[Bug tree-optimization/103231] New: ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[Bug tree-optimization/103231] New: ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

            Bug ID: 103231
           Summary: ICE (nondeterministic) on valid code at -O1 on
                    x86_64-linux-gnu: Segmentation fault
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

Created attachment 51788
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51788&action=edit
reproducer

This one is flaky and very difficult to reduce (likely due to memory errors).
The reproducer is still quite large and hairy.

[658] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20211114 (experimental) [master r12-5239-ga8029add306] (GCC) 
[659] % 
[659] % gcctk -O0 -w small.c
[660] % 
[660] % gcctk -O1 -w small.c
[661] % gcctk -O1 -w small.c
[662] % gcctk -O1 -w small.c
gcctk: internal compiler error: Segmentation fault signal terminated program
cc1
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://gcc.gnu.org/bugs/> for instructions.
[663] %

Re: [Bug tree-optimization/103231] New: ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[Jan Hubicka]

> [659] % 
> [659] % gcctk -O0 -w small.c
> [660] % 
> [660] % gcctk -O1 -w small.c
> [661] % gcctk -O1 -w small.c
> [662] % gcctk -O1 -w small.c
> gcctk: internal compiler error: Segmentation fault signal terminated program
> cc1
> Please submit a full bug report,
> with preprocessed source if appropriate.
> See <https://gcc.gnu.org/bugs/> for instructions.
Backtrace here would be useful.  It is bit strange that you did not get
it from error message.  One can use -S -wrapper gdb,--args to make the
cc1 executed within gdb.
> [663] %

[Bug tree-optimization/103231] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[hubicka at kam dot mff.cuni.cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #1 from hubicka at kam dot mff.cuni.cz ---
> [659] % 
> [659] % gcctk -O0 -w small.c
> [660] % 
> [660] % gcctk -O1 -w small.c
> [661] % gcctk -O1 -w small.c
> [662] % gcctk -O1 -w small.c
> gcctk: internal compiler error: Segmentation fault signal terminated program
> cc1
> Please submit a full bug report,
> with preprocessed source if appropriate.
> See <https://gcc.gnu.org/bugs/> for instructions.
Backtrace here would be useful.  It is bit strange that you did not get
it from error message.  One can use -S -wrapper gdb,--args to make the
cc1 executed within gdb.
> [663] %

[Bug tree-optimization/103231] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |12.0
           Keywords|                            |ice-on-valid-code

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
You might want to try adding "--param ggc-min-expand=1 --param
ggc-min-heapsize=1", it might cause the ICE to be come deterministic.
There are a few other options including running cc1 under valgrind too.

[Bug tree-optimization/103231] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
   Last reconfirmed|                            |2021-11-14
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
I can reproduce it with ulimit -s 4096, having ulimit -s 8192 works.
BT is following:

#0  gimple_ranger::range_of_stmt (this=0x2ceda20, r=..., s=0x7ffff72e9800,
name=0x7ffff72ea1b0) at /home/marxin/Programming/gcc/gcc/gimple-range.cc:259
#1  0x0000000001bc1045 in gimple_ranger::range_on_entry (this=0x2ceda20, r=...,
bb=0x7ffff766db60, name=0x7ffff72ea1b0) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:141
#2  0x0000000001bc1b91 in gimple_ranger::range_of_expr (this=0x2ceda20, r=...,
expr=0x7ffff72ea1b0, stmt=<optimized out>) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:118
#3  0x0000000001bc128c in gimple_ranger::range_on_exit (this=0x2ceda20, r=...,
bb=0x7ffff766db60, name=0x7ffff72ea1b0) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:178
#4  0x0000000001bc1eee in gimple_ranger::range_on_edge (this=0x2ceda20, r=...,
e=<optimized out>, name=0x7ffff72ea1b0) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:222
#5  0x0000000001bc8818 in fur_stmt::get_phi_operand (this=<optimized out>,
r=..., expr=0x7ffff72ea1b0, e=0x7ffff77802d0) at
/home/marxin/Programming/gcc/gcc/gimple-range-fold.cc:167
#6  0x0000000001bca5cf in fold_using_range::range_of_phi (this=0x7fffffc034ef,
r=..., phi=0x7ffff72e9a00, src=...) at
/home/marxin/Programming/gcc/gcc/gimple-range-fold.cc:789
#7  0x0000000001bccea1 in fold_using_range::fold_stmt (this=0x7fffffc034ef,
r=..., s=0x7ffff72e9a00, src=..., name=0x7ffff72ea240) at
/home/marxin/Programming/gcc/gcc/gimple-range-fold.cc:554
#8  0x0000000001bc1457 in gimple_ranger::fold_range_internal
(this=this@entry=0x2ceda20, r=..., s=s@entry=0x7ffff72e9a00,
name=name@entry=0x7ffff72ea240) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:243
#9  0x0000000001bc1707 in gimple_ranger::range_of_stmt (this=0x2ceda20, r=...,
s=0x7ffff72e9a00, name=0x7ffff72ea240) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:296

