[Bug rtl-optimization/55158] New: ICE: [4.8 Regreesion] [IA64] segv in schedule_region

[Bug rtl-optimization/55158] New: ICE: [4.8 Regreesion] [IA64] segv in schedule_region

[gary at intrepid dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

             Bug #: 55158
           Summary: ICE: [4.8 Regreesion] [IA64] segv in schedule_region
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: gary@intrepid.com


Created attachment 28587
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28587
Test case: gcc segv when compiled at -O3 on IA64

See attached test case.

$ bld/gcc/cc1 -O3 gcc-ice-schedule-region.c -o gcc-ice-schedule-region.o
 gasneti_check_node_list
Analyzing compilation unit
Performing interprocedural optimizations
 <*free_lang_data> <visibility> <early_local_cleanups> <*free_inline_summary>
<whole-program> <profile_estimate> <cp> <inline> <pure-const>
<static-var>Assembling functions:
 gasneti_check_node_list
gcc-ice-schedule-region.c: In function ‘gasneti_check_node_list’:
gcc-ice-schedule-region.c:53:1: internal compiler error: Segmentation fault
 }
 ^
0x4000000000b7b22f crash_signal
        src/gcc/toplev.c:333
0x4000000000ac2aaf schedule_region
        src/gcc/sched-rgn.c:2998
0x4000000000ac2aaf schedule_insns()
        src/gcc/sched-rgn.c:3343

Here is the schedule_region source at that location.

2993              f = find_fallthru_edge (last_bb->succs);
2994              if (f && f->probability * 100 / REG_BR_PROB_BASE >=
2995                  PARAM_VALUE (PARAM_SCHED_STATE_EDGE_PROB_CUTOFF))
2996                {
2997                  memcpy (bb_state[f->dest->index], curr_state,
2998                          dfa_state_size);
2999                  if (sched_verbose >= 5)
3000                    fprintf (sched_dump, "saving state for edge %d->%d\n",
3001                             f->src->index, f->dest->index);
3002                }

Here is the value of f->dest->index at the pointed and the value of the
selected element of bb_state.

(gdb) p f->dest->index
$1 = 23
(gdb) p bb_state[23]
$2 = (state_t) 0x431

Clearly not a valid address.

(gdb) p bb_state[22]
$3 = (state_t) 0x60000000002f3d58

While the element before it looks OK.

This issue seemed to be introduced by this check in.

2012-10-08  Bernd Schmidt  <bernds@codesourcery.com>

        * sched-int.h (schedule_block): Adjust declaration.
        * sched-rgn.c (bb_state_array, bb_state): New static variables.
        (sched_rgn_init): Initialize them.
        (sched_rgn_free): Free them.
        (schedule_region): Save scheduling state for future blocks, and

which is svn revision 192203.

[Bug rtl-optimization/55158] ICE: [4.8 Regreesion] [IA64] segv in schedule_region

[gary at intrepid dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #1 from Gary Funck <gary at intrepid dot com> 2012-11-01 00:15:54 UTC ---
Some additional debugging information.

In sched_rgn_init(), the bb_state array is initialized.

3049        {
3050          bb_state_array = (char *) xmalloc (last_basic_block *
dfa_state_size);
3051          bb_state = XNEWVEC (state_t, last_basic_block);
3052          for (i = 0; i < last_basic_block; i++)
3053            {
3054              bb_state[i] = (state_t) (bb_state_array + i *
dfa_state_size);
3055          
3056              state_reset (bb_state[i]);
3057            }
3058        }

For the given test case.

(gdb) p last_basic_block
$3 = 23

Yet, it is the access of bb_state[23] that leads to the segfault.

The last basic block is 23, and the array bb_state[] is initialized only for
entries 0..22.  Perhaps the number entries allocated should be
(last_basic_block +  1) with the initialization loop adjusted accordingly?

