[Bug tree-optimization/50644] New: ICE in set_is_used added today

[Bug tree-optimization/50644] New: ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

             Bug #: 50644
           Summary: ICE in set_is_used added today
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: andi-gcc@firstfloor.org


Since updating to today's trunk I get a ICE in set_is_used while building
a LTOed linux kernel. Yesterday it didn't happen

Running a bisect.

Here's the crash

#7  <signal handler called> 
#8  set_is_used (var=<value optimized out>) at
+../../gcc/gcc/tree-flow-inline.h:562
#9  mark_all_vars_used_1 (var=<value optimized out>) at
+../../gcc/gcc/tree-ssa-live.c:379
#10 0x0000000000860b3e in walk_tree_1 (tp=0x2b11d2f00c00, func=0x7a4390
+<mark_all_vars_used_1(tree*, int*, void*)>, 
    data=0x4296a40, pset=0x0, lh=0) at ../../gcc/gcc/tree.c:10448
#11 0x0000000000860f89 in walk_tree_1 (tp=0x2b11d2efacd0, func=0x7a4390
+<mark_all_vars_used_1(tree*, int*, void*)>, 
    data=0x4296a40, pset=0x0, lh=0) at ../../gcc/gcc/tree.c:10526
#12 0x00000000007a4eb5 in mark_all_vars_used (data=<value optimized out>,
+expr_p=<value optimized out>)
    at ../../gcc/gcc/tree-ssa-live.c:595
#13 remove_unused_locals (data=<value optimized out>, expr_p=<value optimized
+out>)
    at ../../gcc/gcc/tree-ssa-live.c:798
#14 0x000000000068c268 in execute_function_todo (data=Unhandled dwarf
+expression opcode 0xf3
) at ../../gcc/gcc/passes.c:1695
#15 0x000000000068d114 in execute_todo (flags=2132516) at
+../../gcc/gcc/passes.c:1741
#16 0x000000000068f3ce in execute_one_ipa_transform_pass (ipa_pass=0x10ac6e0,
+node=0x2b11e3116ea0)
    at ../../gcc/gcc/passes.c:1919
#17 execute_all_ipa_transforms (ipa_pass=0x10ac6e0, node=0x2b11e3116ea0) at
+../../gcc/gcc/passes.c:1947
#18 0x000000000075fd20 in tree_rest_of_compilation (fndecl=0x2b11d2ed7300) at
+../../gcc/gcc/tree-optimize.c:413
#19 0x000000000051b8a6 in cgraph_expand_function (node=0x2b11e3116ea0) at
+../../gcc/gcc/cgraphunit.c:1805
#20 0x000000000051d182 in cgraph_output_in_order () at
+../../gcc/gcc/cgraphunit.c:1962
#21 cgraph_optimize () at ../../gcc/gcc/cgraphunit.c:2136

...
(gdb) up
#8  set_is_used (var=<value optimized out>) at
+../../gcc/gcc/tree-flow-inline.h:562
562       ann->used = true;
(gdb) p ann
$1 = (var_ann_d *) 0x0

[Bug tree-optimization/50644] ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

Andi Kleen <andi-gcc at firstfloor dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |matz at gcc dot gnu.org

--- Comment #1 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-06 23:53:57 UTC ---
Problem is caused by 

commit 6d3d8bf0e6cb73524be01e28cb82a484cd3d11fd
Author: matz <matz@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Thu Oct 6 15:18:12 2011 +0000

        * tree-flow.h (get_var_ann): Don't declare.
        * tree-flow-inline.h (get_var_ann): Remove.
        (set_is_used): Use var_ann, not get_var_ann.
        * tree-dfa.c (add_referenced_var): Inline body of get_var_ann.
        * tree-profile.c (gimple_gen_edge_profiler): Call
        find_referenced_var_in.
        (gimple_gen_interval_profiler): Ditto.
        (gimple_gen_pow2_profiler): Ditto.
        (gimple_gen_one_value_profiler): Ditto.
        (gimple_gen_average_profiler): Ditto.
        (gimple_gen_ior_profiler): Ditto.
        (gimple_gen_ic_profiler): Ditto plus call add_referenced_var.
        (gimple_gen_ic_func_profiler): Call add_referenced_var.
        * tree-mudflap.c (execute_mudflap_function_ops): Call
        add_referenced_var.