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-5014-g6b8b959675a3e14c.

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Simplified test-case:

cat pr103231.c
void BHbHb2l_1912();

int a;
int bs;
long g_1496_BK8K8el_2738;
long fn1_l_1522;
int fn1_l_1708;
int fn1_l_2085;
int fn1_l_2664;
int fn1_bv;
int fn1_l_2354;
int fn1_l_2188;
long fn1_bx;
int fn1_BHbHb1l_2637;
long fn1_l_2756;
void fn1() {
  long l_1761;
  unsigned l_1552, l_1810, l_1812, bw;
  int l_2189, by, l_2688;
  short l_1852;
  short l_1912;
  short l_2108;
  short l_2126;
  short l_2352;
  unsigned l_2456;
LABEL_5959g:
  __builtin_printf("l_2456=%llu\n", l_2456);
  if (l_1812)
  ca:
    if (a) goto LABEL_IbIbjc;
  if (fn1_l_2188) {
    if (fn1_l_2756 && fn1_l_2188 <= 7)
    LABEL_TaTak:
      if (l_2352) goto LABEL_6969u;
    if (by) {
    LABEL_6969u:
      if (l_2189)
        ;
      if (l_1912) goto LABEL_5959g;
    n:
      int BK8K8hl_2189 = l_2352 * (~l_1852 & g_1496_BK8K8el_2738);
      if (l_2126) {
        int B6666pl_2365 =
            fn1_bx / ~(l_1552 || fn1_l_2354 % l_2108 & fn1_l_2664);
        if (fn1_l_2354) bw = B6666pl_2365 || l_1912;
        short dg = ~(l_2456 & l_1761),
              dh = (l_1912 & by | fn1_l_2756) * BK8K8hl_2189 | dg;
        if (bs) {
          l_1912 = dh * dg;
          if (l_1810) {
            if (fn1_l_2085) goto LABEL_m9m9J;
            goto q;
          }
        }
        l_2456 = dh;
        if (fn1_l_1522) goto n;
        l_1761 = ~BK8K8hl_2189;
        long dl = l_1761 ^ (l_2108 | bw ^ ~fn1_l_2354);
      t:
        l_2108 = (l_2108 && l_1812 && l_2126) - ~0;
        int w = -~0 ^ -l_1552 * ((dl || by) >> fn1_l_2188);
        l_1552 = w;
        if (fn1_l_1522) {
          int x = l_2688 | fn1_l_1708 & l_1552;
          short BHbHbZg_5 = (l_1810 | a) & l_1852;
          if (a)
          y:
            l_2688 = -(fn1_l_1522 & (x ^ BHbHbZg_5));
          l_1810 = x;
          BHbHb2l_1912(fn1_l_1522 && fn1_l_2188 && fn1_BHbHb1l_2637);
        }
        if (0)
          ;
        if (l_1812) goto ca;
      }
      short Bm9m9El_1852 = ~(~0 && l_2688);
      unsigned Bm9m9Fl_1522 = -Bm9m9El_1852;
      if (l_1812)
      LABEL_m9m9J:
        l_1852 = ~fn1_l_2664 ^ Bm9m9Fl_1522;
      long B97976l_1761 = ~fn1_bv ^ (l_1552 && l_2108);
      if (fn1_bv)
      q:
        l_2126 = ~(B97976l_1761 ^ a) / fn1_l_2354 / l_1761;
      if (by) goto LABEL_TaTak;
      if (l_1810) goto y;
      goto t;
    }
  }
LABEL_IbIbjc:
}

one needs ulimit -s 4096 in order to reproduce it.

