[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[davek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710

Dave Korn <davek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2006-11-10 19:32:46         |2010-12-11 19:32:46
                 CC|                            |davek at gcc dot gnu.org
            Version|4.2.0                       |4.6.0
      Known to fail|                            |4.6.0

--- Comment #6 from Dave Korn <davek at gcc dot gnu.org> 2010-12-11 10:17:11 UTC ---
  I've run into what appears to be the same problem with 4.6.0 HEAD in java:

http://gcc.gnu.org/ml/gcc/2010-12/msg00308.html
http://gcc.gnu.org/ml/gcc/2010-12/msg00315.html

> FAIL: newarray_overflow -O3 compilation from source
> FAIL: newarray_overflow -O3 -findirect-dispatch compilation from source

  The problem showed up as a crash during gimple stmt verification.  Turning on
tree dumps moved the crash earlier, to a point where it was trying to dump a
call to builtin_prefetch during the 118t.aprefetch pass.  The GIMPLE context in
that file, after working around the dump problem, shows:

;; Function newarray_overflow.int_check()
(_ZN17newarray_overflow9int_checkEJvv)
              [ . . . ]
<bb 13>:
  D.1283_116 = &MEM[(int *)#ref#2#2_6].data[#slot#3#12.29_44]{lb: 0 sz: 4};
  D.1284_85 = D.1283_116 + 1275068416;
  newarray_overflow.int_check.__builtin_prefetch (D.1284_85, 0, );
  #slot#2#0_53 = MEM[(int *)#ref#2#2_6].data[#slot#3#12.29_44]{lb: 0 sz: 4};
  goto <bb 15>;

  Judging by the way all the RTL dump files (and the generated assembler
source) leave off immediately before this function, it's some kind of invalid
GIMPLE problem.  The verification failure occurred here:

> (gdb) bt
> #0  walk_gimple_op (stmt=0x7fe106e0,
>     callback_op=0x4a0ef0 <verify_expr.265801>, wi=0x326c554)
>     at /gnu/gcc/gcc/gcc/gimple.c:1342
> #1  0x0054a0fd in verify_stmts () at /gnu/gcc/gcc/gcc/tree-cfg.c:4156
> #2  0x0054a94a in verify_ssa (check_modified_stmt=1 '\001')
>     at /gnu/gcc/gcc/gcc/tree-ssa.c:878
> #3  0x008cc671 in execute_function_todo.56548 (data=0x1)
>     at /gnu/gcc/gcc/gcc/passes.c:1237
> #4  0x00776449 in do_per_function (
>     callback=0x8cc530 <execute_function_todo.56548>, data=0x1)
>     at /gnu/gcc/gcc/gcc/passes.c:1084
> #5  0x00540e90 in execute_todo (flags=1) at /gnu/gcc/gcc/gcc/passes.c:1268
> #6  0x00541140 in execute_one_pass (pass=0xaf1320)
>     at /gnu/gcc/gcc/gcc/passes.c:1576

... verifying a gimple call statement:

> (gdb) p stmt[0].gimple_call
> $8 = {membase = {opbase = {gsbase = {code = TS_IDENTIFIER, no_warning = 0,
>         visited = 0, nontemporal_move = 0, plf = 0, modified = 0,
>         has_volatile_ops = 0, pad = 0, subcode = 0, uid = 0, location = 0,
>         num_ops = 6, bb = 0x7fda3210, block = 0x0}, def_ops = 0x0,
>       use_ops = 0x7fed6f30}, vdef = 0x0, vuse = 0x0}, call_used = {
>     anything = 1, nonlocal = 0, escaped = 0, ipa_escaped = 0, null = 0,
>     vars_contains_global = 0, vars_contains_restrict = 0, vars = 0x0},
>   call_clobbered = {anything = 0, nonlocal = 0, escaped = 0, ipa_escaped = 0,
>     null = 0, vars_contains_global = 0, vars_contains_restrict = 0,
>     vars = 0x0}, op = {0x0}}