I cannot give you a small test case because it needs a full LTO
builddir

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #2 from Michael Matz <matz at gcc dot gnu.org> 2011-10-07 15:45:44 UTC ---
Try to find out what var is.  The segfault should also happen with an
unoptimized cc1 so that you can see the value of var.

[Bug tree-optimization/50644] ICE in set_is_used added today

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-10-07 16:30:41 UTC ---
+FAIL: gfortran.dg/select_type_12.f03  -O  (internal compiler error)
+FAIL: gfortran.dg/select_type_12.f03  -O  (test for excess errors)
is also ICE in set_is_used, both on x86_64-linux and i686-linux.

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #4 from Michael Matz <matz at gcc dot gnu.org> 2011-10-07 16:34:49 UTC ---
The fortran segfault is tracked as PR50640.

[Bug tree-optimization/50644] ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #5 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-13 13:22:40 UTC ---
Note I need to keep reverting this patch to do any substantial builds.

I hear it's also failing for other too.

Any progress in fixing it? Thanks.

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #6 from Michael Matz <matz at gcc dot gnu.org> 2011-10-13 14:04:36 UTC ---
See comment #2, you need to help in debugging it.  I can't reproduce, the
emutls problem is fixed, and with the information I have I can't speculate
which (probably global) variables need the add_referenced_var calls.

[Bug tree-optimization/50644] ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #7 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-20 05:53:49 UTC ---
Can someone mark this as a regression please? This still keeps crashing and
crashing.

I don't see why I need to debug a clear regression when I already bisected
it.

IMHO this should be reverted.

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #8 from Michael Matz <matz at gcc dot gnu.org> 2011-10-20 08:14:45 UTC ---
Andi, the patch you bisected transformed a pre-existing bug into a segfault. 
Reverting it wouldn't fix anything.
You could try the stab-in-the-dark patch from PR50741, but if that doesn't help
I don't see how to make progress here without somebody who sees the problem to
go into gdb and do a 'p debug_tree(var)' on a cc1 that has
enough debuginfo for var to still contain a useful value.

[Bug tree-optimization/50644] ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #9 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-20 14:05:49 UTC ---
Previously the builds produced working code. Now they just segfault.
If I revert the patches (plus the ones depending on it) I get working
code again.

In my book that's a "fix". I don't know what the bug was, but it can't
be worth ICEing instead.

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #10 from Michael Matz <matz at gcc dot gnu.org> 2011-10-20 16:15:36 UTC ---
Why is it so difficult to just fire up gdb?  This all could be solved in a
couple of minutes.

[Bug tree-optimization/50644] ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #11 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-20 16:30:27 UTC ---
I did fire gdb up of course, the output is in the initial report.
I also tracked it down to exactly your commit.

[Bug tree-optimization/50644] ICE in set_is_used added today

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-10-20 16:39:15 UTC ---
It doesn't contain enough info though.
In particular, it would be nice to see
p debug_tree (*(tree *)0x2b11d2f00c00)
(the first argument for the innermost walk_tree_1)
and possibly for the outer one too and maybe track through conditional
breakpoint on ggc-page.c ggc_alloc_stat return stmt where the VAR_DECL in it
has been created.

[Bug tree-optimization/50644] ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #13 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-20 16:44:42 UTC ---
I only have a core file. It's really hard to catch the correct lto1
in gdb in a complex LTO build. The only sane way I found to at least
get some gdb information is to use -dH and use the corefile.
But then calling debug_tree doesn't work of course.

[Bug tree-optimization/50644] ICE in set_is_used added today

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #14 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-29 11:31:31 UTC ---
Created attachment 25658
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25658
3 files

I managed to reduce a test case to 3 LTO files now

unpack the tar on x86-64 and
gcc47 -O2 -flto arch/x86/kernel/tsc_sync.i arch/x86/kernel/smp.i
arch/x86/kernel/smpboot.i

[Bug tree-optimization/50644] ICE in set_is_used added today

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markus at trippelsdorf dot
                   |                            |de

