[Bug rtl-optimization/56921] New: [4.8 Regression] ICE in rtx_cost

[Bug rtl-optimization/56921] New: [4.8 Regression] ICE in rtx_cost

[dje at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

             Bug #: 56921
           Summary: [4.8 Regression] ICE in rtx_cost
    Classification: Unclassified
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: dje@gcc.gnu.org


libgomp.c++/for-3.C produces a segfault in GCC.

Program received signal SIGSEGV, Segmentation fault.
_Z8rtx_costP7rtx_def8rtx_codeib (x=0x70824514, outer_code=270238820, opno=0, 
    speed=true) at /nasfarm/dje/src/src/gcc/rtlanal.c:3802

(gdb) where
#0  _Z8rtx_costP7rtx_def8rtx_codeib (x=0x70824514, outer_code=270238820, 
    opno=0, speed=true) at /nasfarm/dje/src/src/gcc/rtlanal.c:3802
#1  0x109f4e98 in _Z21doloop_optimize_loopsv ()
    at /nasfarm/dje/src/src/gcc/loop-doloop.c:2125
#2  0x109d0db8 in _ZL10rtl_doloopv ()
    at /nasfarm/dje/src/src/gcc/loop-init.c:543
#3  0x106370f8 in _Z16execute_one_passP8opt_pass (pass=0x3019aa00)
    at /nasfarm/dje/src/src/gcc/passes.c:2329
#4  0x10637590 in _Z17execute_pass_listP8opt_pass (pass=0x3019aa00)
    at /nasfarm/dje/src/src/gcc/passes.c:2380
#5  0x106375a8 in _Z17execute_pass_listP8opt_pass (pass=0x3019ab50)
    at /nasfarm/dje/src/src/gcc/passes.c:2381
#6  0x106375a8 in _Z17execute_pass_listP8opt_pass (pass=0x301b59c8)
    at /nasfarm/dje/src/src/gcc/passes.c:2381
#7  0x10545f54 in _ZL15expand_functionP11cgraph_node (node=0x70419dc0)
    at /nasfarm/dje/src/src/gcc/cgraphunit.c:1640
#8  0x1054821c in _Z7compilev () at /nasfarm/dje/src/src/gcc/cgraphunit.c:3710
#9  0x10548da4 in _Z25finalize_compilation_unitv ()
    at /nasfarm/dje/src/src/gcc/cgraphunit.c:2119
#10 0x107517b8 in _Z28cp_write_global_declarationsv ()
    at /nasfarm/dje/src/src/gcc/cp/decl2.c:4324
#11 0x10000b14 in _ZL12compile_filev ()

3797      /* Sum the costs of the sub-rtx's, plus cost of this operation,
3798         which is already in total.  */
3799    
3800      fmt = GET_RTX_FORMAT (code);
3801      for (i = GET_RTX_LENGTH (code) - 1; i >= 0; i--)
3802        if (fmt[i] == 'e')
3803          total += rtx_cost (XEXP (x, i), code, i, speed);
3804        else if (fmt[i] == 'E')
3805          for (j = 0; j < XVECLEN (x, i); j++)
3806            total += rtx_cost (XVECEXP (x, i, j), code, i, speed);

[Bug rtl-optimization/56921] [4.8 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[dje at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

David Edelsohn <dje at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |powerpc*-*-*
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |ice-on-valid-code
   Last reconfirmed|                            |2013-04-11
               Host|                            |powerpc*-*-*
     Ever Confirmed|0                           |1
            Summary|[4.8 Regression] ICE in     |[4.8 Regression] ICE in
                   |rtx_cost                    |rtx_cost called by
                   |                            |doloop_optimize_loops for
                   |                            |PPC
              Build|                            |powerpc*-*-*

--- Comment #1 from David Edelsohn <dje at gcc dot gnu.org> 2013-04-11 15:43:24 UTC ---
Confirmed in both AIX and PowerLinux.

[Bug rtl-optimization/56921] [4.8 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[pthaugen at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

Pat Haugen <pthaugen at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #2 from Pat Haugen <pthaugen at gcc dot gnu.org> 2013-04-11 17:54:31 UTC ---
Started with revision 197671.

2013-04-10  Richard Biener  <rguenther@suse.de>

        * passes.c (execute_todo): Do not call ggc_collect conditional here.
        (execute_one_ipa_transform_pass): But unconditionally here.
        (execute_one_pass): And here.
        (init_optimization_passes): Remove reload pass.
        * tree-pass.h (TODO_ggc_collect): Remove.
        (pass_reload): Likewise.
        * ira.c (do_reload): Merge into ...
        (ira): ... this.
        (rest_of_handle_reload): Remove.
        (pass_reload): Likewise.
        * config/i386/i386.c (ix86_option_override): Refer to ira instead
        of reload for vzeroupper pass placement.
        * <everywhere>: Remove TODO_ggc_collect from todo_flags_start
        and todo_flags_finish of all passes.

[Bug rtl-optimization/56921] [4.8 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-11 19:11:21 UTC ---
That was a trunk commit, but this is marked as 4.8 regression, while 4.8 branch
certainly doesn't have that change.
Perhaps something in the rs6000 backend (or middle-end) isn't properly GTY
marked?

