[Bug c++/36648] New: segfault in global constructor with -O3

[Bug c++/36648] New: segfault in global constructor with -O3

[beckmann dot maik at googlemail dot com]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1865 bytes --]

This code
{{{
struct vector {
  vector() : x(0), y(0), z(0) { }  
  float x,y,z;
};

struct Foo { 
  int dummy; // commenting this out makes it run perfectly
  vector array_of_vectors[4];
};

Foo foo;

int main() { }
}}}
compiled with 
  g++ -O3 test.cpp -o test
segaults on x86-64 linux (tested on arch-linux and ubuntu hardy).

Compiled it with -g
  g++ -O3 -g test.cpp -o test
gdb says
{{{
Program received signal SIGSEGV, Segmentation fault.
0x0000000000400553 in global constructors keyed to foo () at test.cpp:2
2         vector() : x(0), y(0), z(0) { }  
(gdb) bt
#0  0x0000000000400553 in global constructors keyed to foo () at test.cpp:2
#1  0x0000000000400636 in __do_global_ctors_aux ()
#2  0x000000000040041b in _init ()
#3  0x00007fbf690ee8c0 in ?? () from /usr/lib/libstdc++.so.6
#4  0x00000000004005c5 in __libc_csu_init ()
#5  0x00007fbf688ca382 in __libc_start_main () from /lib/libc.so.6
#6  0x0000000000400479 in _start ()
(gdb) 
}}}

$ LANG=en_US /opt/bin/g++ -v
Using built-in specs.
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-4.3.1/configure --prefix=/opt --enable-languages=c++
--disable-multilib
Thread model: posix
gcc version 4.3.1 (GCC)

Related ML threads:
  http://thread.gmane.org/gmane.linux.arch.general/16677
  http://thread.gmane.org/gmane.comp.gcc.help/24804


-- Maik


-- 
           Summary: segfault in global constructor with -O3
           Product: gcc
           Version: 4.3.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: beckmann dot maik at googlemail dot com
 GCC build triplet: x86_64-unknown-linux-gnu
  GCC host triplet: x86_64-unknown-linux-gnu
GCC target triplet: x86_64-unknown-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug c++/36648] segfault in global constructor with -O3

[beckmann dot maik at googlemail dot com]

------- Comment #1 from beckmann dot maik at googlemail dot com  2008-06-27 07:21 -------
The segfault doesn't happen on x86-32.


-- 

beckmann dot maik at googlemail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |4.3.0 4.3.1
      Known to work|                            |3.4.6 4.0.1 4.2.3


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug c++/36648] segfault in global constructor with -O3

[beckmann dot maik at googlemail dot com]

------- Comment #2 from beckmann dot maik at googlemail dot com  2008-06-27 08:34 -------
same for gcc-4_3-branch:

$ LANG=en_US svn info .
Path: .
URL: svn://gcc.gnu.org/svn/gcc/branches/gcc-4_3-branch
Repository Root: svn://gcc.gnu.org/svn/gcc
Repository UUID: 138bc75d-0d04-0410-961f-82ee72b054a4
Revision: 137170
Node Kind: directory
Schedule: normal
Last Changed Author: gccadmin
Last Changed Rev: 137166
Last Changed Date: 2008-06-27 02:16:55 +0200 (Fri, 27 Jun 2008)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug c++/36648] segfault in global constructor with -O3

[beckmann dot maik at googlemail dot com]

------- Comment #3 from beckmann dot maik at googlemail dot com  2008-06-27 08:46 -------
eeh.. same means it segfaults on x86-64 :)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug tree-optimization/36648] [4.3/4.4 Regression] segfault in global constructor with -O3

[rguenth at gcc dot gnu dot org]

------- Comment #4 from rguenth at gcc dot gnu dot org  2008-06-27 09:31 -------
The vectorizer creates an unaligned access.  -O -ftree-vectorize reproduces it.

_GLOBAL__I_foo:
.LFB10:
        xorps   %xmm0, %xmm0
        movaps  %xmm0, foo+4(%rip)
        movl    $foo+20, %eax
        movaps  %xmm0, (%rax)
        movaps  %xmm0, 16(%rax)
        ret

.globl foo
        .bss
        .align 32
        .type   foo, @object
        .size   foo, 52


        base_address: &foo
        offset from base address: 0
        constant offset from base address: 4
        step: 12
        aligned to: 128
        base_object: ((struct vector *) &foo)->x
        symbol tag: SMT.10

the base object looks wrong (or doesn't it include the constant offset?)

In the end it looks like the vectorizer simply ignores the first field of
the struct.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |irar at il dot ibm dot com,
                   |                            |rguenth at gcc dot gnu dot
                   |                            |org, spop at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |NEW
          Component|c++                         |tree-optimization
     Ever Confirmed|0                           |1
           Keywords|                            |wrong-code
      Known to work|3.4.6 4.0.1 4.2.3           |3.4.6 4.0.1 4.1.2 4.2.4
           Priority|P3                          |P1
   Last reconfirmed|0000-00-00 00:00:00         |2008-06-27 09:31:54
               date|                            |
            Summary|segfault in global          |[4.3/4.4 Regression]
                   |constructor with -O3        |segfault in global
                   |                            |constructor with -O3
   Target Milestone|---                         |4.3.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug tree-optimization/36648] [4.3/4.4 Regression] segfault in global constructor with -O3

[irar at il dot ibm dot com]