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #6 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
(In reply to Martin Liška from comment #5)
> Simplified test-case:

Oh, great; thanks, Martin!

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amacleod at redhat dot com,
                   |                            |law at gcc dot gnu.org

--- Comment #7 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
This looks like a ranger proper issue, as the strlen pass is just a simple
client, not a crazy ass abuser like the threader passes :).

Jeff reported pretty much an identical backtrace while building the aarch64
kernel.

Andrew, this testcase may save you the hassle of dealing with an aarch64 cross.

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #8 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Created attachment 51789
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51789&action=edit
similar problem on aarch64 kernel

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #9 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
A very simple repro (with ulimit -s 32):

[530] % compile.sh small.c
*** Compiling with: gcctk -O1 small.c
gcctk: internal compiler error: Segmentation fault signal terminated program
cc1
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://gcc.gnu.org/bugs/> for instructions.

*** Compiling with: gcc110 -O1 small.c
[531] % 
[531] % cat small.c
int a, b;
int main() {
  int c, d;
L1:
  if (a) {
    __builtin_printf("%d", d);
  L2:
    goto L1;
  }
  if (b) {
    d = c;
    goto L2;
  }
  return 0;
}
[532] % 
[532] % cat compile.sh
#!/bin/bash

ulimit -s 32

echo "*** Compiling with: gcctk -O1 $1"
gcctk -O1 $1

echo

echo "*** Compiling with: gcc110 -O1 $1"
gcc110 -O1 $1
[533] %

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #10 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Zhendong Su from comment #9)
> A very simple repro (with ulimit -s 32):

Well, using a stack limit of 32B does not make sense, pretty much any
executable hits stack overflow with such a small limit.

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #11 from Martin Liška <marxin at gcc dot gnu.org> ---
But yes, with ulimit -s 512, one can reduce it to:

$ cat pr103231.c
long g_1496_BK8K8el_2738;
int fn1_l_1522;
int fn1_l_2664;
long fn1_l_1761;
unsigned int fn1_l_1812;
int fn1_l_2189;
int fn1_by;
int fn1_l_2688;
short fn1_l_1852;
short fn1_l_2352;
void fn1() {
  unsigned l_2456;
LABEL_5959g:
  __builtin_printf("l_2456=%llu\n", l_2456);
LABEL_TaTak:
  if (fn1_by)
    if (fn1_l_2189) goto LABEL_5959g;
  int BK8K8hl_2189 = fn1_l_2352 * (~fn1_l_1852 & g_1496_BK8K8el_2738);
  short dg = l_2456 & fn1_l_1761;
  l_2456 = dg;
  if (fn1_l_1522) fn1_l_1761 = ~BK8K8hl_2189;
  short Bm9m9El_1852 = ~(~0 && fn1_l_2688);
  unsigned Bm9m9Fl_1522 = -Bm9m9El_1852;
  if (fn1_l_1812) fn1_l_1852 = ~fn1_l_2664 ^ Bm9m9Fl_1522;
  goto LABEL_TaTak;
}

with the following back-trace:

