[Bug ipa/102557] New: [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access)

[Bug ipa/102557] New: [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

            Bug ID: 102557
           Summary: [12 Regression] ICE: Segmentation fault signal
                    terminated program cc1plus (indefinite recursion in
                    modref_ref_node<int>::insert_access)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

Created attachment 51533
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51533&action=edit
Testcase

g++-12.0.0-alpha20210926 snapshot (g:fe2771b291c2c7c0ac37b75ec5b160937524b60c)
ICEs when compiling the attached testcase, reduced from
libstdc++-v3/testsuite/22_locale/time_get/get_monthname/char/6.cc, w/ -O3
--param max-inline-insns-single=2 --param modref-max-accesses=2:

% g++-12.0.0 -O3 --param max-inline-insns-single=2 --param
modref-max-accesses=2 -c xv7snbwu.cc
g++-12.0.0: internal compiler error: Segmentation fault signal terminated
program cc1plus

(gdb) where
#0  0x0000000000f345c7 in modref_access_node::merge
(this=this@entry=0x7ffff77533f8, a=...,
    record_adjustments=record_adjustments@entry=false)
    at
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20210926/work/gcc-12-20210926/gcc/ipa-modref-tree.h:204
#1  0x0000000000f35235 in modref_access_node::forced_merge
(this=0x7ffff77533f8, a=..., record_adjustments=<optimized out>)
    at
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20210926/work/gcc-12-20210926/gcc/ipa-modref-tree.h:351
#2  0x0000000000f39654 in modref_ref_node<int>::insert_access
(this=this@entry=0x7ffff7732f00, a=...,
    max_accesses=max_accesses@entry=2,
record_adjustments=record_adjustments@entry=false)
    at
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20210926/work/gcc-12-20210926/gcc/ipa-modref-tree.h:575
#3  0x0000000000f397de in modref_ref_node<int>::insert_access
(this=this@entry=0x7ffff7732f00, a=...,
    max_accesses=max_accesses@entry=2,
record_adjustments=record_adjustments@entry=false)
    at
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20210926/work/gcc-12-20210926/gcc/ipa-modref-tree.h:596

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

--- Comment #1 from Arseny Solokha <asolokha at gmx dot com> ---
Semi-reduced testcase for the reference:

#include <sstream>

void
test01 (char *mname)
{
  std::istringstream iss;

  iss.str (mname);
  iss.str (mname);
}

% g++-12.0.0 -std=c++20 -O3 -fopenacc --param max-inline-insns-single=2 --param
modref-max-accesses=2 --param uninlined-function-time=999998 -c ujd9xqvr.cc
g++-12.0.0: internal compiler error: Segmentation fault signal terminated
program cc1plus

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
            Summary|[12 Regression] ICE:        |[12 Regression] ICE:
                   |Segmentation fault signal   |Segmentation fault signal
                   |terminated program cc1plus  |terminated program cc1plus
                   |(indefinite recursion in    |(indefinite recursion in
                   |modref_ref_node<int>::inser |modref_ref_node<int>::inser
                   |t_access)                   |t_access) since
                   |                            |r12-3202-gf5ff3a8ed4ca9173
   Last reconfirmed|                            |2021-10-01
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-3202-gf5ff3a8ed4ca9173.
I can try taking a look.

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|marxin at gcc dot gnu.org          |unassigned at gcc dot gnu.org

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
I'm not familiar enough with the code, leaving to Honza.

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
It is caused by broken early exit while updating the access range which makes
insert_access to get into infinite recursion (trying to free space to add extra
item)
gcc/ChangeLog:

        PR ipa/102557
        * ipa-modref-tree.h (modref_access_node::update): Fix early
        exit conditional.
        (modref_ref_node::insert_access): Sanity check that mergin
        suceeded.

diff --git a/gcc/ipa-modref-tree.h b/gcc/ipa-modref-tree.h
index 8e9b89b3e2c..52f225b1aae 100644
--- a/gcc/ipa-modref-tree.h
+++ b/gcc/ipa-modref-tree.h
@@ -148,7 +148,8 @@ struct GTY(()) modref_access_node
               poly_int64 offset1, poly_int64 size1, poly_int64 max_size1,
               bool record_adjustments)
     {
-      if (known_eq (offset, offset1)
+      if (known_eq (parm_offset, parm_offset1)
+         && known_eq (offset, offset1)
          && known_eq (size, size1)
          && known_eq (max_size, max_size1))
        return;
@@ -577,6 +578,10 @@ struct GTY((user)) modref_ref_node
          }
        (*accesses)[best1].forced_merge (best2 < 0 ? a : (*accesses)[best2],
                                         record_adjustments);
+       /* Check that merging indeed merged ranges.  */
+       gcc_checking_assert ((*accesses)[best1].contains (best2 < 0 ? a :
(*accesses)[best2]));
+       /*if (best2 >= 0)
+         accesses->unordered_remove (best2);*/
        if (!(*accesses)[best1].useful_p ())
          {
            collapse ();

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jan Hubicka <hubicka@gcc.gnu.org>:

https://gcc.gnu.org/g:fecd145359fc981beb2802f746190227c5cc010a

commit r12-4401-gfecd145359fc981beb2802f746190227c5cc010a
Author: Jan Hubicka <hubicka@ucw.cz>
Date:   Thu Oct 14 15:48:01 2021 +0200

    Fix ICE in insert_access.

    gcc/ChangeLog:

            PR ipa/102557
            * ipa-modref-tree.h (modref_access_node::update2):
            Also check that parm_offset is unchanged.
            (modref_ref_node::insert_access): Fix updating of
            parameter.

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
Can we close it as fixed now?

[Bug ipa/102557] [12 Regression] ICE: Segmentation fault signal terminated program cc1plus (indefinite recursion in modref_ref_node<int>::insert_access) since r12-3202-gf5ff3a8ed4ca9173

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102557

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed.