[Bug analyzer/107711] New: internal compiler error: Segmentation fault

[Bug analyzer/107711] New: internal compiler error: Segmentation fault

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

            Bug ID: 107711
           Summary: internal compiler error: Segmentation fault
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: urs at akk dot org
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu
             Build: x86_64-pc-linux-gnu

Created attachment 53904
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53904&action=edit
internal compiler error: Segmentation fault

gcc build from git @ 6052482f841634522c6d2e56c4231f8df2dc6d3e
with
configure --program-suffix=-13 --enable-languages=c,lto --enable-lto
--disable-multilib
make -j 4 BOOT_CFLAGS='-pipe -O0 -w' bootstrap

on x86_64-pc-linux-gnu (Intel(R) Core(TM) i7-6700T); Ubuntu 22.04.1 LTS; GLIBC
2.35-0ubuntu3.1

gcc-13 -I. -I../include -DHAVE_CONFIG_H -DDEBUG -g -std=c11 -O2 -Wextra
-Wpedantic -Wall -Winline -Wshadow -Wstrict-prototypes -Wmissing-prototypes
-Wmissing-declarations -Wbad-function-cast -Wnested-externs -Wcast-align
-Wpointer-arith -Waggregate-return -Wcast-qual -Wwrite-strings -Wundef -Wpacked
-Wfloat-equal -Wunused-macros -Wold-style-definition -Winit-self
-Wmissing-include-dirs -Wlogical-op -Wjump-misses-init -Wformat=2
-Wshift-overflow=2 -Wnull-dereference -Wduplicated-cond -Walloc-zero -Walloca
-Wstringop-overflow=2 -Wduplicated-branches -Wno-format-nonliteral
-Wno-stringop-truncation -Wno-format-truncation -fanalyzer -o makecfg 
./makecfg.c

results in

./makecfg.c: At top level:
./makecfg.c:552:1: internal compiler error: Segmentation fault
  552 | }
      | ^
0x7feba1f0151f ???
        ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7feba1ee8d8f __libc_start_call_main
        ../sysdeps/nptl/libc_start_call_main.h:58
0x7feba1ee8e3f __libc_start_main_impl
        ../csu/libc-start.c:392
Please submit a full bug report, with preprocessed source (by using
-freport-bug).

I can't see the issue with additional "-v -save-temps -freport-bug" or without
"-fanalyzer".

[Bug analyzer/107711] internal compiler error: Segmentation fault

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug report.

Unfortunately I can't reproduce the ICE with the attachment.

I have a suspicion that this relates to commits r13-4073-gd8aba860b34203 and/or
r13-4074-g86a90006864840 and that it relates to accessing preprocessor macros
for named constants relating to file descriptors.

To confirm this hypothesis, does the crash go away if you first use -E to run
the preprocessor on its own, and then use -fanalyzer on the preprocessed
source? (with the same other options as before)

(I'd hoped that we could look at the analyzer dump file to confirm this, but
unfortunately the code in question runs before the analyzer's logging code
starts up)

[Bug analyzer/107711] internal compiler error: Segmentation fault

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #2 from urs at akk dot org ---
On Wed, Nov 16, 2022 at 02:41:40PM +0000, dmalcolm at gcc dot gnu.org wrote:
> Unfortunately I can't reproduce the ICE with the attachment.

Yes, attachment was created with "-v -save-temps -freport-bug" and with that
the crash doesn't show up.

Plain source is
<https://salsa.debian.org/md/tin/-/blob/master/src/makecfg.c>
but it needs a few makros like FreeIfNeeded from
<https://salsa.debian.org/md/tin/-/blob/master/include/tin.h>
which needs autoconf.h ... and so on

> I have a suspicion that this relates to commits r13-4073-gd8aba860b34203 and/or
> r13-4074-g86a90006864840 and that it relates to accessing preprocessor macros
> for named constants relating to file descriptors.
> 
> To confirm this hypothesis, does the crash go away if you first use -E to run
> the preprocessor on its own, and then use -fanalyzer on the preprocessed
> source? (with the same other options as before)

gcc-13 -E -I. -I../include -DHAVE_CONFIG_H -DDEBUG -o makecfg.i ./makecfg.c
gcc-13 -g -std=c11 -O2 -Wextra -Wpedantic -Wall -Winline -Wshadow
-Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations
-Wbad-function-cast -Wnested-externs -Wcast-align -Wpointer-arith
-Waggregate-return -Wcast-qual -Wwrite-strings -Wundef -Wpacked -Wfloat-equal
-Wunused-macros -Wold-style-definition -Winit-self -Wmissing-include-dirs
-Wlogical-op -Wjump-misses-init -Wformat=2 -Wshift-overflow=2
-Wnull-dereference -Wduplicated-cond -Walloc-zero -Walloca
-Wstringop-overflow=2 -Wduplicated-branches -Wno-format-nonliteral
-Wno-stringop-truncation -Wno-format-truncation -fanalyzer -o makecfg
./makecfg.i

