[Bug c++/47290] New: memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[Bug c++/47290] New: memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[gcc at abeckmann dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

           Summary: memory exhausted compiling a destructor with an
                    infinite 'for (;;);' loop
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: gcc@abeckmann.de


The following piece of code consumes all available memory when being compiled
with g++ 4.5 or g++ 4.6 and optimization level -O2 or higher. It compiles
correctly with g++ 4.4.

gcc version 4.6.0 20110111 (experimental) (GCC)
gcc version 4.5.3 20110110 (prerelease) (GCC)

===== 8< =====
struct V
{
        V ( int = 0 ) ;
        ~V ()
        {
                for ( ; ; ) ;
        }
        int size () ;
} ;
struct S
{
        V a ;
        V b ;
        S () : b ( a . size () )
        { }
} ;
S s ;
===== >8 =====

$ ulimit -v
7000000
# limited to about 7 GB ouf of my 8 GB of RAM so the machine does not start to
swap heavily

$ g++-trunk -O2 -c memhog.C
virtual memory exhausted: Cannot allocate memory

$ g++-trunk -v -O2 -c memhog.C
Using built-in specs.
COLLECT_GCC=/opt/software/x86_64/gcc-trunk/bin/g++-trunk
COLLECT_LTO_WRAPPER=/opt/software/x86_64/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/opt/software/x86_64/gcc-trunk
--program-suffix=-trunk --enable-languages=c,c++ --enable-checking
Thread model: posix
gcc version 4.6.0 20110111 (experimental) (GCC)
COLLECT_GCC_OPTIONS='-v' '-O2' '-c' '-shared-libgcc' '-mtune=generic'
'-march=x86-64'

/opt/software/x86_64/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus
-quiet -v -D_GNU_SOURCE memhog.C -quiet -dumpbase memhog.C -mtune=generic
-march=x86-64 -auxbase memhog -O2 -version -o /tmp/ccmZpTnX.s
GNU C++ (GCC) version 4.6.0 20110111 (experimental) (x86_64-unknown-linux-gnu)
        compiled by GNU C version 4.6.0 20110111 (experimental), GMP version
4.3.2, MPFR version 3.0.0-p3, MPC version 0.8.2
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
ignoring nonexistent directory
"/opt/software/x86_64/gcc-trunk/lib/gcc/x86_64-unknown-linux-gnu/4.6.0/../../../../x86_64-unknown-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:

/opt/software/x86_64/gcc-trunk/lib/gcc/x86_64-unknown-linux-gnu/4.6.0/../../../../include/c++/4.6.0

/opt/software/x86_64/gcc-trunk/lib/gcc/x86_64-unknown-linux-gnu/4.6.0/../../../../include/c++/4.6.0/x86_64-unknown-linux-gnu

/opt/software/x86_64/gcc-trunk/lib/gcc/x86_64-unknown-linux-gnu/4.6.0/../../../../include/c++/4.6.0/backward
 /opt/software/x86_64/gcc-trunk/lib/gcc/x86_64-unknown-linux-gnu/4.6.0/include
 /usr/local/include
 /opt/software/x86_64/gcc-trunk/include

/opt/software/x86_64/gcc-trunk/lib/gcc/x86_64-unknown-linux-gnu/4.6.0/include-fixed
 /usr/include
End of search list.
GNU C++ (GCC) version 4.6.0 20110111 (experimental) (x86_64-unknown-linux-gnu)
        compiled by GNU C version 4.6.0 20110111 (experimental), GMP version
4.3.2, MPFR version 3.0.0-p3, MPC version 0.8.2
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: e48296e048ab4023a18c7e7537bfd602
virtual memory exhausted: Cannot allocate memory

[Bug c++/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |memory-hog
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011.01.14 14:20:44
            Summary|memory exhausted compiling  |[4.5/4.6 Regression] memory
                   |a destructor with an        |exhausted compiling a
                   |infinite 'for (;;);' loop   |destructor with an infinite
                   |                            |'for (;;);' loop
     Ever Confirmed|0                           |1

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> 2011-01-14 14:20:44 UTC ---
confirmed as regression since 4.4

seems to stop allocating at about 10GB, then just consumes 100% cpu until
killed

[Bug c++/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.5.3

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-17 14:49:53 UTC ---
Created attachment 22995
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=22995
gcc46-pr47290.patch

Ugh, cddce pass for empty loop:
<L0>:

<bb 6>:
  goto <bb 6>;

creates a preheader:

<L0>:

<bb 6>:

<bb 7>:
  goto <bb 6>;

so suddenly we have an empty infinite loop containing two bbs instead of one,
on which cleanup_empty_eh keeps up oscillating between the landing pads on bb 6
and on bb 7 forever.  There is a check already for empty infinite loops, but it
covers just those containing just single bb, not more than that.

I wonder if ehcleanup should be prepared for empty infinite loops containing
arbitrary number of bbs, or if worst case two of them should be possible (that
can be fixed by the attached patch) and why a preheader is created inside of
the loop instead of before it.

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-17 15:21:36 UTC ---
Small correction, the empty infinite loop is not split because of preheader
creation, but because of force_single_succ_latches - the condition there causes
edge split even when latch has single succ if header and latch are the same:
if (loop->latch != loop->header && single_succ_p (loop->latch))
  continue;

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #4 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-01-18 10:31:32 UTC ---
How about

Index: tree-eh.c
===================================================================
--- tree-eh.c   (revision 168906)
+++ tree-eh.c   (working copy)
@@ -3710,6 +3710,9 @@ cleanup_empty_eh_unsplit (basic_block bb
     if (find_edge (e->src, e_out->dest))
       return false;

+  if (!single_pred_p (e_out->dest))
+    return false;
+
   /* Attempt to move the PHIs into the successor block.  */
   if (cleanup_empty_eh_merge_phis (e_out->dest, bb, e_out, false))
     {

?  The condition before was added by me for another corner-case and
of course could be removed with that patch.