[Bug rtl-optimization/55158] ICE: [4.8 Regreesion] [IA64] segv in schedule_region

[gary at intrepid dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #2 from Gary Funck <gary at intrepid dot com> 2012-11-01 00:35:41 UTC ---
I tried making the change suggested in the previous comment and ran into a
segfault here:

5876        dump_new_block_header (0, *target_bb, head, tail);
5877
5878      if (init_state == NULL)
5879        state_reset (curr_state);
5880      else
5881        memcpy (curr_state, init_state, dfa_state_size);
5882
5883      /* Clear the ready list.  */
5884      ready.first = ready.veclen - 1;
5885      ready.n_ready = 0;

(gdb) p init_state
$10 = (state_t) 0x431

init_state is an invalid pointer.

Going up one level.

2985          curr_bb = first_bb;
2986          if (dbg_cnt (sched_block))
2987            {
2988              edge f;
2989
2990              schedule_block (&curr_bb, bb_state[first_bb->index]);
2991              gcc_assert (EBB_FIRST_BB (bb) == first_bb);
2992              sched_rgn_n_insns += sched_n_insns;
2993              f = find_fallthru_edge (last_bb->succs);
2994              if (f && f->probability * 100 / REG_BR_PROB_BASE >=

(gdb) p first_bb->index
$13 = 25

If the last basic block is 23, then this index is out-of-range.

[Bug rtl-optimization/55158] ICE: [4.8 Regression] [IA64] segv in schedule_region

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
   Target Milestone|---                         |4.8.0

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #3 from Steven Bosscher <steven at gcc dot gnu.org> 2012-11-07 20:57:49 UTC ---
(In reply to comment #1)
> The last basic block is 23, and the array bb_state[] is initialized only
> for entries 0..22.  Perhaps the number entries allocated should be
> (last_basic_block +  1) with the initialization loop adjusted
> accordingly?

Actually, last_basic_block is already "largest bb index + 1". The name
is a bit confusing...

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-11-07
     Ever Confirmed|0                           |1

--- Comment #4 from Steven Bosscher <steven at gcc dot gnu.org> 2012-11-07 21:07:44 UTC ---
Confirmed.  The scheduler creates new basic blocks via generate_recovery_code,
leading to:

Breakpoint 5, schedule_region (rgn=0) at gcc/sched-rgn.c:2990
2990              schedule_block (&curr_bb, bb_state[first_bb->index]);
1: last_basic_block = 23
(gdb) 
Continuing.

Breakpoint 6, create_basic_block (...) at gcc/cfghooks.c:644
644       if (!cfg_hooks->create_basic_block)
1: last_basic_block = 23
(gdb) up
#1  0x... in create_empty_bb (..) at ../../trunk/gcc/cfghooks.c:662
662       return create_basic_block (NULL, NULL, after);
(gdb) 
#2  0x... in sched_create_empty_bb_1 (...) at gcc/haifa-sched.c:8479
8479      return create_empty_bb (after);
(gdb) 
#3  0x... in init_before_recovery (...) at gcc/haifa-sched.c:7491
7491          single = sched_create_empty_bb (last);
(gdb) 

But apparently some of the scheduler data structures are not resized.

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #5 from Steven Bosscher <steven at gcc dot gnu.org> 2012-11-07 21:19:42 UTC ---
Completely untested patch for someone else to foster-parent:

--- sched-rgn.c 2012-11-04 14:48:19.110019609 -0800
+++ sched-rgn.c 2012-11-07 13:17:06.740019608 -0800
@@ -2986,10 +2986,23 @@
       if (dbg_cnt (sched_block))
         {
          edge f;
+         int saved_last_basic_block = last_basic_block;

           schedule_block (&curr_bb, bb_state[first_bb->index]);
           gcc_assert (EBB_FIRST_BB (bb) == first_bb);
           sched_rgn_n_insns += sched_n_insns;
+         if (last_basic_block > saved_last_basic_block)
+           {
+             /* New basic blocks have been created, probably for
+                speculation recovery code.  Fixup the state array.  */
+             bb_state_array = (char *) xrealloc (last_basic_block *
dfa_state_size);
+             bb_state = XRESIZEVEC (state_t, bb_state, last_basic_block);
+             for (int i = saved_last_basic_block; i < last_basic_block; i++)
+               {
+                 bb_state[i] = (state_t) (bb_state_array + i *
dfa_state_size);
+                 state_reset (bb_state[i]);
+               }
+           }
          f = find_fallthru_edge (last_bb->succs);
          if (f && f->probability * 100 / REG_BR_PROB_BASE >=
              PARAM_VALUE (PARAM_SCHED_STATE_EDGE_PROB_CUTOFF))

