[Bug tree-optimization/102560] New: [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[Bug tree-optimization/102560] New: [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

            Bug ID: 102560
           Summary: [12 Regression] g++.dg/Walloca1.C ICE with aggressive
                    GC
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: GC, ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jason at gcc dot gnu.org
  Target Milestone: ---

When I run make check-g++-strict-gc, which adds the flags

  --param ggc-min-heapsize=0 --param ggc-min-expand=0

the compiler ICEs in Walloca1.C with

wa.ii: In function ‘void __static_initialization_and_destruction_0(int, int)’:
wa.ii:7:52: internal compiler error: Segmentation fault
    7 | char *b = static_cast<char *>(__builtin_alloca (a));
      |                                                    ^
0x176fa90 crash_signal
        /home/jason/gt/gcc/toplev.c:331
0xacb5b2 contains_struct_check(tree_node const*, tree_node_structure_enum, char
const*, int, char const*)
        /home/jason/gt/gcc/tree.h:3802
0xb64c70 wi::to_wide(tree_node const*)
        /home/jason/gt/gcc/tree.h:6092
0x1bf0ce6 irange::irange_intersect(irange const&)
        /home/jason/gt/gcc/value-range.cc:1684
0x1bf01fa irange::intersect(irange const*)
        /home/jason/gt/gcc/value-range.cc:1514
0x1bea82b irange::intersect(irange const&)
        /home/jason/gt/gcc/value-range.h:549
0x2bdd28d alloca_call_type
        /home/jason/gt/gcc/gimple-ssa-warn-alloca.c:229
0x2bdd574 pass_walloca::execute(function*)
        /home/jason/gt/gcc/gimple-ssa-warn-alloca.c:293

I don't get the same crash with my GCC 11 branch compiler.

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com
   Target Milestone|---                         |12.0

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-10-02
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
confirmed

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Going up the backtrace we see:

(gdb) 
#3  0x0000000001b43aff in irange::intersect (this=0x7fffffffc8e0, 
    other=0x3c7aa40 <alloca_call_type(gimple*, bool)::invalid_range>)
    at /home/aldyh/src/gcc/gcc/value-range.cc:1514
(gdb) 
#4  0x0000000001b3e1e8 in irange::intersect (this=0x7fffffffc8e0, r=...)
    at /home/aldyh/src/gcc/gcc/value-range.h:549
(gdb) 
#5  0x0000000002a78c33 in alloca_call_type (stmt=<gimple_call 0x7fffea151240>,
is_vla=false)
    at /home/aldyh/src/gcc/gcc/gimple-ssa-warn-alloca.c:229

We're intersecting with invalid_range which is a static member:

  static int_range<2> invalid_range (build_int_cst (size_type_node, 0),
                                         build_int_cst (size_type_node,
                                                        max_size),
                                         VR_ANTI_RANGE);

It looks like it has members that have been GC freed:

(gdb) print invalid_range
$9 = {<irange> = {m_num_ranges = 1 '\001', m_max_ranges = 2 '\002', m_kind =
VR_RANGE, 
    m_base = 0x3c7aa50 <alloca_call_type(gimple*, bool)::invalid_range+16>},
m_ranges = {
    <ggc_freed 0x7fffea157b88>, <integer_cst 0x7fffe9fe2620>, <tree 0x0>, <tree
0x0>}}
(gdb) 

The m_ranges bits are trees in int_range<N>, which live in GC, and trees are
inherently GC'ish.

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Probably needs GTY markers, and possibly putting it invalid_range in file
scope.

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Created attachment 51540
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51540&action=edit
patch in testing

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
+      int_range<2> invalid_range (build_int_cst (size_type_node, 0),
+                                 build_int_cst (size_type_node, max_size),

       r.intersect (invalid_range);

is there no way to .intersect with a wide_int instead?

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

--- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #5)
> +      int_range<2> invalid_range (build_int_cst (size_type_node, 0),
> +                                 build_int_cst (size_type_node, max_size),
> 
>        r.intersect (invalid_range);
> 
> is there no way to .intersect with a wide_int instead?

Patch is posted upstream, so you can respond there.

But no, the intersect() method is from irange to irange.  I suppose when we get
rid of trees and go back to faster wide-ints for the internal representation,
we could add such a method.

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:fa3ccf8bfe9940b439d6cc2c38ee8da134b0ff2d

commit r12-4139-gfa3ccf8bfe9940b439d6cc2c38ee8da134b0ff2d
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Sun Oct 3 19:42:10 2021 +0200

    Remove static marker for range in alloca pass.

    The m_ranges[] field in int_range<N> are trees, so they live in GC
    space.  Since invalid_range is static, it must be marked with GTY
    magic.  However, calculating invalid_range is not particularly slow,
    or on a critical path, so we can just put it in local scope and
    recalculate every time.

    Tested on x86-64 Linux.

    gcc/ChangeLog:

            PR tree-optimization/102560
            * gimple-ssa-warn-alloca.c (alloca_call_type): Remove static
            marker for invalid_range.

    gcc/testsuite/ChangeLog:

            * g++.dg/Walloca2.C: New test.

[Bug tree-optimization/102560] [12 Regression] g++.dg/Walloca1.C ICE with aggressive GC

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
fixed