3664==    by 0xC7727F: cpp_get_token_with_location (macro.c:1352)
> ==3664==    by 0x51684C: c_lex_with_flags (c-lex.c:302)
> ==3664==    by 0x4CFAA7: c_lex_one_token (c-parser.c:204)
> ==3664==    by 0x4DC468: c_parser_compound_statement_nostart (c- 
> parser.c:320)
> ==3664==    by 0x4DEA18: c_parser_compound_statement (c-parser.c:3545)
> ==3664==    by 0x4DBDC2: c_parser_declaration_or_fndef (c-parser.c: 
> 1375)
> ==3664==  Address 0x5331f50 is 5,808 bytes inside a block of size  
> 5,815 alloc'd
> ==3664==    at 0x4A05255: realloc (vg_replace_malloc.c:476)
> ==3664==    by 0xC9ADAC: xrealloc (xmalloc.c:179)
> ==3664==    by 0xC6659F: _cpp_convert_input (charset.c:1734)
> ==3664==    by 0xC6EFA2: read_file (files.c:648)
> ==3664==    by 0xC6F9CA: _cpp_stack_file (files.c:723)
> ==3664==    by 0xC71190: cpp_read_main_file (init.c:570)
> ==3664==    by 0x51B58A: c_common_post_options (c-opts.c:1124)
> ==3664==    by 0x7DACA4: toplev_main (toplev.c:1826)
> ==3664==    by 0x369861EC5C: (below main) (in /lib64/libc-2.12.so)
> ==3664==
> ==3664== Invalid read of size 8
> ==3664==    at 0xC71723: search_line_sse2 (lex.c:382)
> ==3664==    by 0xC71919: _cpp_clean_line (lex.c:665)
> ==3664==    by 0xC72317: _cpp_get_fresh_line (lex.c:1878)
> ==3664==    by 0xC73AA1: _cpp_lex_direct (lex.c:1943)
> ==3664==    by 0xC74896: _cpp_lex_token (lex.c:1817)
> ==3664==    by 0xC76FC7: cpp_get_token (macro.c:1240)
> ==3664==    by 0xC7727F: cpp_get_token_with_location (macro.c:1352)
> ==3664==    by 0x51684C: c_lex_with_flags (c-lex.c:302)
> ==3664==    by 0x4CFAA7: c_lex_one_token (c-parser.c:204)
> ==3664==    by 0x4DC468: c_parser_compound_statement_nostart (c- 
> parser.c:320)
> ==3664==    by 0x4DEA18: c_parser_compound_statement (c-parser.c:3545)
> ==3664==    by 0x4DBDC2: c_parser_declaration_or_fndef (c-parser.c: 
> 1375)
> ==3664==  Address 0x5331f50 is 5,808 bytes inside a block of size  
> 5,815 alloc'd
> ==3664==    at 0x4A05255: realloc (vg_replace_malloc.c:476)
> ==3664==    by 0xC9ADAC: xrealloc (xmalloc.c:179)
> ==3664==    by 0xC6659F: _cpp_convert_input (charset.c:1734)
> ==3664==    by 0xC6EFA2: read_file (files.c:648)
> ==3664==    by 0xC6F9CA: _cpp_stack_file (files.c:723)
> ==3664==    by 0xC71190: cpp_read_main_file (init.c:570)
> ==3664==    by 0x51B58A: c_common_post_options (c-opts.c:1124)
> ==3664==    by 0x7DACA4: toplev_main (toplev.c:1826)
> ==3664==    by 0x369861EC5C: (below main) (in /lib64/libc-2.12.so)
> ==3664==
>
> ==3680== ERROR SUMMARY: 4 errors from 2 contexts (suppressed: 6 from  
> 6)
>
> Woo-hoo?


Actually those can be safely ignored. The loads will not cross page  
boundaries and then the code does not depend on the extra parts if the  
buffer has correctly a null character at the end. So it is a non bug  
that valgrind picks up but does not know how to handle when processing  
strings with vector instructions.

