[Bug tree-optimization/46987] New: [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[Bug tree-optimization/46987] New: [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46987

           Summary: [4.6 Regression] g++.dg/torture/covariant-1.C ICE:
                    double free or corruption with -fno-inline
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
                CC: jamborm@gcc.gnu.org
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 22791
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=22791
reduced testcase

Compiler output (with valgrind):
$ gcc -O -fno-inline covariant-1.ii
==12570== Invalid read of size 4
==12570==    at 0xAB822A: get_constant_value (tree-ssa-ccp.c:307)
==12570==    by 0xB1990B: substitute_and_fold (tree-ssa-propagate.c:888)
==12570==    by 0xABAF2E: do_ssa_ccp (tree-ssa-ccp.c:884)
==12570==    by 0x93A1A5: execute_one_pass (passes.c:1553)
==12570==    by 0x93A494: execute_pass_list (passes.c:1608)
==12570==    by 0x93A4A6: execute_pass_list (passes.c:1609)
==12570==    by 0xA7A945: tree_rest_of_compilation (tree-optimize.c:422)
==12570==    by 0xC3ED41: cgraph_expand_function (cgraphunit.c:1508)
==12570==    by 0xC41419: cgraph_optimize (cgraphunit.c:1567)
==12570==    by 0xC41999: cgraph_finalize_compilation_unit (cgraphunit.c:1031)
==12570==    by 0x5B75CC: cp_write_global_declarations (decl2.c:3974)
==12570==    by 0xA24205: toplev_main (toplev.c:591)
==12570==  Address 0x825cea0 is 0 bytes after a block of size 704 alloc'd
==12570==    at 0x4C24EE1: calloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==12570==    by 0x11F1FA8: xcalloc (xmalloc.c:162)
==12570==    by 0xABA95B: do_ssa_ccp (tree-ssa-ccp.c:767)
==12570==    by 0x93A1A5: execute_one_pass (passes.c:1553)
==12570==    by 0x93A494: execute_pass_list (passes.c:1608)
==12570==    by 0x93A4A6: execute_pass_list (passes.c:1609)
==12570==    by 0xA7A945: tree_rest_of_compilation (tree-optimize.c:422)
==12570==    by 0xC3ED41: cgraph_expand_function (cgraphunit.c:1508)
==12570==    by 0xC41419: cgraph_optimize (cgraphunit.c:1567)
==12570==    by 0xC41999: cgraph_finalize_compilation_unit (cgraphunit.c:1031)
==12570==    by 0x5B75CC: cp_write_global_declarations (decl2.c:3974)
==12570==    by 0xA24205: toplev_main (toplev.c:591)
==12570== 
==12570== Invalid write of size 8
==12570==    at 0xAB827F: get_constant_value (tree-ssa-ccp.c:308)
==12570==    by 0xB1990B: substitute_and_fold (tree-ssa-propagate.c:888)
==12570==    by 0xABAF2E: do_ssa_ccp (tree-ssa-ccp.c:884)
==12570==    by 0x93A1A5: execute_one_pass (passes.c:1553)
==12570==    by 0x93A494: execute_pass_list (passes.c:1608)
==12570==    by 0x93A4A6: execute_pass_list (passes.c:1609)
==12570==    by 0xA7A945: tree_rest_of_compilation (tree-optimize.c:422)
==12570==    by 0xC3ED41: cgraph_expand_function (cgraphunit.c:1508)
==12570==    by 0xC41419: cgraph_optimize (cgraphunit.c:1567)
==12570==    by 0xC41999: cgraph_finalize_compilation_unit (cgraphunit.c:1031)
==12570==    by 0x5B75CC: cp_write_global_declarations (decl2.c:3974)
==12570==    by 0xA24205: toplev_main (toplev.c:591)
==12570==  Address 0x825cea0 is 0 bytes after a block of size 704 alloc'd
==12570==    at 0x4C24EE1: calloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==12570==    by 0x11F1FA8: xcalloc (xmalloc.c:162)
==12570==    by 0xABA95B: do_ssa_ccp (tree-ssa-ccp.c:767)
==12570==    by 0x93A1A5: execute_one_pass (passes.c:1553)
==12570==    by 0x93A494: execute_pass_list (passes.c:1608)
==12570==    by 0x93A4A6: execute_pass_list (passes.c:1609)
==12570==    by 0xA7A945: tree_rest_of_compilation (tree-optimize.c:422)
==12570==    by 0xC3ED41: cgraph_expand_function (cgraphunit.c:1508)
==12570==    by 0xC41419: cgraph_optimize (cgraphunit.c:1567)
==12570==    by 0xC41999: cgraph_finalize_compilation_unit (cgraphunit.c:1031)
==12570==    by 0x5B75CC: cp_write_global_declarations (decl2.c:3974)
==12570==    by 0xA24205: toplev_main (toplev.c:591)
==12570== 