------- Comment #5 from irar at il dot ibm dot com  2008-06-29 12:25 -------
It's a bug in calculation of number of iterations of prolog loop. I am testing
the following patch:

Index: tree-vect-transform.c
===================================================================
--- tree-vect-transform.c       (revision 137250)
+++ tree-vect-transform.c       (working copy)
@@ -6725,16 +6725,14 @@ vect_do_peeling_for_loop_bound (loop_vec
    Else, compute address misalignment in bytes:
      addr_mis = addr & (vectype_size - 1)

-   prolog_niters = min ( LOOP_NITERS , (VF - addr_mis/elem_size)&(VF-1) )
-
-   (elem_size = element type size; an element is the scalar element
-       whose type is the inner type of the vectype)
-
-   For interleaving,
-
-   prolog_niters = min ( LOOP_NITERS ,
-                       (VF/group_size - addr_mis/elem_size)&(VF/group_size-1)
)
-        where group_size is the size of the interleaved group.
+   prolog_niters = min (LOOP_NITERS, ((VF - addr_mis/elem_size)&(VF-1))/step)
+
+   (elem_size = element type size; an element is the scalar element whose type
+   is the inner type of the vectype)
+
+   When the step of the data-ref in the loop is not 1 (as in interleaved data
+   and SLP), the number of iterations of the prolog must be divided by the
step
+   (which is equal to the size of interleaved group).

    The above formulas assume that VF == number of elements in the vector. This
    may not hold when there are multiple-types in the loop.
@@ -6756,18 +6754,12 @@ vect_gen_niters_for_prolog_loop (loop_ve
   tree vectype = STMT_VINFO_VECTYPE (stmt_info);
   int vectype_align = TYPE_ALIGN (vectype) / BITS_PER_UNIT;
   tree niters_type = TREE_TYPE (loop_niters);
-  int group_size = 1;
+  int step = 1;
   int element_size = GET_MODE_SIZE (TYPE_MODE (TREE_TYPE (DR_REF (dr))));
   int nelements = TYPE_VECTOR_SUBPARTS (vectype);

   if (STMT_VINFO_STRIDED_ACCESS (stmt_info))
-    {
-      /* For interleaved access element size must be multiplied by the size of
-        the interleaved group.  */
-      group_size = DR_GROUP_SIZE (vinfo_for_stmt (
-                                              DR_GROUP_FIRST_DR (stmt_info)));
-      element_size *= group_size;
-    }
+    step = DR_GROUP_SIZE (vinfo_for_stmt (DR_GROUP_FIRST_DR (stmt_info)));

   pe = loop_preheader_edge (loop);

@@ -6778,8 +6770,9 @@ vect_gen_niters_for_prolog_loop (loop_ve

       if (vect_print_dump_info (REPORT_DETAILS))
         fprintf (vect_dump, "known alignment = %d.", byte_misalign);
-      iters = build_int_cst (niters_type,
-                         (nelements -
elem_misalign)&(nelements/group_size-1));
+
+      iters = build_int_cst (niters_type,
+                     (((nelements - elem_misalign) & (nelements - 1)) /
step));
     }
   else
     {

Ira


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug tree-optimization/36648] [4.3/4.4 Regression] segfault in global constructor with -O3

[irar at gcc dot gnu dot org]

------- Comment #6 from irar at gcc dot gnu dot org  2008-06-30 11:44 -------
Subject: Bug 36648

Author: irar
Date: Mon Jun 30 11:43:55 2008
New Revision: 137272

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=137272
Log:
        PR tree-optimization/36648
        * tree-vect-transform.c (vect_do_peeling_for_loop_bound): Divide
        number of prolog iterations by step. Fix the comment.


Added:
    trunk/gcc/testsuite/g++.dg/vect/pr36648.cc
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-vect-transform.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug tree-optimization/36648] [4.3/4.4 Regression] segfault in global constructor with -O3

[jakub at gcc dot gnu dot org]

-- 

jakub at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |irar at gcc dot gnu dot org
                   |dot org                     |
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug tree-optimization/36648] [4.3/4.4 Regression] segfault in global constructor with -O3

[irar at gcc dot gnu dot org]

------- Comment #7 from irar at gcc dot gnu dot org  2008-07-01 05:32 -------
Subject: Bug 36648

Author: irar
Date: Tue Jul  1 05:31:55 2008
New Revision: 137308

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=137308
Log:

        PR tree-optimization/36648
        * tree-vect-transform.c (vect_do_peeling_for_loop_bound): Divide
        number of prolog iterations by step. Fix the comment.


Added:
    branches/gcc-4_3-branch/gcc/testsuite/g++.dg/vect/pr36648.cc
Modified:
    branches/gcc-4_3-branch/gcc/ChangeLog
    branches/gcc-4_3-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_3-branch/gcc/tree-vect-transform.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug tree-optimization/36648] [4.3/4.4 Regression] segfault in global constructor with -O3

[irar at il dot ibm dot com]

------- Comment #8 from irar at il dot ibm dot com  2008-07-01 06:12 -------
Fixed.


-- 

irar at il dot ibm dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648

[Bug tree-optimization/36648] [4.3/4.4 Regression] segfault in global constructor with -O3

[beckmann dot maik at googlemail dot com]

------- Comment #9 from beckmann dot maik at googlemail dot com  2008-07-01 06:29 -------
Thank you Ira.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36648