[Bug middle-end/113724] New: [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[Bug middle-end/113724] New: [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

            Bug ID: 113724
           Summary: [14 Regression][OpenMP] ICE (segfault) when mapping a
                    struct in omp_gather_mapping_groups_1
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code, openmp
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: burnus at gcc dot gnu.org
  Target Milestone: ---

Created attachment 57295
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57295&action=edit
compile with: gcc -fopenmp target_struct_map.4

The attached testcase from the OpenMP examples document now ICEs in the
new omp_gather_mapping_groups_1 function.

* * *

target_struct_map.4.c: In function ‘main’:
target_struct_map.4.c:46:11: internal compiler error: Segmentation fault
   46 |   #pragma omp target data map(S1.p[:N],S1.p,S1.a,S1.b)
      |           ^~~
0x1045382 crash_signal
        /home/tburnus/repos/gcc/gcc/toplev.cc:317
0x7fc380e4251f ???
        ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0xcf8263 tree_check(tree_node*, char const*, int, char const*, tree_code)
        /home/tburnus/repos/gcc/gcc/tree.h:3611
0xcf8263 omp_gather_mapping_groups_1
        /home/tburnus/repos/gcc/gcc/gimplify.cc:9583
0xd0bc32 omp_gather_mapping_groups
        /home/tburnus/repos/gcc/gcc/gimplify.cc:9610
0xd0bc32 gimplify_adjust_omp_clauses
        /home/tburnus/repos/gcc/gcc/gimplify.cc:13733
0xd23d27 gimplify_omp_workshare

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

--- Comment #1 from Tobias Burnus <burnus at gcc dot gnu.org> ---
Debugging shows:

In gimplify_adjust_omp_clauses
(line numbers are off by 1 as I have a #pragma GCC optimize("O0") on top of the
file):

13717         groups = omp_gather_mapping_groups (list_p);
...
13720         if (groups)
13721           {
13722             grpmap = omp_index_mapping_groups (groups);
13723
13724             omp_resolve_clause_dependencies (code, groups, grpmap);
13725             omp_build_struct_sibling_lists (code, ctx->region_type,
groups,
13726                                             &grpmap, list_p);


On the outermost side:

(gdb) p debug(*list_p)
num_teams(-2) thread_limit(0)

(gdb) p debug(*list_p)
map(tofrom:S1.b) map(tofrom:S1.a) map(tofrom:S1.p) map(tofrom:*S1.p [len: 400])
map(attach_detach:S1.p [bias: 0])

The latter goes into the 'if (groups)' and list_p after line 13726 is:

(gdb) p debug(*list_p)
map(struct:S1 [len: 3]) map(tofrom:S1.a) map(tofrom:S1.b)


The later ICE / segfault is because 'map(struct' has len = 3 but only two map
clauses follow.

And the other question is: Why is 'S1.p' gone?

* * *

The 'struct' (GOMP_MAP_STRUCT) with initial length is created by
omp_accumulate_sibling_list:

11120         OMP_CLAUSE_SET_MAP_KIND (l, str_kind);
11121         OMP_CLAUSE_DECL (l) = unshare_expr (base);
11122         OMP_CLAUSE_SIZE (l) = size_int (1);

and later updated via

11462         OMP_CLAUSE_SIZE (*osc)
11463           = size_binop (PLUS_EXPR, OMP_CLAUSE_SIZE (*osc),
size_one_node);
11464
11465         if (reprocessing_struct)

* * *

This works fine for:
  map(tofrom:S1.b)
-> create struct with len=1

It works also for:
   map(tofrom:S1.a)
-> update struct len to 2 + add 'S1.a'

But not for:
   map(tofrom:S1.p)
-> does update len to 3 but doesn't add 'S1.p'.

I do note that at:

11382           if (attach_detach && sc == grp_start_p)

(gdb) p attach_detach
$139 = true

(gdb) p sc == grp_start_p
$140 = false

(gdb) p debug(*sc)
map(tofrom:S1.b) map(tofrom:S1.p) map(tofrom:*S1.p [len: 400])
map(attach_detach:S1.p [bias: 0])

(gdb) p debug(*grp_start_p)
map(tofrom:*S1.p [len: 400]) map(attach_detach:S1.p [bias: 0])

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

--- Comment #2 from Tobias Burnus <burnus at gcc dot gnu.org> ---
Inside:  omp_build_struct_sibling_lists

          new_next 
            = omp_accumulate_sibling_list (region_type, code,
                                           struct_map_to_clause, *grpmap,
                                           grp_start_p, grp_end, addr_tokens,
                                           &inner, &fragile_p,
                                           grp->reprocess_struct, &added_tail);

This processing looks okay. But:

  /* Delete groups marked for deletion above.  At this point the order of the
     groups may no longer correspond to the order of the underlying list,
     which complicates this a little.  First clear out OMP_CLAUSE_DECL for
     deleted nodes...  */

  FOR_EACH_VEC_ELT (*groups, i, grp)
    if (grp->deleted)
      for (tree d = *grp->grp_start;
           d != OMP_CLAUSE_CHAIN (grp->grp_end);
           d = OMP_CLAUSE_CHAIN (d))
        OMP_CLAUSE_DECL (d) = NULL_TREE;