--- Comment #15 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2011-10-29 12:58:43 UTC ---
Further reduced:

markus@x4 testcase % cat smpboot.i 
struct _ddebug {
     const char *modname;
     const char *function;
     const char *filename;
     const char *format;
     char enabled;
}
cpumask_t;
extern void check_tsc_sync_source(int cpu);
int native_cpu_up(unsigned int cpu)
{
     int err;
     static struct _ddebug descriptor  = {
             "", __func__, "", "", 866, 0};
               if (__builtin_expect(!!(descriptor.enabled), 0))
                 __dynamic_pr_debug(&descriptor, "", err);
     check_tsc_sync_source(cpu);
}

markus@x4 testcase % cat smp.i 
struct smp_ops {
     void (*smp_prepare_boot_cpu)(void);
     void (*smp_prepare_cpus)(unsigned max_cpus);
     void (*smp_cpus_done)(unsigned max_cpus);
     void (*stop_other_cpus)(int wait);
     void (*smp_send_reschedule)(int cpu);
     int (*cpu_up)(unsigned cpu);
     int (*cpu_disable)(void);
     void (*cpu_die)(unsigned int cpu);
     void (*play_dead)(void);
     void (*send_call_func_ipi)(const struct cpumask *mask);
     void (*send_call_func_single_ipi)(int cpu);
};
int native_cpu_up(unsigned int cpunum);
void native_cpu_die(unsigned int cpu);
struct kernel_symbol {
     unsigned long value;
};
struct smp_ops smp_ops = {
     .cpu_up = native_cpu_up,  .cpu_die = native_cpu_die,
};
static const char __kstrtab_smp_ops[] = "" "smp_ops";
static const struct kernel_symbol 
__ksymtab_smp_ops __attribute__((__used__)) = {
     (unsigned long)&smp_ops
};

markus@x4 testcase % cat tsc_sync.i 
typedef struct {} atomic_t;
struct _ddebug {
     const char *modname;
     const char *function;
     const char *filename;
     const char *format;
     char enabled;
};
extern __typeof__(int) cpu_number;
static atomic_t start_count;
void check_tsc_sync_source(int cpu)
{
 if (unsynchronized_tsc())   return;
  else {
    do {
        static struct _ddebug descriptor = {
        "", __func__, "", 151, 0 };
        if (__builtin_expect(!!(descriptor.enabled), 0))
        __dynamic_pr_debug(&descriptor, "", 
        (({
            typeof(cpu_number) pfo_ret__;
            switch (sizeof(cpu_number)) {
             case 4:
              asm("mov" "l ""%%""gs"":" "%P" "1"",%0" :
              "=r" (pfo_ret__) : "m" (cpu_number));
             }
             pfo_ret__;
         })), cpu);
         } while (0);
  }
 atomic_set(&start_count, 0);
}

markus@x4 testcase % gcc smpboot.i smp.i tsc_sync.i -w -Os -flto
In file included from :0:0:
smpboot.i: In function ‘native_cpu_up’:
smpboot.i:10:5: internal compiler error: Segmentation fault
Please submit a full bug report

[Bug tree-optimization/50644] ICE in set_is_used added today

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #16 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2011-10-29 13:08:13 UTC ---
Or as one file:

 % cat test.i
struct _ddebug {
     const char *modname;
     const char *function;
     const char *filename;
     const char *format;
     char enabled;
}
cpumask_t;
int native_cpu_up(unsigned int cpu)
{
     int err;
     static struct _ddebug descriptor  = {
          "", __func__, "", "", 866, 0
     };
     if (__builtin_expect(!!(descriptor.enabled), 0))
     __dynamic_pr_debug(&descriptor, "", err);
     check_tsc_sync_source(cpu);
}
struct smp_ops {
     int (*cpu_up)(unsigned cpu);
     void (*cpu_die)(unsigned int cpu);
};
void native_cpu_die(unsigned int cpu);
struct kernel_symbol {
     unsigned long value;
};
struct smp_ops smp_ops = {
     .cpu_up = native_cpu_up,  .cpu_die = native_cpu_die,
};
static const struct kernel_symbol
__ksymtab_smp_ops __attribute__((__used__)) = {
     (unsigned long)&smp_ops
};
typedef struct {
}
atomic_t;
extern __typeof__(int) cpu_number;
static atomic_t start_count;
void check_tsc_sync_source(int cpu)
{
     if (unsynchronized_tsc())   return;
     else {
          do {
               static struct _ddebug descriptor = {
                    "", __func__, "", 151, 0
               };
               if (__builtin_expect(!!(descriptor.enabled), 0))
               __dynamic_pr_debug(&descriptor, "",          (( {
                    typeof(cpu_number) pfo_ret__;
                    switch (sizeof(cpu_number)) {
                    case 4:
                         asm("mov" "l ""%%""gs"":" "%P" "1"",%0" :
                         "=r" (pfo_ret__) : "m" (cpu_number));
                    }
                    pfo_ret__;
               }
               )), cpu);
          } while (0);
     }
     atomic_set(&start_count, 0);
}