#0  0x0000000001218987 in range_query::get_tree_range (this=0x7fffffffd4a0,
r=..., expr=0x7ffff76200d8, stmt=<optimized out>) at
/home/marxin/Programming/gcc/gcc/value-query.cc:213
#1  0x0000000001bcb812 in fold_using_range::range_of_range_op
(this=0x7ffffff8396f, r=..., s=0x7ffff776c108, src=...) at
/home/marxin/Programming/gcc/gcc/gimple-range-fold.cc:617
#2  0x0000000001bcce12 in fold_using_range::fold_stmt (this=0x7ffffff8396f,
r=..., s=0x7ffff776c108, src=..., name=0x7ffff776b360) at
/home/marxin/Programming/gcc/gcc/gimple-range-fold.cc:552
#3  0x0000000001bc14a7 in gimple_ranger::fold_range_internal
(this=this@entry=0x7fffffffd4a0, r=..., s=s@entry=0x7ffff776c108,
name=name@entry=0x7ffff776b360) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:243
#4  0x0000000001bc1757 in gimple_ranger::range_of_stmt (this=0x7fffffffd4a0,
r=..., s=0x7ffff776c108, name=0x7ffff776b360) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:296
#5  0x0000000001bc1dc0 in gimple_ranger::range_of_expr (this=0x7fffffffd4a0,
r=..., expr=0x7ffff776b360, stmt=<optimized out>) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:113
#6  0x0000000001bcb7e0 in fold_using_range::range_of_range_op
(this=0x7ffffff87c4f, r=..., s=0x7ffff776d140, src=...) at
/home/marxin/Programming/gcc/gcc/gimple-range-fold.cc:600
#7  0x0000000001bcce12 in fold_using_range::fold_stmt (this=0x7ffffff87c4f,
r=..., s=0x7ffff776d140, src=..., name=0x7ffff776b3a8) at
/home/marxin/Programming/gcc/gcc/gimple-range-fold.cc:552
#8  0x0000000001bc14a7 in gimple_ranger::fold_range_internal
(this=this@entry=0x7fffffffd4a0, r=..., s=s@entry=0x7ffff776d140,
name=name@entry=0x7ffff776b3a8) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:243
...
#164 0x0000000001bc1757 in gimple_ranger::range_of_stmt (this=0x7fffffffd4a0,
r=..., s=0x7ffff773f500, name=0x7ffff776b708) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:296
#165 0x0000000001bc1dc0 in gimple_ranger::range_of_expr (this=0x7fffffffd4a0,
r=..., expr=0x7ffff776b708, stmt=<optimized out>) at
/home/marxin/Programming/gcc/gcc/gimple-range.cc:113
#166 0x0000000001bfec29 in (anonymous namespace)::format_integer (dir=...,
arg=0x7ffff776b708, query=0x7fffffffd4a0) at
/home/marxin/Programming/gcc/gcc/gimple-ssa-sprintf.c:1386
#167 0x0000000001bf8de4 in (anonymous namespace)::format_directive (info=...,
res=0x7fffffffcf80, dir=..., query=<optimized out>) at
/home/marxin/Programming/gcc/gcc/gimple-ssa-sprintf.c:3091
#168 0x0000000001bfc092 in (anonymous namespace)::compute_format_length
(query=0x7fffffffd4a0, res=0x7fffffffcf80, info=...) at
/home/marxin/Programming/gcc/gcc/gimple-ssa-sprintf.c:4033
#169 handle_printf_call (gsi=gsi@entry=0x7fffffffd880, ptr_qry=...) at
/home/marxin/Programming/gcc/gcc/gimple-ssa-sprintf.c:4703
#170 0x000000000112a8de in strlen_pass::check_and_optimize_call
(this=0x7fffffffd480, zero_write=0x7fffffffd28f) at
/home/marxin/Programming/gcc/gcc/tree-ssa-strlen.c:5379
#171 0x000000000112b592 in strlen_pass::check_and_optimize_stmt
(this=0x7fffffffd480, cleanup_eh=<optimized out>) at
/home/marxin/Programming/gcc/gcc/tree-ssa-strlen.c:5583
#172 0x000000000112b9d6 in strlen_pass::before_dom_children
(this=0x7fffffffd480, bb=0x7ffff760d270) at
/home/marxin/Programming/gcc/gcc/tree-ssa-strlen.c:5767
#173 0x0000000001b8de48 in dom_walker::walk (this=0x7fffffffd480,
bb=0x7ffff760d270) at /home/marxin/Programming/gcc/gcc/domwalk.c:309
#174 0x000000000112befb in (anonymous namespace)::printf_strlen_execute
(fun=0x7ffff7764000, warn_only=<optimized out>) at
/home/marxin/Programming/gcc/gcc/tree-ssa-strlen.c:5831
#175 0x0000000000e2effa in execute_one_pass (pass=0x2a1a250) at
/home/marxin/Programming/gcc/gcc/passes.c:2567
#176 0x0000000000e2f8f3 in execute_pass_list_1 (pass=0x2a1a250) at
/home/marxin/Programming/gcc/gcc/passes.c:2656
#177 0x0000000000e2f905 in execute_pass_list_1 (pass=0x2a17cc0) at
/home/marxin/Programming/gcc/gcc/passes.c:2657
#178 0x0000000000e2f936 in execute_pass_list (fn=0x7ffff7764000,
pass=<optimized out>) at /home/marxin/Programming/gcc/gcc/passes.c:2667
#179 0x0000000000a73975 in cgraph_node::expand (this=0x7ffff7616220) at
/home/marxin/Programming/gcc/gcc/context.h:48
#180 cgraph_node::expand (this=0x7ffff7616220) at
/home/marxin/Programming/gcc/gcc/cgraphunit.c:1781
#181 0x0000000000a74fef in expand_all_functions () at
/home/marxin/Programming/gcc/gcc/cgraphunit.c:1992
#182 symbol_table::compile (this=0x7ffff7605000) at
/home/marxin/Programming/gcc/gcc/cgraphunit.c:2356
#183 symbol_table::compile (this=0x7ffff7605000) at
/home/marxin/Programming/gcc/gcc/cgraphunit.c:2267
#184 0x0000000000a77c58 in symbol_table::finalize_compilation_unit
(this=0x7ffff7605000) at /home/marxin/Programming/gcc/gcc/cgraphunit.c:2537
#185 0x0000000000f1e662 in compile_file () at
/home/marxin/Programming/gcc/gcc/toplev.c:479
#186 0x00000000008b969b in do_compile (no_backend=false) at
/home/marxin/Programming/gcc/gcc/toplev.c:2156
#187 toplev::main (this=this@entry=0x7fffffffdb9e, argc=<optimized out>,
argc@entry=14, argv=<optimized out>, argv@entry=0x7fffffffdce8) at
/home/marxin/Programming/gcc/gcc/toplev.c:2308
#188 0x00000000008bb615 in main (argc=14, argv=0x7fffffffdce8) at
/home/marxin/Programming/gcc/gcc/main.c:39