Where we have the following 4 elements. Note that grp_start is identical for
[1] and [2] – where [2] is deleted = true – which causes that the CLAUSE_DECL
are NULL. Namely, 'p (*groups)[i]' for i = 0...3 gives:

$86 = (omp_mapping_group &) @0x30f7a48: {grp_start = 0x7ffff6c92070, grp_end =
0x7ffff71f96c0, mark = UNVISITED, deleted = false, reprocess_struct = false,
fragile = false, sibling = 0x0, next = 0x0}

$91 = (omp_mapping_group &) @0x30f7a70: {grp_start = 0x7ffff71f96d0, grp_end =
0x7ffff71f9678, mark = UNVISITED, deleted = false, reprocess_struct = false,
fragile = false, sibling = 0x0, next = 0x0}

$92 = (omp_mapping_group &) @0x30f7a98: {grp_start = 0x7ffff71f96d0, grp_end =
0x7ffff71f9630, mark = UNVISITED, deleted = true, reprocess_struct = false,
fragile = false, sibling = 0x0, next = 0x0}

$93 = (omp_mapping_group &) @0x30f7ac0: {grp_start = 0x7ffff71f9640, grp_end =
0x7ffff71f9708, mark = UNVISITED, deleted = false, reprocess_struct = false,
fragile = false, sibling = 0x0, next = 0x0}


Where the '*grp_start' values of [0],[1]+[2], [3] are:

map(struct:S1 [len: 3]) map(tofrom:S1.a) map(tofrom:S1.b) map(alloc:S1.p [len:
8]) map(tofrom:*S1.p [len: 400]) map(attach_detach:S1.p [bias: 0])
map(tofrom:S1.p)

map(alloc:S1.p [len: 8]) map(tofrom:*S1.p [len: 400]) map(attach_detach:S1.p
[bias: 0]) map(tofrom:S1.p)

(gdb) p debug(*(tree*)0x7ffff71f9640)
<nil>

And 'grp_end' for [0]...[4] is:

map(tofrom:S1.b) map(alloc:S1.p [len: 8]) map(tofrom:*S1.p [len: 400])
map(attach_detach:S1.p [bias: 0]) map(tofrom:S1.p)

map(tofrom:S1.a) map(tofrom:S1.b) map(alloc:S1.p [len: 8]) map(tofrom:*S1.p
[len: 400]) map(attach_detach:S1.p [bias: 0]) map(tofrom:S1.p)

map(tofrom:S1.p)

map(attach_detach:S1.p [bias: 0]) map(tofrom:S1.p)


BEFORE that deleted loop, the result is:

(gdb) p debug(*list_p)

map(struct:S1 [len: 3]) map(tofrom:S1.a) map(tofrom:S1.b) map(alloc:S1.p [len:
8]) map(tofrom:*S1.p [len: 400]) map(attach_detach:S1.p [bias: 0])
map(tofrom:S1.p)

which looks fine. Obviously, after the deleted, all entries after 'alloc:S.p'
have CLAUSE_DECL == NULL_TREE, causing the fail.

* * *

RFC:
* Why are there two 'grp' with the same *grp_start value?
* Why does it get set to 'deleted' while its clauses are actually used?

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

--- Comment #3 from Tobias Burnus <burnus at gcc dot gnu.org> ---
Inside omp_build_struct_sibling_lists, the following assignment:

11654           grp->grp_start = new_next;

has on the LHS the [3] array with value:

(gdb) p *grp
$147 = {grp_start = 0x7ffff71f9688, grp_end = 0x7ffff71f9630, mark = UNVISITED,
deleted = true, reprocess_struct = false, fragile = false, sibling = 0x0, next
= 0x0}

while

(gdb) p new_next
$146 = (tree *) 0x7ffff71f96d0

which causes the alias issue we are seeing. Before the assignment:

(gdb) p debug(*(tree*)0x7ffff71f9688)
map(tofrom:S1.b) map(tofrom:S1.p) map(tofrom:*S1.p [len: 400])
map(attach_detach:S1.p [bias: 0])

(gdb) p debug(*(tree*)0x7ffff71f96d0)
map(tofrom:S1.p) map(tofrom:*S1.p [len: 400]) map(attach_detach:S1.p [bias: 0])

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

--- Comment #4 from Tobias Burnus <burnus at gcc dot gnu.org> ---
Created attachment 57377
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57377&action=edit
Fixes the ICE – might paper over a real issue; doesn't fix the run-time issue →
TODO + 'data'-issue in PR comment 4

The patch fixes the issue

    #pragma omp target data map(S1.p[:N],S1.p,S1.a,S1.b)

This gets split into the groups (reverse order!) 'S1.b' (i = 0), 'S1.a' (i =
1), 'S1.p' (i = 3) and 'S1.p[:N]' (i = 4; map + attach).