Tested revisions:
r167954 - crash
r167898 - crash
r165699 - OK
4.5 r166509 - OK

[Bug tree-optimization/46987] [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46987

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2010.12.17 13:27:32
   Target Milestone|---                         |4.6.0
     Ever Confirmed|0                           |1

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> 2010-12-17 13:27:32 UTC ---
It is caused by revision 167855:

http://gcc.gnu.org/ml/gcc-cvs/2010-12/msg00537.html

I got

*** glibc detected ***
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus:
double free or corruption (!prev): 0x0000000001bd6490 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x78db3)[0x7ffff7482db3]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus[0xd69312]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus[0xd71f26]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(execute_one_pass+0x1da)[0xb741a2]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(execute_pass_list+0x41)[0xb74391]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(execute_pass_list+0x62)[0xb743b2]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(tree_rest_of_compilation+0x10a)[0xcfc7a8]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus[0xf9b0f5]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus[0xf9b2b4]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(cgraph_optimize+0x1bb)[0xf9b8e9]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(cgraph_finalize_compilation_unit+0x63)[0xf99433]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(cp_write_global_declarations+0x146f)[0x60ed22]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus[0xc6a1ee]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus[0xc6c2e9]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(toplev_main+0x121)[0xc6c436]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus(main+0x20)[0x808b98]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x7ffff7428dfd]
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus[0x48cbd9]
======= Memory map: ========
00400000-01841000 r-xp 00000000 08:21 7538315                           
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus
01a40000-01a4b000 rw-p 01440000 08:21 7538315                           
/export/gnu/import/rrs/167895/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus
01a4b000-01c23000 rw-p 00000000 00:00 0                                  [heap]
3f4ac00000-3f4acba000 r-xp 00000000 08:07 27630                         
/usr/lib64/libppl.so.7.1.0
3f4acba000-3f4aeb9000 ---p 000ba000 08:07 27630                         
/usr/lib64/libppl.so.7.1.0
3f4aeb9000-3f4aebc000 rw-p 000b9000 08:07 27630                         
/usr/lib64/libppl.so.7.1.0
3f4b000000-3f4b003000 r-xp 00000000 08:07 26888                         
/usr/lib64/libgmpxx.so.4.1.2
3f4b003000-3f4b203000 ---p 00003000 08:07 26888                         
/usr/lib64/libgmpxx.so.4.1.2
3f4b203000-3f4b204000 rw-p 00003000 08:07 26888                         
/usr/lib64/libgmpxx.so.4.1.2
3f4b400000-3f4b420000 r-xp 00000000 08:07 26584                         
/usr/lib64/libcloog.so.0.0.0
3f4b420000-3f4b61f000 ---p 00020000 08:07 26584                         
/usr/lib64/libcloog.so.0.0.0
3f4b61f000-3f4b620000 rw-p 0001f000 08:07 26584                         
/usr/lib64/libcloog.so.0.0.0
3f4b620000-3f4b622000 rw-p 00000000 00:00 0 
3f4c000000-3f4c366000 r-xp 00000000 08:07 16831                         
/usr/lib64/libppl_c.so.2.1.0
3f4c366000-3f4c565000 ---p 00366000 08:07 16831                         
/usr/lib64/libppl_c.so.2.1.0
3f4c565000-3f4c569000 rw-p 00365000 08:07 16831                         
/usr/lib64/libppl_c.so.2.1.0
3f4c569000-3f4c56a000 rw-p 00000000 00:00 0 
3f4cc00000-3f4cc4d000 r-xp 00000000 08:07 27185                         
/usr/lib64/libmpfr.so.1.2.2
3f4cc4d000-3f4ce4c000 ---p 0004d000 08:07 27185                         
/usr/lib64/libmpfr.so.1.2.2
3f4ce4c000-3f4ce4e000 rw-p 0004c000 08:07 27185                         
/usr/lib64/libmpfr.so.1.2.2