works fine (, but then make fails on the next input file, again on the last
curly brace in the file):

compiling heapsort.o
./heapsort.c:187:1: internal compiler error: Segmentation fault
  187 | }
      | ^
0x7fd658e6251f ???
        ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7fd658e49d8f __libc_start_call_main
        ../sysdeps/nptl/libc_start_call_main.h:58
0x7fd658e49e3f __libc_start_main_impl
        ../csu/libc-start.c:392


niko% wc -l makecfg.c heapsort.c 
  552 makecfg.c
  188 heapsort.c

HTH,
urs

[Bug analyzer/107711] internal compiler error: Segmentation fault

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Created attachment 53911
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53911&action=edit
Work-in-progress patch to add logging to ana::on_finish_translation_unit

[Bug analyzer/107711] internal compiler error: Segmentation fault

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
(In reply to urs from comment #2)
> On Wed, Nov 16, 2022 at 02:41:40PM +0000, dmalcolm at gcc dot gnu.org wrote:
> > Unfortunately I can't reproduce the ICE with the attachment.
> 
> Yes, attachment was created with "-v -save-temps -freport-bug" and with that
> the crash doesn't show up.

Thanks!

That seems to confirm my suspicion about what's crashing.

I think it's crashing when the analyzer asks the C frontend for the value of
one of these names:
  O_ACCMODE
  O_RDONLY
  O_WRONLY
  SOCK_STREAM
  SOCK_DGRAM
but it's not clear to me how that could fail.

It would be good to know which name it's failing on, and how it's
defined/declared in your headers.

If you're familiar with gdb, would you be able to reproduce the crasher under
gdb, by adding:
  -wrapper gdb,--args
to the crashing gcc invocation, and getting a backtrace at the point of the
crash.

Otherwise, would you be able to try rebuilding gcc with attachment 53911, and
then use -fdump-analyzer, which with that patch ought to dump which name it's
failing on (the dump is written to SOURCEFILE.analyzer.txt).

Sorry about this.

[Bug analyzer/107711] internal compiler error: Segmentation fault

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #5 from urs at akk dot org ---
On Wed, Nov 16, 2022 at 03:54:54PM +0000, dmalcolm at gcc dot gnu.org wrote:
> If you're familiar with gdb, would you be able to reproduce the crasher under
> gdb, by adding:
>   -wrapper gdb,--args
> to the crashing gcc invocation, and getting a backtrace at the point of the
> crash.

Program received signal SIGSEGV, Segmentation fault.
0x0000000000cf0871 in LINEMAPS_USED(line_maps const*, bool) ()
(gdb) bt
#0  0x0000000000cf0871 in LINEMAPS_USED(line_maps const*, bool) ()
#1  0x0000000002e50aa3 in LINEMAPS_MACRO_USED(line_maps const*) ()
#2  0x0000000002e50adc in LINEMAPS_MACRO_LOWEST_LOCATION(line_maps const*) ()
#3  0x0000000002e7cd2e in linemap_location_from_macro_expansion_p(line_maps
const*, unsigned int) ()
#4  0x0000000002e7c49d in linemap_lookup(line_maps const*, unsigned int) ()
#5  0x0000000002e7f752 in _cpp_warn_if_unused_macro ()
#6  0x0000000002e8a46d in ht_forall(ht*, int (*)(cpp_reader*, ht_identifier*,
void const*), void const*) ()
#7  0x0000000002e6d9e6 in cpp_forall_identifiers(cpp_reader*, int
(*)(cpp_reader*, cpp_hashnode*, void*), void*) ()
#8  0x0000000002e6f1b2 in cpp_finish(cpp_reader*, _IO_FILE*) ()
#9  0x0000000000d26427 in c_common_finish() ()
#10 0x000000000151a5f5 in finalize(bool) ()
#11 0x000000000151a966 in do_compile(bool) ()
#12 0x000000000151ad0e in toplev::main(int, char**) ()
#13 0x0000000002dded3e in main ()

> Otherwise, would you be able to try rebuilding gcc with attachment 53911, and
> then use -fdump-analyzer, which with that patch ought to dump which name it's
> failing on (the dump is written to SOURCEFILE.analyzer.txt).