>
>
> -- 
>
> ubizjak at gmail dot com changed:
>
>           What    |Removed                     |Added
> --- 
> --- 
> ----------------------------------------------------------------------
>             Status|UNCONFIRMED                 |NEW
>     Ever Confirmed|0                           |1
>   Last reconfirmed|0000-00-00 00:00:00         |2010-09-02 05:47:57
>               date|                            |
>
>
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484
>

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[ubizjak at gmail dot com]

------- Comment #12 from ubizjak at gmail dot com  2010-09-02 06:05 -------
Created an attachment (id=21652)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=21652&action=view)
preprocessed source, fails with valgrind on linux

A non-sse4 sse2 capable host (core2 class) is needed to trigger valgrind
failure.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] r163660 ICEs gcc.c-torture/execute/builtins/sprintf-chk.c compilation, -Os at -m32

[ubizjak at gmail dot com]

------- Comment #13 from ubizjak at gmail dot com  2010-09-02 11:24 -------
(In reply to comment #12)

> A non-sse4 sse2 capable host (core2 class) is needed to trigger valgrind
> failure.

This is actually PR45386. Sorry for the noise...


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[hjl dot tools at gmail dot com]

------- Comment #14 from hjl dot tools at gmail dot com  2010-09-02 13:52 -------
On Linux/x86, -fPIC triggered invalid memory access:

[hjl@gnu-6 gcc]$ valgrind --tool=memcheck ./cc1 -fpreprocessed
/tmp/sprintf-chk.i -quiet -dumpbase sprintf-chk.i -m32 -mtune=generic
-march=x86-64 -auxbase sprintf-chk -Os -w -version -fpic -o sprintf-chk.s
==8036== Memcheck, a memory error detector
==8036== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==8036== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info
==8036== Command: ./cc1 -fpreprocessed /tmp/sprintf-chk.i -quiet -dumpbase
sprintf-chk.i -m32 -mtune=generic -march=x86-64 -auxbase sprintf-chk -Os -w
-version -fpic -o sprintf-chk.s
==8036== 
GNU C (GCC) version 4.6.0 20100901 (experimental) (x86_64-unknown-linux-gnu)
        compiled by GNU C version 4.4.4 20100630 (Red Hat 4.4.4-10), GMP
version 4.3.2, MPFR version 2.4.2-p3, MPC version 0.8.1
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
GNU C (GCC) version 4.6.0 20100901 (experimental) (x86_64-unknown-linux-gnu)
        compiled by GNU C version 4.4.4 20100630 (Red Hat 4.4.4-10), GMP
version 4.3.2, MPFR version 2.4.2-p3, MPC version 0.8.1
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 5013623740daff515d54e379ca68fe2e
==8036== Invalid read of size 8
==8036==    at 0x67F8A2: dwarf2out_notice_stack_adjust (dwarf2out.c:1624)
==8036==    by 0x681BD7: dwarf2out_frame_debug (dwarf2out.c:2744)
==8036==    by 0xCC2DD1: output_set_got (i386.c:8127)
==8036==    by 0xEACFD2: output_615 (i386.md:11477)
==8036==    by 0x719262: get_insn_template (final.c:1731)
==8036==    by 0x71A9C7: final_scan_insn (final.c:2609)
==8036==    by 0x719178: final (final.c:1716)
==8036==    by 0x71D885: rest_of_handle_final (final.c:4235)
==8036==    by 0x8F68AA: execute_one_pass (passes.c:1568)
==8036==    by 0x8F6A99: execute_pass_list (passes.c:1623)
==8036==    by 0x8F6ABA: execute_pass_list (passes.c:1624)
==8036==    by 0x8F6ABA: execute_pass_list (passes.c:1624)
==8036==  Address 0xb8ee848 is 0 bytes after a block of size 2,472 alloc'd
==8036==    at 0x4A0515D: malloc (vg_replace_malloc.c:195)
==8036==    by 0x1118BB3: xmalloc (xmalloc.c:147)
==8036==    by 0x67EFA1: compute_barrier_args_size (dwarf2out.c:1429)
==8036==    by 0x67F873: dwarf2out_notice_stack_adjust (dwarf2out.c:1619)
==8036==    by 0x681BD7: dwarf2out_frame_debug (dwarf2out.c:2744)
==8036==    by 0x719E79: final_scan_insn (final.c:2015)
==8036==    by 0x719178: final (final.c:1716)
==8036==    by 0x71D885: rest_of_handle_final (final.c:4235)
==8036==    by 0x8F68AA: execute_one_pass (passes.c:1568)
==8036==    by 0x8F6A99: execute_pass_list (passes.c:1623)
==8036==    by 0x8F6ABA: execute_pass_list (passes.c:1624)
==8036==    by 0x8F6ABA: execute_pass_list (passes.c:1624)
==8036== 
==8036== 
==8036== HEAP SUMMARY:
==8036==     in use at exit: 432,089 bytes in 1,754 blocks
==8036==   total heap usage: 15,425 allocs, 13,671 frees, 7,502,579 bytes
allocated
==8036== 
==8036== LEAK SUMMARY:
==8036==    definitely lost: 0 bytes in 0 blocks
==8036==    indirectly lost: 0 bytes in 0 blocks
==8036==      possibly lost: 16,064 bytes in 2 blocks
==8036==    still reachable: 416,025 bytes in 1,752 blocks
==8036==         suppressed: 0 bytes in 0 blocks
==8036== Rerun with --leak-check=full to see details of leaked memory
==8036== 
==8036== For counts of detected and suppressed errors, rerun with: -v
==8036== ERROR SUMMARY: 5 errors from 1 contexts (suppressed: 6 from 6)
[hjl@gnu-6 gcc]$ 