  By forcing the num_ops down to 5, I managed to defer the crash until
expand_builtin_prefetch:

Program received signal SIGSEGV, Segmentation fault.
expand_builtin_prefetch (exp=<value optimized out>)
    at /gnu/gcc/gcc/gcc/builtins.c:1131
1131      if (TREE_CODE (arg2) != INTEGER_CST)

  So that made me suspect the third argument to the call was invalid, and
breakpointing on gimple_build_call showed the problem:

 (gdb) bt
#0  gimple_build_call (fn=0x7ff8f580, nargs=3) at /gnu/gcc/gcc/gcc/gimple.c:261
#1  0x008c310d in tree_ssa_loop_prefetch () at
/gnu/gcc/gcc/gcc/tree-ssa-loop-pr
efetch.c:1121
(gdb) x/8xw $esp
0x326c5fc:      0x008c310d      0x7ff8f580      0x00000003      0x7feb8280
0x326c60c:      0x7fef03d8      0x00000000      0x00000000      0x00080000

  fn and nargs can be seen in the middle of the first row there, and the next
three words should be the arguments to the gimple call, but you can see the
third one is null.  That comes from this line in issue_prefetch_ref() in
tree-ssa-loop-prefetch.c:

      prefetch = gimple_build_call (built_in_decls[BUILT_IN_PREFETCH],
                    3, addr, write_p, local);

and the variable local is set like so:

  local = nontemporal ? integer_zero_node : integer_three_node;

Sure enough, on investigating the integer_xxx_nodes, 

  TI_INTEGER_ZERO,  // = 13
  TI_INTEGER_ONE,  // = 14
  TI_INTEGER_THREE,  // = 15
  TI_INTEGER_MINUS_ONE,  // = 16

(gdb) p global_trees[13]
$20 = (union tree_node *) 0x7fef03d8
(gdb) p global_trees[14]
$21 = (union tree_node *) 0x7fef03f0
(gdb) p global_trees[15]
$22 = (union tree_node *) 0x0
(gdb) p global_trees[16]
$23 = (union tree_node *) 0x7fef0438

... it appears that integer_three_node has not been initialised.  Looks to me
like that might be something that was added after the others and maybe only the
c family compilers got updated to set it up in their init routines; I'll take a
closer look.

Although I haven't verified that this is the same as the original problem
report, it really looks like it, modulo various changes to the compiler's
internals since 4.2; in particular, 

(In reply to comment #4)
> (gdb) p current_stmt_group
> $6 = (struct stmt_group *) 0x0

... that looks like that null third argument causing problems to me.

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[davek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710

--- Comment #7 from Dave Korn <davek at gcc dot gnu.org> 2010-12-11 10:46:22 UTC ---
(In reply to comment #6)

> Although I haven't verified that this is the same as the original problem
> report, it really looks like it, modulo various changes to the compiler's
> internals since 4.2; in particular, 
> 
> (In reply to comment #4)
> > (gdb) p current_stmt_group
> > $6 = (struct stmt_group *) 0x0
> 
> ... that looks like that null third argument causing problems to me.

  Ah, but there was no integer_three_node back then and builtin_expect only
used to take two args at the time.  So it can't be the same thing after all.

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |5.0
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The original Ada issue was fixed with r0-101637 .
The java issue was fixed with r0-105374 but java support was removed anyways.

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[laurent at guerby dot net]

------- Comment #5 from laurent at guerby dot net  2006-11-10 19:32 -------

Confirmed with gcc version 4.2.0 20061020 (experimental) on x86_64-linux

$ H=.../gcc/ada
$ gcc -c -fprefetch-loop-arrays -gnatpg -gnata -g0 -O1   -fno-inline  -I$H
$H/a-except.adb

raised STORAGE_ERROR : stack overflow (or erroneous memory access)

With gcc 4.1.1 it compiles successfully, with gcc 4.2.0 20061102 (prerelease)
it fails too.