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #5 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-01-18 10:32:06 UTC ---
CCing Honza.  What kind of simplifications did we want to catch here?

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 13:07:06 UTC ---
Created attachment 23017
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=23017
gcc46-pr47290.patch

Another possible untested patch that should handle any number of bbs in empty
infinite loop.

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 13:10:19 UTC ---
We could also limit the number of iterations:
   int i;

-  for (i = 1; VEC_iterate (eh_landing_pad, cfun->eh->lp_array, i, lp); ++i)
+  int len = VEC_length (eh_landing_pad, cfun->eh->lp_array) * 2;
+  for (i = 1; 
+       VEC_iterate (eh_landing_pad, cfun->eh->lp_array, i, lp) && i < len;
+       i++)
     if (lp)
       changed |= cleanup_empty_eh (lp);

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #8 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-01-18 13:39:47 UTC ---
(In reply to comment #7)
> We could also limit the number of iterations:
>    int i;
> 
> -  for (i = 1; VEC_iterate (eh_landing_pad, cfun->eh->lp_array, i, lp); ++i)
> +  int len = VEC_length (eh_landing_pad, cfun->eh->lp_array) * 2;
> +  for (i = 1; 
> +       VEC_iterate (eh_landing_pad, cfun->eh->lp_array, i, lp) && i < len;
> +       i++)
>      if (lp)
>        changed |= cleanup_empty_eh (lp);

won't it still say "changed" and iterate in the caller?  Note that we could
avoid the above if we'd avoid generating new landing-pads and instead moved
the old ones.

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 13:49:18 UTC ---
cleanup_all_empty_eh is called just once per ehcleanup pass, doesn't iterate.
If we don't want to iterate on the new pads, we could just use len = VEC_length
too, but IMHO some iteration is helpful, as we don't recurse on them, and we
probably want to handle cases like moving pads across two empty bbs and with a
resx in the third bb or something similar.

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rth at gcc dot gnu.org

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 13:50:07 UTC ---
CCing Richard, as he wrote this function...

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #11 from Richard Henderson <rth at gcc dot gnu.org> 2011-01-18 16:45:09 UTC ---
Jakub, I'm fine with your second patch to detect infinite loops, with
the proviso that you break out the test into a separate function.

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 17:20:56 UTC ---
Created attachment 23020
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=23020
gcc46-pr47290.patch

Like this (still untested but on this testcase)?

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #13 from Richard Henderson <rth at gcc dot gnu.org> 2011-01-18 18:20:49 UTC ---
Looks good.  Ok if it passes tests.

[Bug tree-optimization/47290] [4.5/4.6 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 23:16:18 UTC ---
Author: jakub
Date: Tue Jan 18 23:16:16 2011
New Revision: 168974

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=168974
Log:
    PR tree-optimization/47290
    * tree-eh.c (infinite_empty_loop_p): New function.
    (cleanup_empty_eh): Use it.

    * g++.dg/torture/pr47290.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr47290.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-eh.c

[Bug tree-optimization/47290] [4.5 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
      Known to work|                            |4.6.0
         AssignedTo|unassigned at gcc dot       |jakub at gcc dot gnu.org
                   |gnu.org                     |
            Summary|[4.5/4.6 Regression] memory |[4.5 Regression] memory
                   |exhausted compiling a       |exhausted compiling a
                   |destructor with an infinite |destructor with an infinite
                   |'for (;;);' loop            |'for (;;);' loop
      Known to fail|4.6.0                       |

--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 23:19:47 UTC ---
Fixed on the trunk so far.

[Bug tree-optimization/47290] [4.5 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/47290] [4.5 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

--- Comment #16 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-04-18 15:25:23 UTC ---
Author: rguenth
Date: Mon Apr 18 15:25:17 2011
New Revision: 172653

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=172653
Log:
2011-04-18  Richard Guenther  <rguenther@suse.de>

    Backported from 4.6 branch
    2011-01-19  Jakub Jelinek  <jakub@redhat.com>

    PR tree-optimization/47290
    * tree-eh.c (infinite_empty_loop_p): New function.
    (cleanup_empty_eh): Use it.

    * g++.dg/torture/pr47290.C: New test.

    2010-05-29  Jan Hubicka  <jh@suse.cz>

    PR tree-optimization/46364
    * cgraphunit.c (cgraph_materialize_clone): Only remove calles, refs
    and body;
    not the whole node for masters of materialized clones.

    * g++.dg/torture/pr46364.C: New testcase.

Added:
    branches/gcc-4_5-branch/gcc/testsuite/g++.dg/torture/pr46364.C
    branches/gcc-4_5-branch/gcc/testsuite/g++.dg/torture/pr47290.C
Modified:
    branches/gcc-4_5-branch/gcc/ChangeLog
    branches/gcc-4_5-branch/gcc/cgraphunit.c
    branches/gcc-4_5-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_5-branch/gcc/tree-eh.c

[Bug tree-optimization/47290] [4.5 Regression] memory exhausted compiling a destructor with an infinite 'for (;;);' loop

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47290

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #17 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-04-18 15:26:52 UTC ---
Fixed.