-- 

hjl dot tools at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ubizjak at gmail dot com
  GCC build triplet|x86_64-apple-darwin10       |
   GCC host triplet|x86_64-apple-darwin10       |
 GCC target triplet|x86_64-apple-darwin10       |
            Summary|r163660 ICEs gcc.c-         |Invalid memory access in
                   |torture/execute/builtins/spr|gcc.c-
                   |intf-chk.c compilation,  -Os|torture/execute/builtins/spr
                   |at -m32                     |intf-chk.c
   Target Milestone|---                         |4.6.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[hjl dot tools at gmail dot com]

------- Comment #15 from hjl dot tools at gmail dot com  2010-09-02 14:22 -------
A smaller testcase:

---
extern void abort (void);
extern void *chk_fail_buf[];
extern volatile int chk_fail_allowed;

void
test3 (void)
{
  chk_fail_allowed = 1;
  if (__builtin_setjmp (chk_fail_buf) == 0)
    abort ();
  chk_fail_allowed = 0;
}
---


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[hjl dot tools at gmail dot com]

------- Comment #16 from hjl dot tools at gmail dot com  2010-09-02 14:40 -------
output_set_got in i386.c has

#ifdef DWARF2_UNWIND_INFO
      /* Ensure all queued register saves are flushed before the
         call.  */
      if (dwarf2out_do_frame ())
        {
          rtx insn;
          start_sequence ();
          insn = emit_barrier ();
          end_sequence ();
          dwarf2out_frame_debug (insn, false);
        }
#endif

We inserted an instruction. But we are using the
old barrier_args_size.  It looks wrong to me.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[hjl dot tools at gmail dot com]

------- Comment #17 from hjl dot tools at gmail dot com  2010-09-02 14:43 -------
No idea if it is correct:

diff --git a/gcc/config/i386/i386.c b/gcc/config/i386/i386.c
index b550d86..decfd65 100644
--- a/gcc/config/i386/i386.c
+++ b/gcc/config/i386/i386.c
@@ -8121,6 +8121,7 @@ output_set_got (rtx dest, rtx label ATTRIBUTE_UNUSED)
       if (dwarf2out_do_frame ())
        {
          rtx insn;
+         dwarf2out_frame_debug (NULL_RTX, false);
          start_sequence ();
          insn = emit_barrier ();
          end_sequence ();


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[hjl dot tools at gmail dot com]

------- Comment #18 from hjl dot tools at gmail dot com  2010-09-02 14:49 -------
It is very likely that the stack usage change triggers this bug.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[howarth at nitro dot med dot uc dot edu]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 974 bytes --]



------- Comment #19 from howarth at nitro dot med dot uc dot edu  2010-09-02 15:21 -------
(In reply to comment #17)
> No idea if it is correct:
> 
> diff --git a/gcc/config/i386/i386.c b/gcc/config/i386/i386.c
> index b550d86..decfd65 100644
> --- a/gcc/config/i386/i386.c
> +++ b/gcc/config/i386/i386.c
> @@ -8121,6 +8121,7 @@ output_set_got (rtx dest, rtx label ATTRIBUTE_UNUSED)
>        if (dwarf2out_do_frame ())
>         {
>           rtx insn;
> +         dwarf2out_frame_debug (NULL_RTX, false);
>           start_sequence ();
>           insn = emit_barrier ();
>           end_sequence ();
> 

This change alone applied to r163600 just crashes the compiler.