See attachment

[Bug analyzer/107711] internal compiler error: Segmentation fault

[urs at akk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #6 from urs at akk dot org ---
Created attachment 53913
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53913&action=edit
head of fanalyzer-dump with patch from 53911

[Bug analyzer/107711] ICE with -fanalyzer with -Wunused-macros since r13-4073-gd8aba860b34203

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|internal compiler error:    |ICE with -fanalyzer with
                   |Segmentation fault          |-Wunused-macros since
                   |                            |r13-4073-gd8aba860b34203
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2022-11-16
     Ever confirmed|0                           |1

--- Comment #7 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks!  That's really helpful; I can reproduce it now, using just:

  gcc/testsuite/gcc.dg/analyzer/named-constants-via-macros.c

with:

  -fanalyzer -Wunused-macros

Presumably started with r13-4073-gd8aba860b34203.

Debugging it now...

[Bug analyzer/107711] [13 Regression] ICE with "-fanalyzer -Wunused-macros" since r13-4073-gd8aba860b34203

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:6e4962810fe5de95b807d1ac675df45a725e31a2

commit r13-4114-g6e4962810fe5de95b807d1ac675df45a725e31a2
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Nov 16 17:38:24 2022 -0500

    analyzer: log the stashing of named constants [PR107711]

    PR analyzer/107711 seems to be a bug in how named constants are looked up
    by the analyzer in the C frontend.

    To help debug this, this patch extends -fdump-analyzer and
    -fdump-analyzer-stderr so that they dump this part of the analyzer's
    startup.

    gcc/analyzer/ChangeLog:
            PR analyzer/107711
            * analyzer-language.cc: Include "diagnostic.h".
            (maybe_stash_named_constant): Add logger param and use it to log
            the name being looked up, and the result.
            (stash_named_constants): New, splitting out from...
            (on_finish_translation_unit): ...this function.  Call
            get_or_create_logfile and use the result to create a logger
            instance, passing it to stash_named_constants.
            * analyzer.h (get_or_create_any_logfile): New decl.
            * engine.cc (dump_fout, owns_dump_fout): New globals, split out
            from run_checkers.
            (get_or_create_any_logfile): New function, split out from...
            (run_checkers): ...here, so that the logfile can be opened by
            on_finish_translation_unit.  Clear the globals when closing the
            dump file.

    gcc/testsuite/ChangeLog:
            PR analyzer/107711
            * gcc.dg/analyzer/fdump-analyzer-1.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107711] [13 Regression] ICE with "-fanalyzer -Wunused-macros" since r13-4073-gd8aba860b34203

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #9 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
It's a use-after-free of the ident_hash hash_table.  Testing a fix...

[Bug analyzer/107711] [13 Regression] ICE with "-fanalyzer -Wunused-macros" since r13-4073-gd8aba860b34203

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch
             Status|ASSIGNED                    |WAITING

--- Comment #10 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Patch posted for review:
https://gcc.gnu.org/pipermail/gcc-patches/2022-November/606488.html

[Bug analyzer/107711] [13 Regression] ICE with "-fanalyzer -Wunused-macros" since r13-4073-gd8aba860b34203

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:f9ed1d24ee46f5ca759c35a1f51fa163d7529ea6

commit r13-4130-gf9ed1d24ee46f5ca759c35a1f51fa163d7529ea6
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Nov 17 12:34:56 2022 -0500

    c, analyzer: fix ICE with -fanalyzer and -Wunused-macros [PR107711]

    PR analyzer/107711 reports an ICE since r13-4073-gd8aba860b34203 with
    the combination of -fanalyzer and -Wunused-macros.

    The issue is that in c_translation_unit::consider_macro's call to
    cpp_create_reader I was passing "ident_hash" for use by the the new
    reader, but that takes ownership of that hash_table, so that ident_hash
    erroneously gets freed when c_translation_unit::consider_macro calls
    cpp_destroy, leading to a use-after-free in -Wunused-macros, where:

    (gdb) p pfile->hash_table->pfile == pfile
    $23 = false

    and it's instead pointing at the freed reader from consider_macro,
    leading to a use-after-free ICE.

    Fixed thusly.

    gcc/c/ChangeLog:
            PR analyzer/107711
            * c-parser.cc (ana::c_translation_unit::consider_macro): Pass NULL
            to cpp_create_reader, rather than ident_hash, so that the new
            reader gets its own hash table.

    gcc/testsuite/ChangeLog:
            PR analyzer/107711
            * gcc.dg/analyzer/named-constants-Wunused-macros.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/107711] [13 Regression] ICE with "-fanalyzer -Wunused-macros" since r13-4073-gd8aba860b34203

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|---                         |FIXED

--- Comment #12 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above patch.

[Bug analyzer/107711] [13 Regression] ICE with "-fanalyzer -Wunused-macros" since r13-4073-gd8aba860b34203

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107711

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0