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> 2012-11-09 14:22:55 UTC ---
Hmm, this bug currently breaks half IA-64 bencharking in our autotester.
http://gcc.opensuse.org/ (terbium)

Bernd, you seem to be last who touched this area.  Does the patch look OK for
you?
(probably these structures should be turned into VECtors).

Honza

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[gary at intrepid dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #8 from Gary Funck <gary at intrepid dot com> 2012-11-09 15:26:46 UTC ---
(In reply to comment #5)
> Completely untested patch for someone else to foster-parent:

> +               }
> +           }
>           f = find_fallthru_edge (last_bb->succs);
>           if (f && f->probability * 100 / REG_BR_PROB_BASE >=
>               PARAM_VALUE (PARAM_SCHED_STATE_EDGE_PROB_CUTOFF))

I could not apply the patch cleanly.  Perhaps it was garbled by line wraps,
etc.  Can you post the patch as an attachment?

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> 2012-11-09 16:38:16 UTC ---
OK, I applied it to our autotester and we will see tomorrow if it fixes the
segfaults.
If so, can I go ahead and commit it?

Honza

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[gary at intrepid dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #10 from Gary Funck <gary at intrepid dot com> 2012-12-01 23:17:00 UTC ---
(In reply to comment #9)
> OK, I applied it to our autotester and we will see tomorrow if it fixes the
> segfaults.
> If so, can I go ahead and commit it?
> 
> Honza

Ping: was this patch tested and then applied?

thanks.

[Bug rtl-optimization/55158] [4.8 Regression] [IA64] ICE: segv in schedule_region

[bernds at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #11 from Bernd Schmidt <bernds at gcc dot gnu.org> 2012-12-03 11:26:02 UTC ---
Sure, if tests are good, OK to apply.

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |ia64-*-*
                 CC|                            |ebotcazou at gcc dot
                   |                            |gnu.org
            Summary|[4.8 Regression] [IA64]     |[4.8 Regression] segfault
                   |ICE: segv in                |in schedule_region at -O3
                   |schedule_region             |

--- Comment #12 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2012-12-03 12:28:26 UTC ---
Someone needs to do something here because the C/C++/Fortran testsuite results
are abysmal at -O3.

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #13 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2012-12-03 21:06:23 UTC ---
> Someone needs to do something here because the C/C++/Fortran testsuite results
> are abysmal at -O3.

And the tentative fix doesn't really help, it turns the ICEs of the testsuite
at -O3 into timeouts.

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[hubicka at ucw dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #14 from Jan Hubicka <hubicka at ucw dot cz> 2012-12-03 23:24:13 UTC ---
> > Someone needs to do something here because the C/C++/Fortran testsuite results
> > are abysmal at -O3.
> 
> And the tentative fix doesn't really help, it turns the ICEs of the testsuite
> at -O3 into timeouts.

Yes, i aplied it to our tester a while a go.  It helps to some tests but not to
others.

Honza

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |steven at gcc dot gnu.org
         AssignedTo|unassigned at gcc dot       |steven at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #15 from Steven Bosscher <steven at gcc dot gnu.org> 2012-12-04 09:02:20 UTC ---
(In reply to comment #12)
> Someone needs to do something here because the C/C++/Fortran testsuite results
> are abysmal at -O3.

So it's up to the only one in this discussion who does *not* have a paid
GCC hacking position to fix this? Has Itanium really sunk so deep?

OK, better not answer that :-)

I'm having a look on gcc66.

