[Bug tree-optimization/107976] New: ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[Bug tree-optimization/107976] New: ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

            Bug ID: 107976
           Summary: ICE: SIGSEGV (stack overflow) in
                    emit_case_dispatch_table (stmt.cc:783) with large
                    --param=jump-table-max-growth-ratio-for-speed
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 54018
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54018&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc
--param=jump-table-max-growth-ratio-for-speed=1813160384 testcase.c 
x86_64-pc-linux-gnu-gcc: internal compiler error: Segmentation fault signal
terminated program cc1
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
See <https://gcc.gnu.org/bugs/> for instructions.


Program received signal SIGSEGV, Segmentation fault.
0x000000000138aa18 in emit_case_dispatch_table (index_expr=0x7ffff770be58,
index_type=0x7ffff771f5e8, case_list=..., default_label=0x7ffff771a2c0,
default_edge=0x7ffff78d23f0, minval=0x7ffff7885fc0, maxval=0x7ffff78b59d8,
range=0x7ffff78d7a98, stmt_bb=0x7ffff78ad600) at
/repo/gcc-trunk/gcc/stmt.cc:783
783       memset (labelvec, 0, ncases * sizeof (rtx));
(gdb) list
778     
779       /* Get table of labels to jump to, in order of case index.  */
780     
781       ncases = tree_to_shwi (range) + 1;
782       labelvec = XALLOCAVEC (rtx, ncases);
783       memset (labelvec, 0, ncases * sizeof (rtx));
784     
785       for (unsigned j = 0; j < case_list.length (); j++)
786         {
787           simple_case_node *n = &case_list[j];
(gdb) p ncases
$1 = 69108865

[Bug middle-end/107976] ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
  ncases = tree_to_shwi (range) + 1;
  labelvec = XALLOCAVEC (rtx, ncases);
  memset (labelvec, 0, ncases * sizeof (rtx));


I think this is a won't fix.
Doctor, it hurts when I bend my arm this way.
Don't bend it that way then.

[Bug middle-end/107976] ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #1)
>   ncases = tree_to_shwi (range) + 1;
>   labelvec = XALLOCAVEC (rtx, ncases);
>   memset (labelvec, 0, ncases * sizeof (rtx));
> 
> 
> I think this is a won't fix.
> Doctor, it hurts when I bend my arm this way.
> Don't bend it that way then.

Changing the above to heap allocation would be easy - of course we'd generate
a huge number of labels then which eventually will lead to different issues.

Using heap allocation or an auto_vec and capping the maximum of
jump-table-max-growth-ratio-for-{size,speed} to something sensible
(the defaults are 300 and 800) would be appropriate I think.

[Bug middle-end/107976] ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-12-08
             Status|UNCONFIRMED                 |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Yeah, I think we should limit the params to a reasonable limit.

[Bug middle-end/107976] ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

--- Comment #4 from Zdenek Sojka <zsojka at seznam dot cz> ---
Thank you for having a look. If anything is done with the param limits,
jump-table-max-growth-ratio-for-size should probably receive the same care.

[Bug middle-end/107976] ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0

[Bug middle-end/107976] ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Liska <marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:8221efae233e2d5992a79600071dd0a52f1b3c74

commit r13-5104-g8221efae233e2d5992a79600071dd0a52f1b3c74
Author: Martin Liska <mliska@suse.cz>
Date:   Wed Dec 28 09:11:40 2022 +0100

    switch expansion: limit JT growth param values

    Currently, one can request a huge jump table creation which
    leads to a non-sensual huge output. Moreover, use auto_vec rather
    than a stack-allocated array.

            PR middle-end/107976

    gcc/ChangeLog:

            * params.opt: Limit JT params.
            * stmt.cc (emit_case_dispatch_table): Use auto_vec.

[Bug middle-end/107976] ICE: SIGSEGV (stack overflow) in emit_case_dispatch_table (stmt.cc:783) with large --param=jump-table-max-growth-ratio-for-speed

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107976

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed, not planning to do a backport.