3f54800000-3f54857000 r-xp 00000000 08:07 27019                         
/usr/lib64/libgmp.so.3.5.2
3f54857000-3f54a57000 ---p 00057000 08:07 27019                         
/usr/lib64/libgmp.so.3.5.2
3f54a57000-3f54a59000 rw-p 00057000 08:07 27019                         
/usr/lib64/libgmp.so.3.5.2
7ffff0c94000-7ffff0ddd000 rw-p 00000000 00:00 0 
7ffff0ddd000-7ffff6c6e000 r--p 00000000 08:07 27067                     
/usr/lib/locale/locale-archive
7ffff6c6e000-7ffff6c83000 r-xp 00000000 08:21 8333589                   
/export/gnu/import/rrs/167895/usr/lib64/libgcc_s.so.1
7ffff6c83000-7ffff6e82000 ---p 00015000 08:21 8333589                   
/export/gnu/import/rrs/167895/usr/lib64/libgcc_s.so.1
7ffff6e82000-7ffff6e83000 rw-p 00014000 08:21 8333589                   
/export/gnu/import/rrs/167895/usr/lib64/libgcc_s.so.1
7ffff6e83000-7ffff6f07000 r-xp 00000000 08:07 32870                     
/lib64/libm-2.12.90.so
7ffff6f07000-7ffff7106000 ---p 00084000 08:07 32870                     
/lib64/libm-2.12.90.so
7ffff7106000-7ffff7107000 r--p 00083000 08:07 32870                     
/lib64/libm-2.12.90.so
7ffff7107000-7ffff7108000 rw-p 00084000 08:07 32870                     
/lib64/libm-2.12.90.so
7ffff7108000-7ffff71eb000 r-xp 00000000 08:21 8333566                   
/export/gnu/import/rrs/167895/usr/lib64/libstdc++.so.6.0.15
7ffff71eb000-7ffff73eb000 ---p 000e3000 08:21 8333566                   
/export/gnu/import/rrs/167895/usr/lib64/libstdc++.so.6.0.15
7ffff73eb000-7ffff73f3000 r--p 000e3000 08:21 8333566                   
/export/gnu/import/rrs/167895/usr/lib64/libstdc++.so.6.0.15
7ffff73f3000-7ffff73f5000 rw-p 000eb000 08:21 8333566                   
/export/gnu/import/rrs/167895/usr/lib64/libstdc++.so.6.0.15
7ffff73f5000-7ffff740a000 rw-p 00000000 00:00 0 
7ffff740a000-7ffff75a4000 r-xp 00000000 08:07 26780                     
/lib64/libc-2.12.90.so
7ffff75a4000-7ffff77a3000 ---p 0019a000 08:07 26780                     
/lib64/libc-2.12.90.so
7ffff77a3000-7ffff77a7000 r--p 00199000 08:07 26780                     
/lib64/libc-2.12.90.so
7ffff77a7000-7ffff77a8000 rw-p 0019d000 08:07 26780                     
/lib64/libc-2.12.90.so
7ffff77a8000-7ffff77ae000 rw-p 00000000 00:00 0 
7ffff77ae000-7ffff77c4000 r-xp 00000000 08:07 8868                      
/lib64/libz.so.1.2.5
7ffff77c4000-7ffff79c4000 ---p 00016000 08:07 8868                      
/lib64/libz.so.1.2.5
7ffff79c4000-7ffff79c5000 rw-p 00016000 08:07 8868                      
/lib64/libz.so.1.2.5
7ffff79c5000-7ffff79c7000 r-xp 00000000 08:07 32841                     
/lib64/libdl-2.12.90.so
7ffff79c7000-7ffff7bc7000 ---p 00002000 08:07 32841                     
/lib64/libdl-2.12.90.so
7ffff7bc7000-7ffff7bc8000 r--p 00002000 08:07 32841                     
/lib64/libdl-2.12.90.so
7ffff7bc8000-7ffff7bc9000 rw-p 00003000 08:07 32841                     
/lib64/libdl-2.12.90.so
7ffff7bc9000-7ffff7bdb000 r-xp 00000000 08:07 15478                     
/usr/lib64/libmpc.so.2.0.0
7ffff7bdb000-7ffff7ddb000 ---p 00012000 08:07 15478                     
/usr/lib64/libmpc.so.2.0.0
7ffff7ddb000-7ffff7ddc000 rw-p 00012000 08:07 15478                     
/usr/lib64/libmpc.so.2.0.0
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:07 27617                     
/lib64/ld-2.12.90.so
7ffff7eb2000-7ffff7fdc000 rw-p 00000000 00:00 0 
7ffff7fe7000-7ffff7ffb000 rw-p 00000000 00:00 0 
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:07 27617                     
/lib64/ld-2.12.90.so
7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:07 27617                     
/lib64/ld-2.12.90.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                         
[stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                 
[vsyscall]

[Bug tree-optimization/46987] [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46987

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |jamborm at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #2 from Martin Jambor <jamborm at gcc dot gnu.org> 2010-12-17 13:58:21 UTC ---
Yes, I know.  Mine.