 % gcc test.i -w -O2 -flto
In file included from :0:0:
test.i: In function ‘native_cpu_up’:
test.i:9:5: internal compiler error: Segmentation fault
Please submit a full bug report

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #17 from Michael Matz <matz at gcc dot gnu.org> 2011-10-31 13:16:49 UTC ---
Thank you very much!  This really helps and at least reveals something quite
strange with LTO.  It falls over the __func__ member of one of the two
static initializers:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000b757b0 in set_is_used (var=0x7ffff527b320)
    at ../../gcc/gcc/tree-flow-inline.h:562
562       ann->used = true;
(gdb) p debug_generic_expr (var)
__func__
(gdb) up
...
#4  0x0000000000b77d7e in mark_all_vars_used (expr_p=0x7ffff527b2d0,
    data=0x1a823f0) at ../../gcc/gcc/tree-ssa-live.c:595
595       walk_tree (expr_p, mark_all_vars_used_1, data, NULL);
(gdb) p debug_generic_expr (*expr_p)
{.modname="", .function=&__func__, .filename="", .format=151B, .enabled=0}

So it walks the one with 'format=151', i.e. the one from
check_tsc_sync_source.  The strange this is:

(gdb) p debug_generic_expr (current_function_decl)
native_cpu_up

Huh?  These two functions have no relation with each other.  This static
initializer shouldn't be reached while dealing with native_cpu_up.

And indeed (from remove_unused_locals):

(gdb) p debug_tree (var)
<var_decl 0x7ffff527b280 descriptor
  ...
    context <function_decl 0x7ffff539ff00 check_tsc_sync_source>
    initial <constructor 0x7ffff5391738>>

So, we have this local static in the cfun->local_decls list, which is
just wrong.

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #18 from Michael Matz <matz at gcc dot gnu.org> 2011-10-31 13:37:33 UTC ---
Ah, wrong, native_cpu_up of course calls check_tsc_sync_source, which under
LTO can be inlined.  So it's the same issues as PR50741, the patch from
there works around the issue.  Unfortunately with the side-effect of removing
the second descriptor object (from check_tsc_sync_source) from the local_decls
list of native_cpu_up.  This happens also before the patch when the segfault
is worked around by source changes (s/__func__/0/), so that's not a
regression.

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #19 from Michael Matz <matz at gcc dot gnu.org> 2011-10-31 13:41:59 UTC ---
Bah, I checked against the patched compiler.  Nope, with the unpatched
compiler both descriptor variables stay in the local_decls of native_cpu_up
after inlining (with the source change to not segfault).  So this side effect
of the patch needs to be taken into account.

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

--- Comment #20 from Michael Matz <matz at gcc dot gnu.org> 2011-11-17 16:04:04 UTC ---
Author: matz
Date: Thu Nov 17 16:03:56 2011
New Revision: 181443

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=181443
Log:
    PR middle-end/50644
    PR middle-end/50741

    * tree-ssa-live.c (mark_all_vars_used_1): Recurse only for decls of
    current function.
    (remove_unused_locals): Ditto.

testsuite/

    * g++.dg/tree-ssa/pr50741.C: New.

Added:
    trunk/gcc/testsuite/g++.dg/tree-ssa/pr50741.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-live.c

[Bug tree-optimization/50644] ICE in set_is_used added today

[matz at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50644

Michael Matz <matz at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #21 from Michael Matz <matz at gcc dot gnu.org> 2011-11-17 16:08:12 UTC ---
Fixed.  Sorry it took so long, but thanks for the testcase.