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #16 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2012-12-04 09:27:54 UTC ---
> So it's up to the only one in this discussion who does *not* have a paid
> GCC hacking position to fix this? Has Itanium really sunk so deep?

It's up to the author of the suspected patch to do something.  I personally
monitor the status of the IA-64 port on a regular basis, but we're supposed to
have maintainers to do it, although they seem to be in the MIPS business now.

I can provide IA-64 testing cycles, but I don't really have time to debug the
scheduler when I haven't broken it.

> I'm having a look on gcc66.

Thanks.  I'm going to attach the testsuite results with the patch applied; all
the timeouts have been introduced by it.

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #17 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2012-12-04 09:29:50 UTC ---
Created attachment 28871
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28871
Testsuite results with tentative fix

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #18 from Steven Bosscher <steven at gcc dot gnu.org> 2012-12-04 09:56:53 UTC ---
Created attachment 28872
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28872
Updated tentative fix

(In reply to comment #16)
> I can provide IA-64 testing cycles, but I don't really have time to 
> debug the scheduler when I haven't broken it.

Sometimes you have to fix things you haven't broken.  Especially trivial
bugs like this one.  Look at all the REG_EQUAL stuff I've been trying
to fix.  I assure you I wasn't around in GCC land when in ~1992 e.g. the
optabs self-referencing REG_EQUAL notes were introduced :-)

And in this case, my tentative fix was a pointer in the right direction.
It has a rather obvious mistake in it, and anyone spending a minutes or
two looking at the patch could have spotted and resolved the mistake.

> > I'm having a look on gcc66.
> 
> Thanks.  I'm going to attach the testsuite results with the patch
> applied; all the timeouts have been introduced by it.

Attached is an updated patch.  Again untested, but that's about to change.
I'm going to test it on gcc66.

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #19 from Steven Bosscher <steven at gcc dot gnu.org> 2012-12-04 10:02:58 UTC ---
This line is of course supposed to compare bb_state_array and
old_bb_state_array:
  for (int i = (bb_state != old_bb_state) ? 0 : saved_last_basic_block;

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[bernds at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #20 from Bernd Schmidt <bernds at gcc dot gnu.org> 2012-12-04 11:06:07 UTC ---
Created attachment 28873
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28873
Another patch

Here's another attempt, given that it seems to be the speculation code that
causes the problem.

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #21 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2012-12-04 11:36:23 UTC ---
> Sometimes you have to fix things you haven't broken.  Especially trivial
> bugs like this one.  Look at all the REG_EQUAL stuff I've been trying
> to fix.  I assure you I wasn't around in GCC land when in ~1992 e.g. the
> optabs self-referencing REG_EQUAL notes were introduced :-)

Sure.  However, I personally stay away from the register allocator, reload and
the scheduler unless I'm really forced to look into them. :-)

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #22 from Richard Biener <rguenth at gcc dot gnu.org> 2012-12-07 10:45:20 UTC ---
*** Bug 55545 has been marked as a duplicate of this bug. ***

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

--- Comment #23 from Steven Bosscher <steven at gcc dot gnu.org> 2012-12-08 12:12:59 UTC ---
Author: steven
Date: Sat Dec  8 12:12:50 2012
New Revision: 194322

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=194322
Log:
    PR rtl-optimization/55158
    * sched-rgn.c (bb_state_array, bb_state): Add some explaining
    comment, and initialize to NULL explicitly.
    (realloc_bb_state_array): New function.
    (free_bb_state_array): New function.
    (schedule_region): Call realloc_bb_state_array after schedule_block.
    (sched_rgn_init): Use realloc_bb_state_array to initialize bb_state.
    (sched_rgn_finish): Use free_bb_state_array to free it.


Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/sched-rgn.c

[Bug rtl-optimization/55158] [4.8 Regression] segfault in schedule_region at -O3

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55158

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #24 from Steven Bosscher <steven at gcc dot gnu.org> 2012-12-13 10:44:22 UTC ---
.