[Bug tree-optimization/46987] [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46987

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> 2010-12-17 16:12:25 UTC ---
I've nailed this down to

  gimple_call_set_arg (call_stmt, 0, tmp);

in gimple_adjust_this_by_delta.  When I comment it out, the corruption
goes away (though the produced code is of course wrong).  Otherwise it
all blows up later in tree-ssa-ccp.  (The new parameter is a result of
a new PTR_PLUS with a thunk delta which is a constant).

But I don't see anything wrong with gimple_adjust_this_by_delta, at
least not at the moment...

[Bug tree-optimization/46987] [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46987

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> 2010-12-20 18:35:51 UTC ---
OK, it's not later, the folding is called from within ccp which I
guess is not happy that there is a new ssa name or some such nuisance.

Which means that the best fix is probably to go ahead and commit

http://gcc.gnu.org/ml/gcc-patches/2010-12/msg01217.html

which I wanted to wait with but this is a good reason not to.  I'll
re-test and do it tomorrow.

[Bug tree-optimization/46987] [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46987

--- Comment #5 from Martin Jambor <jamborm at gcc dot gnu.org> 2010-12-22 12:57:00 UTC ---
Author: jamborm
Date: Wed Dec 22 12:56:54 2010
New Revision: 168168

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=168168
Log:
2010-12-22  Martin Jambor  <mjambor@suse.cz>

    PR tree-optimization/45934
    PR tree-optimization/46302
    PR tree-optimization/46987
    * gimple-fold.c (get_base_binfo_for_type): Removed.
    (gimple_get_relevant_ref_binfo): Likewise.
    (gimple_fold_obj_type_ref_call): Dumb down to 4.5 functionality,
    removed parameter inplace, updated the caller.
    * gimple.h (gimple_get_relevant_ref_binfo): Remove declaration.
    * ipa-cp.c (ipcp_propagate_types): Do not derive types from constants.
    (ipcp_discover_new_direct_edges): Do not do devirtualization based on
    constants.
    * ipa-prop.c (compute_known_type_jump_func): Use
    get_ref_base_and_extent and get_binfo_at_offset instead of
    gimple_get_relevant_ref_binfo.
    (compute_known_type_jump_func): Likewise.
    (update_jump_functions_after_inlining): Do not derive types from
    constants.
    (try_make_edge_direct_virtual_call): Likewise.
    * tree.c (get_binfo_at_offset): Get type from non-artificial fields.

    * testsuite/g++.dg/ipa/ipcp-ivi-1.C: Removed.
    * testsuite/g++.dg/ipa/ivinline-6.C: Likewise.
    * testsuite/g++.dg/otr-fold-1.C: Likewise.
    * testsuite/g++.dg/otr-fold-2.C: Likewise.
    * testsuite/g++.dg/tree-ssa/pr43411.C: Xfail dump scan.
    * testsuite/g++.dg/tree-ssa/pr45605.C: Likewise.
    * testsuite/g++.dg/tree-ssa/pr46987.C: New test.


Added:
    trunk/gcc/testsuite/g++.dg/tree-ssa/pr46987.C
Removed:
    trunk/gcc/testsuite/g++.dg/ipa/ipcp-ivi-1.C
    trunk/gcc/testsuite/g++.dg/ipa/ivinline-6.C
    trunk/gcc/testsuite/g++.dg/otr-fold-1.C
    trunk/gcc/testsuite/g++.dg/otr-fold-2.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/gimple-fold.c
    trunk/gcc/gimple.h
    trunk/gcc/ipa-cp.c
    trunk/gcc/ipa-prop.c
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/g++.dg/tree-ssa/pr43411.C
    trunk/gcc/testsuite/g++.dg/tree-ssa/pr45605.C
    trunk/gcc/tree.c

[Bug tree-optimization/46987] [4.6 Regression] g++.dg/torture/covariant-1.C ICE: double free or corruption with -fno-inline

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46987

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> 2010-12-22 13:23:39 UTC ---
Fixed.