-- 

laurent at guerby dot net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2006-11-10 19:32:46
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[pluto at agmk dot net]

------- Comment #4 from pluto at agmk dot net  2006-11-07 14:43 -------
(gdb) p current_stmt_group
$6 = (struct stmt_group *) 0x0


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[pluto at agmk dot net]

------- Comment #3 from pluto at agmk dot net  2006-11-07 14:42 -------
Program received signal SIGSEGV, Segmentation fault.

append_to_statement_list_1 (t=0x2b70307e9940, list_p=0x8) at
../../gcc/gimplify.c:297
297       tree list = *list_p;

(gdb) bt
#0  append_to_statement_list_1 (t=0x2b70307e9940, list_p=0x8) at
../../gcc/gimplify.c:297
#1  0x00000000006215d4 in append_to_statement_list (t=0x2b70307e9940,
list_p=0x8) at ../../gcc/gimplify.c:321
#2  0x00000000004200d7 in add_stmt (gnu_stmt=0x2b70307e9940) at
../../gcc/ada/trans.c:4374
#3  0x000000000042014e in add_stmt_with_node (gnu_stmt=0x2b70307e9940,
gnat_node=8) at ../../gcc/ada/trans.c:4390
#4  0x000000000042020e in add_decl_expr (gnu_decl=0x2b703064b2a0,
gnat_entity=0) at ../../gcc/ada/trans.c:4416
#5  0x0000000000419ed2 in gnat_pushdecl (decl=0x2b703064b2a0, gnat_node=0) at
../../gcc/ada/utils.c:354
#6  0x0000000000419fd7 in builtin_function (name=<value optimized out>,
type=0x2b70307dfa50, function_code=480,
    class=BUILT_IN_NORMAL, library_name=0x0, attrs=0x0) at
../../gcc/ada/utils.c:1845
#7  0x0000000000922e7e in tree_ssa_prefetch_arrays (loops=0x142dc10) at
../../gcc/tree-ssa-loop-prefetch.c:1039
#8  0x000000000090f892 in tree_ssa_loop_prefetch () at
../../gcc/tree-ssa-loop.c:418
#9  0x000000000087bc4f in execute_one_pass (pass=0xdd5cc0) at
../../gcc/passes.c:870
#10 0x000000000087bd3e in execute_pass_list (pass=0xdd5cc0) at
../../gcc/passes.c:917
#11 0x000000000087bd55 in execute_pass_list (pass=0xdd58a0) at
../../gcc/passes.c:918
#12 0x000000000087bd55 in execute_pass_list (pass=0xdd0ac0) at
../../gcc/passes.c:918
#13 0x000000000061f2af in tree_rest_of_compilation (fndecl=0x2b702fc410e0) at
../../gcc/tree-optimize.c:463
#14 0x0000000000412023 in gnat_expand_body (gnu_decl=0x2b70307e9940) at
../../gcc/ada/misc.c:666
#15 0x00000000008c12c3 in cgraph_expand_function (node=0x2b7030580900) at
../../gcc/cgraphunit.c:1241
#16 0x00000000008c1be7 in cgraph_optimize () at ../../gcc/cgraphunit.c:1306
#17 0x0000000000412575 in gnat_parse_file (set_yydebug=<value optimized out>)
at ../../gcc/ada/misc.c:250
#18 0x000000000085f2a3 in toplev_main (argc=<value optimized out>, argv=<value
optimized out>) at ../../gcc/toplev.c:1033
#19 0x000000000061c661 in main (argc=813603136, argv=0x8) at
../../gcc/main.c:35


Program received signal SIGSEGV, Segmentation fault.
append_to_statement_list_1 (t=0x2aaf80d0b940, list_p=0x8) at
../../gcc/gimplify.c:297
297       tree list = *list_p;

