[Bug c/111821] New: GCC: 14: continue to consume memory until OOM

[Bug c/111821] New: GCC: 14: continue to consume memory until OOM

[141242068 at smail dot nju.edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

            Bug ID: 111821
           Summary: GCC: 14: continue to consume memory until OOM
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: 141242068 at smail dot nju.edu.cn
  Target Milestone: ---

The bug triggering program:
```
typedef union { char a[1003263430]; }
__attribute__((__packed__)) T;
void f(const void *p) {
    unsigned short v;
    *(T *)(void *)(&v) = *(const T *)p;
}
```

When compile it with `gcc -Og`, gcc used up 8GB of memory on my computer, but
when compile with other options like `-Os`, it normally returns.

Compiler Explorer: https://godbolt.org/z/73n953Y3j

[Bug middle-end/111821] [11/12/13/14 Regression] OOM with packed struct and stack variable with copy

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection
   Target Milestone|---                         |11.5
      Known to work|                            |10.1.0, 10.5.0
            Summary|GCC: 14: continue to        |[11/12/13/14 Regression]
                   |consume memory until OOM    |OOM with packed struct and
                   |                            |stack variable with copy
      Known to fail|                            |11.1.0, 12.3.0

[Bug middle-end/111821] [11/12/13/14 Regression] OOM with packed struct and stack variable with copy

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-10-15
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
here is a testcase where it happens at -O1 and above (and not just -Og):
```
typedef union { char a[1003263430]; }
__attribute__((__packed__)) T;
unsigned short f(const void *p) {
    unsigned short v;
    *(T *)(void *)(&v) = *(const T *)p;
    return v;
}

```

Confirmed.

[Bug middle-end/111821] [11/12/13/14 Regression] OOM with packed struct and stack variable with copy

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note smaller #s decrease the memory usage and compiles faster but still uses a
lot of memory.

Going from 0x1000000 to 0x2000000:
 expand                             :   0.60 (100%)   0.06 (100%)   0.70 ( 97%)
  271M ( 99%)

 expand                             :   1.99 ( 98%)   0.22 (100%)   2.20 ( 96%)
  543M (100%)

As you can see double the memory usage.

[Bug middle-end/111821] [11/12/13/14 Regression] OOM with packed struct and stack variable with copy

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
We end up calling store_integral_bit_field with bitsize 8026107440 which
eventually copies word-size chunks recursively here:

  /* Handle fields bigger than a word.  */

  if (bitsize > BITS_PER_WORD)
    {
...
      for (int i = 0; i < nwords; i++)
        {
...
          if (!store_bit_field_1 (op0, new_bitsize,
                                  bitnum + bit_offset,
                                  bitregion_start, bitregion_end,
                                  word_mode,
                                  value_word, reverse, fallback_p, false))
            {
              delete_insns_since (last);
              return false;
            }

RTL expansion is faced with a GIMPLE aggregate copy, but it seems the
fallback to use memcpy (if it exists...) isn't triggered for whatever
reason.  In the above loop for large nwords we could copy the large
"aligned" chunk in a more optimal way.

I suspect the limited actual size of 'v' deters us here.  You get
undefined behavior at compile-time.  Eh.  (maybe we should not DWIM
but simply cut the size of the copy)

Needs more analysis of where things go astray.

[Bug middle-end/111821] [12/13/14/15 Regression] OOM with packed struct and stack variable with copy

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.5                        |12.5

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11 branch is being closed.

[Bug middle-end/111821] [12/13/14/15 Regression] OOM with packed struct and stack variable with copy

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
So the issue is that we expand 'v' as a register despite of the large
out-of-bound access.  With -O0 we expand it to (stack) memory and use memcpy as
fallback.

I have a patch.

[Bug middle-end/111821] [12/13/14/15 Regression] OOM with packed struct and stack variable with copy

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

--- Comment #6 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:8f3d0c8c3dd02d94635517c68fd314cbceed8373

commit r15-2741-g8f3d0c8c3dd02d94635517c68fd314cbceed8373
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Aug 2 13:49:34 2024 +0200

    middle-end/111821 - compile-time/memory-hog with large copy

    The following fixes a compile-time/memory-hog when performing a
    large aggregate copy to a small object allocated to a register.
    While store_bit_field_1 called by store_integral_bit_field will
    do nothign for accesses outside of the target the loop over the
    source in store_integral_bit_field will still code-generate
    the read parts for all words in the source.  The following copies
    the noop condition from store_bit_field_1 and terminates the
    loop when it runs forward or avoid code-generating the read parts
    when not.

            PR middle-end/111821
            * expmed.cc (store_integral_bit_field): Terminate the
            word-wise copy loop when we get out of the destination
            and do a forward copy.  Skip the word if it would be
            outside of the destination in case of a backward copy.

            * gcc.dg/torture/pr111821.c: New testcase.

[Bug middle-end/111821] [12/13/14 Regression] OOM with packed struct and stack variable with copy

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14/15 Regression]    |[12/13/14 Regression] OOM
                   |OOM with packed struct and  |with packed struct and
                   |stack variable with copy    |stack variable with copy
           Priority|P3                          |P2
      Known to work|                            |15.0

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar, not sure if worth backporting.

[Bug middle-end/111821] [12/13/14 Regression] OOM with packed struct and stack variable with copy

[stefansf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111821

Stefan Schulze Frielinghaus <stefansf at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |stefansf at gcc dot gnu.org

--- Comment #8 from Stefan Schulze Frielinghaus <stefansf at gcc dot gnu.org> ---
Tests gcc.dg/torture/pr111821.c are failing for s390 which looks like a bug in
the back end.  I will have a look at this.