In omp_build_struct_sibling_lists the collecting and reordering happens but for
'S1.p' there should be an 'alloc' not a 'tofrom' - such 'S1.p' has grp->deleted
and the attach code will add the 'alloc' code.

Until i = 2, everything is fine:
  *(*group[2])->deleted == true
  *(*group[2])->grp_start == (*group[2])->grp_end

and this encloses 'map(tofrom:S1.p [len: 8])' – which should be removed in
favor of a later (i = 3) added 'map(alloc:S1.p [len: 8])'.

In principle, everything looks fine, until i =3 calls
omp_accumulate_sibling_list, which in turn calls:

          continue_at
            = cl ? omp_siblist_move_concat_nodes_after (cl, tail_chain,
                                                        grp_start_p, grp_end,
                                                        sc)
                 : omp_siblist_move_nodes_after (grp_start_p, grp_end, sc);

where 'cl' != NULL_TREE.

After the call, 'tail_chain' alias 'list_p' looks fine - except for the tailing
'map(tofrom:S1.p [len: 8])'.

In principle, 'groups' is no longer touched - except for the the 'grp->deleted'
handling, which fails (deletes the wrong stuff) because grp_begin points to the
wrong tree.

Solution: Do the OMP_CLAUSE_DECL nullifying earlier such that messing around
with groups won't cause issues.


TODO: We should really find out WHY i=2's grp_begin gets updated. If it happens
just for previously processed grp items, that's fine - but what will happen if
it also affects a still to be processed item? - If that indeed happens,
everything will be messed up again!

* * *

The testcase shows another issue:

  target data map(to: S2.p[:N])

gets mapped as:

  map(struct:S2 [len: 1]) map(alloc:S2.p [len: 0])
       map(tofrom:*_14 [len: 400])    map(attach:S2.p [bias: 0])

before:

  map(tofrom:*_14 [len: 400]) map(attach:S2.p [bias: 0]

The problem of the former is of course that 'S' is already partially mapped and
that an alloc of length 0 will then fail already in 'target data' for the
attach:S2.p as 0 bytes aren't sufficient for a pointer attachment.

This applies both to target data and target, except that for 'target', 'S'
might appear implicitly - while for 'data' it can only appear explicitly or not
at all.

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

--- Comment #5 from Tobias Burnus <burnus at gcc dot gnu.org> ---
The runtime issue is now PR113867.

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

--- Comment #6 from Tobias Burnus <burnus at gcc dot gnu.org> ---
Created attachment 57407
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57407&action=edit
C testcase – passes with patch (except for '#if 0'ed PR113867 issues)

DejaGNU-ified testcase for this PR and ('#if 0'-ed for PR113867).

Using the attached patch, it no longer gives an ICE and it works except for the
'#if 0' code but it regresses for:

FAIL: libgomp.c/../libgomp.c-c++-common/baseptrs-1.c (internal compiler error:
Segmentation fault)
FAIL: libgomp.c/../libgomp.c-c++-common/baseptrs-1.c (test for excess errors)
FAIL: libgomp.c/../libgomp.c-c++-common/pr109062.c output pattern test
FAIL: libgomp.c/../libgomp.c-c++-common/target-map-1.c execution test
FAIL: libgomp.c/target-52.c execution test

Thus, there is more work needed.

TODO:
- Create a tix which solves this issue without regressing
- Possibly addressing the PR113867 here

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org
           Priority|P3                          |P1

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |13.2.1
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-03-26

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed btw., works with checking-enabled GCC 13.

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
With release checking we ICE with

t.c: In function 'main':
t.c:46:11: internal compiler error: Segmentation fault
   46 |   #pragma omp target data map(S1.p[:N],S1.p,S1.a,S1.b)
      |           ^~~
0xd320af crash_signal
        /home/rguenther/src/trunk/gcc/toplev.cc:319
0xa3b5b0 omp_gather_mapping_groups_1
        /home/rguenther/src/trunk/gcc/gimplify.cc:9593
0xa3b769 omp_gather_mapping_groups
        /home/rguenther/src/trunk/gcc/gimplify.cc:9621

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1 since r14-6515

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
            Summary|[14 Regression][OpenMP] ICE |[14 Regression][OpenMP] ICE
                   |(segfault) when mapping a   |(segfault) when mapping a
                   |struct in                   |struct in
                   |omp_gather_mapping_groups_1 |omp_gather_mapping_groups_1
                   |                            |since r14-6515

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
ICE started with r14-6515-g5fdb150cd4bf8f2da335e3f5c3a17aafcbc66dbe

[Bug middle-end/113724] [14 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1 since r14-6515

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P1                          |P2

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Per IRC discussions downgrading this to P2, it isn't something used widely in
real-world code and while we can get some partial fix soon, a full fix will
take likely longer.  If it is fixed relatively soon in stage1, we can consider
backporting the non-risky parts of the fixes to 14.2.

[Bug middle-end/113724] [14/15 Regression][OpenMP] ICE (segfault) when mapping a struct in omp_gather_mapping_groups_1 since r14-6515

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113724

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|14.0                        |14.2

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 14.1 is being released, retargeting bugs to GCC 14.2.