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic/stack overflow) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Target Milestone|---                         |12.0

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic/stack overflow) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #12 from Andrew Macleod <amacleod at redhat dot com> ---
Yes, ranger can currently create some very deep call chains, especially as it
evaluates values around back edges.

A general query on a stmt first checks if all the operands have been resolved,
and if they have not been, spawns another query to resolve the answer.  If we
do this along a back edge, we get into another basic block which has not been
processed at all, so every operand spawns another request and the stack gets
deeper and deeper until it reaches a stmt that can be resolved.. then it
unwinds with all the answers, folding and setting ranges as it goes.

Note that each one of the query steps can involves 4 or 5 functions calls as we
look at the kind of stmt, and process it, then get values on edges, etc etc. 
so each "depth" of query can be up to 5 function calls.

I have analyzed the call patterns and have a solution I am working on now that 
almost completely flattens the call chains to satisfy the dependency
resolution.

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic/stack overflow) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:5deacf6058d1bc7261a75c9fd1f116c4442e9e60

commit r12-5505-g5deacf6058d1bc7261a75c9fd1f116c4442e9e60
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Mon Nov 22 14:39:41 2021 -0500

    Directly resolve range_of_stmt dependencies.

    All ranger API entries eventually call range_of_stmt to ensure there is an
    initial global value to work with.  This can cause very deep call chains
when
    satisfied via the normal API.  Instead, push any dependencies onto a stack
    and evaluate them in a depth first manner, mirroring what would have
happened
    via the normal API calls.

            PR tree-optimization/103231
            gcc/
            * gimple-range.cc (gimple_ranger::gimple_ranger): Create stmt
stack.
            (gimple_ranger::gimple_ranger): Delete stmt stack.
            (gimple_ranger::range_of_stmt): Process depenedencies if they have
no
            global cache entry.
            (gimple_ranger::prefill_name): New.
            (gimple_ranger::prefill_stmt_dependencies): New.
            * gimple-range.h (class gimple_ranger): Add prototypes.

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic/stack overflow) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

Andrew Macleod <amacleod at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #14 from Andrew Macleod <amacleod at redhat dot com> ---
Should be fixed.

[Bug tree-optimization/103231] [12 Regression] ICE (nondeterministic/stack overflow) on valid code at -O1 on x86_64-linux-gnu: Segmentation fault since r12-5014-g6b8b959675a3e14c

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103231

--- Comment #15 from Jeffrey A. Law <law at gcc dot gnu.org> ---
And a note, aarch64_be successfully built a linux kernel which had previously
been triggering the same crazy deep call chains.