/Users/howarth/darwin_objdir/gcc/xgcc -B/Users/howarth/darwin_objdir/gcc/ -c
./sprintf-chk.c -w -Os -lm -m32
./sprintf-chk.c: In function ‘test1’:
./sprintf-chk.c:77:1: internal compiler error: in dwarf2out_frame_debug, at
dwarf2out.c:2714


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[ebotcazou at gcc dot gnu dot org]

------- Comment #20 from ebotcazou at gcc dot gnu dot org  2010-09-02 15:27 -------
> It is very likely that the stack usage change triggers this bug.

Not clear what you mean by this exactly, but I can reproduce the valgrind error
with the revision 163629 compiler.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[jakub at gcc dot gnu dot org]

------- Comment #21 from jakub at gcc dot gnu dot org  2010-09-02 16:16 -------
Created an attachment (id=21670)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=21670&action=view)
gcc46-pr45484.patch

The last valgrind error is my fault, we don't need a BARRIER there, any
instruction that flushes the queued ones will do.
So, either we do something like in this patch, or dwarf2out.c would need to
record the size of barrier_args_size and for BARRIERs with higher INSN_UID just
use offset 0 (i.e. args_size before offset -= args_size;).  But the latter
would be more code and uglier.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[howarth at nitro dot med dot uc dot edu]

------- Comment #22 from howarth at nitro dot med dot uc dot edu  2010-09-02 17:39 -------
(In reply to comment #21)
> Created an attachment (id=21670)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=21670&action=view) [edit]
> gcc46-pr45484.patch
> 
... 

Jakub,
    Thanks. This patch when applied to r163660 on x86_64-apple-darwin10 appears
to
totally eliminate the ICEs which were occurring 50% of time previously.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[jakub at gcc dot gnu dot org]

------- Comment #23 from jakub at gcc dot gnu dot org  2010-09-03 14:47 -------
Subject: Bug 45484

Author: jakub
Date: Fri Sep  3 14:46:39 2010
New Revision: 163823

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=163823
Log:
        PR middle-end/45484
        * dwarf2out.c (flush_queued_reg_saves): Rename to...
        (dwarf2out_flush_queued_reg_saves): ... this.  No longer static.
        (dwarf2out_frame_debug_expr, dwarf2out_frame_debug): Adjust callers.
        * dwarf2out.h (dwarf2out_flush_queued_reg_saves): New prototype.
        * config/i386/i386.c (output_set_got): Call it.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/config/i386/i386.c
    trunk/gcc/dwarf2out.c
    trunk/gcc/dwarf2out.h


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[jakub at gcc dot gnu dot org]

------- Comment #24 from jakub at gcc dot gnu dot org  2010-09-03 14:50 -------
Subject: Bug 45484

Author: jakub
Date: Fri Sep  3 14:50:20 2010
New Revision: 163824

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=163824
Log:
        PR middle-end/45484
        * dwarf2out.c (flush_queued_reg_saves): Rename to...
        (dwarf2out_flush_queued_reg_saves): ... this.  No longer static.
        (dwarf2out_frame_debug): Adjust callers.
        * dwarf2out.h (dwarf2out_flush_queued_reg_saves): New prototype.
        * config/i386/i386.c (output_set_got): Call it.

Modified:
    branches/gcc-4_5-branch/gcc/ChangeLog
    branches/gcc-4_5-branch/gcc/config/i386/i386.c
    branches/gcc-4_5-branch/gcc/dwarf2out.c
    branches/gcc-4_5-branch/gcc/dwarf2out.h


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484

[Bug middle-end/45484] Invalid memory access in gcc.c-torture/execute/builtins/sprintf-chk.c

[howarth at nitro dot med dot uc dot edu]

------- Comment #25 from howarth at nitro dot med dot uc dot edu  2010-09-03 23:37 -------
Fixed at r163823.


-- 

howarth at nitro dot med dot uc dot edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45484