(gdb) up
#1  0x00000000006215d4 in append_to_statement_list (t=0x2aaf80d0b940,
list_p=0x8) at ../../gcc/gimplify.c:321
321         append_to_statement_list_1 (t, list_p);
(gdb)
#2  0x00000000004200d7 in add_stmt (gnu_stmt=0x2aaf80d0b940) at
../../gcc/ada/trans.c:4374
4374      append_to_statement_list (gnu_stmt, &current_stmt_group->stmt_list);
(gdb) p gnu_stmt
$5 = (tree) 0x2aaf80d0b940
(gdb) call debug_tree(gnu_stmt)
 <decl_expr 0x2aaf80d0b940
    type <void_type 0x2aaf80096d10 void sizes-gimplified asm_written visited
VOID
        align 8 symtab 0 alias set -1
        pointer_to_this <pointer_type 0x2aaf80096dc0>>
    side-effects
    arg 0 <function_decl 0x2aaf80b6d2a0 __builtin_prefetch
        type <function_type 0x2aaf80d01a50 type <void_type 0x2aaf80096d10 void>
            QI
            size <integer_cst 0x2aaf800897b0 constant invariant 8>
            unit size <integer_cst 0x2aaf800897e0 constant invariant 1>
            align 8 symtab 0 alias set -1
            arg-types <tree_list 0x2aaf80d05e70 value <pointer_type
0x2aaf80096f20>>>
        public external no-static-chain QI file ../../gcc/ada/a-exexda.adb line
637 context <function_decl 0x2aaf801630e0
ada__exceptions__exception_data__set_exception_msgXn>>>


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[pluto at agmk dot net]

------- Comment #2 from pluto at agmk dot net  2006-11-07 06:06 -------
(In reply to comment #1)
> Can you give the backtrace and also attach the sources which crash?

sources come from gcc-4.2.0-0.20061030r118195.

(gdb) r
Starting program:
/home/users/pluto/rpm/BUILD/gcc-4_2-branch/builddir/prev-gcc/gnat1 -I- -I.
-Iada -I../../gcc/ada -quiet -dumpbase a-except.adb -O1 -fprefetch-loop-arrays
-gnatpg -gnata -g -mtune=generic -gnatO ada/a-except.o
../../gcc/ada/a-except.adb -o /tmp/ccr3NsG5.s

Program received signal SIGSEGV, Segmentation fault.
0x000000000062155e in append_to_statement_list_1 ()
(gdb) bt
#0  0x000000000062155e in append_to_statement_list_1 ()
#1  0x00000000006215d4 in append_to_statement_list ()
#2  0x00000000004200d7 in add_stmt ()
#3  0x000000000042014e in add_stmt_with_node ()
#4  0x000000000042020e in add_decl_expr ()
#5  0x0000000000419ed2 in gnat_pushdecl ()
#6  0x0000000000419fd7 in builtin_function ()
#7  0x0000000000922f4e in tree_ssa_prefetch_arrays ()
#8  0x000000000090f962 in tree_ssa_loop_prefetch ()
#9  0x000000000087bccf in execute_one_pass ()
#10 0x000000000087bdbe in execute_pass_list ()
#11 0x000000000087bdd5 in execute_pass_list ()
#12 0x000000000087bdd5 in execute_pass_list ()
#13 0x000000000061f2af in tree_rest_of_compilation ()
#14 0x0000000000412023 in gnat_expand_body ()
#15 0x00000000008c1393 in cgraph_expand_function ()
#16 0x00000000008c1cb7 in cgraph_optimize ()
#17 0x0000000000412575 in gnat_parse_file ()
#18 0x000000000085f2a3 in toplev_main ()
#19 0x000000000061c661 in main ()


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710

[Bug tree-optimization/29710] gnat ICEs on -fprefetch-loop-arrays -O1.

[pinskia at gcc dot gnu dot org]

------- Comment #1 from pinskia at gcc dot gnu dot org  2006-11-06 20:38 -------
Can you give the backtrace and also attach the sources which crash?


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29710