[Bug rtl-optimization/56921] [4.8 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[pthaugen at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

--- Comment #4 from Pat Haugen <pthaugen at gcc dot gnu.org> 2013-04-11 20:02:09 UTC ---
This is another failure due to the same revision.

FAIL: gcc.dg/torture/vec-cvt-1.c  -O3 -fomit-frame-pointer -funroll-all-loops
-finline-functions  (internal compiler error)

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[pthaugen at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

--- Comment #5 from Pat Haugen <pthaugen at gcc dot gnu.org> 2013-04-11 21:03:50 UTC ---
As are these forran failures also:

FAIL: gfortran.dg/minloc_3.f90  -O3 -fomit-frame-pointer -funroll-loops 
(internal compiler error)

FAIL: gfortran.dg/minlocval_3.f90  -O3 -fomit-frame-pointer -funroll-loops 
(internal compiler error)

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |steven at gcc dot gnu.org

--- Comment #6 from Steven Bosscher <steven at gcc dot gnu.org> 2013-04-11 22:15:26 UTC ---
Shot from the hip:

struct niter_desc is not GC safe.

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.0

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> 2013-04-12 07:46:01 UTC ---
niter_desc is not marked GTY(()) but is cached from struct loop aux field.
niter_desc uses heap memory but points to GC memory.  Thus, caching of this
across passes is not safe.

I suppose passes are missing free_simple_loop_desc, loop-doloop.c calls
get_simple_loop_desc but never free_simple_loop_desc for example (which
then at least leaks the niter_desc memory).

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

--- Comment #8 from Steven Bosscher <steven at gcc dot gnu.org> 2013-04-12 08:36:04 UTC ---
(In reply to comment #7)
> niter_desc is not marked GTY(()) but is cached from struct loop aux field.
> niter_desc uses heap memory but points to GC memory.  Thus, caching of this
> across passes is not safe.
> I suppose passes are missing free_simple_loop_desc, loop-doloop.c calls
> get_simple_loop_desc but never free_simple_loop_desc for example (which
> then at least leaks the niter_desc memory).

Another, IMHO better, solution would be to not use loop->aux but make
a GC-safe vec indexed by loop->num. Maybe add checking in the loop
verifier that no struct niter_desc is left pending if its parent loop
is removed.

That should make the loop passes GC safe.

Then mark all "aux" fields as GC unsafe and document that every pass is
responsible for cleaning up after itself.

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[rguenther at suse dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

--- Comment #9 from rguenther at suse dot de <rguenther at suse dot de> 2013-04-12 08:45:46 UTC ---
On Fri, 12 Apr 2013, steven at gcc dot gnu.org wrote:

> 
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921
> 
> --- Comment #8 from Steven Bosscher <steven at gcc dot gnu.org> 2013-04-12 08:36:04 UTC ---
> (In reply to comment #7)
> > niter_desc is not marked GTY(()) but is cached from struct loop aux field.
> > niter_desc uses heap memory but points to GC memory.  Thus, caching of this
> > across passes is not safe.
> > I suppose passes are missing free_simple_loop_desc, loop-doloop.c calls
> > get_simple_loop_desc but never free_simple_loop_desc for example (which
> > then at least leaks the niter_desc memory).
> 
> Another, IMHO better, solution would be to not use loop->aux but make
> a GC-safe vec indexed by loop->num. Maybe add checking in the loop
> verifier that no struct niter_desc is left pending if its parent loop
> is removed.
> 
> That should make the loop passes GC safe.
> 
> Then mark all "aux" fields as GC unsafe and document that every pass is
> responsible for cleaning up after itself.

Yes, definitely.  I was bit once by this ->aux usage which is
not really obvious.

Richard.

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ktkachov at gcc dot gnu.org

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> 2013-04-14 23:54:11 UTC ---
*** Bug 56916 has been marked as a duplicate of this bug. ***

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> 2013-04-15 14:46:49 UTC ---
Created attachment 29877
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29877
patch papering over the issue with TODO_do_not_ggc_collect

Patch papering over (restoring non-GC collect) attached.  Not exactly the
best solution as garbage is then again not collected during the in some
cases memory expensive passes.

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[ktkachov at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

--- Comment #12 from ktkachov at gcc dot gnu.org 2013-04-15 15:26:10 UTC ---
(In reply to comment #11)
> Created attachment 29877 [details]
> patch papering over the issue with TODO_do_not_ggc_collect
> 
> Patch papering over (restoring non-GC collect) attached.  Not exactly the
> best solution as garbage is then again not collected during the in some
> cases memory expensive passes.

Fixes ICE while building libgfortran for arm-*-*.
Also, no regressions on arm-none-eabi tested with qemu.

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[krebbel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

Andreas Krebbel <krebbel at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |krebbel at gcc dot gnu.org

--- Comment #14 from Andreas Krebbel <krebbel at gcc dot gnu.org> 2013-04-16 13:40:27 UTC ---
*** Bug 56978 has been marked as a duplicate of this bug. ***

[Bug rtl-optimization/56921] [4.9 Regression] ICE in rtx_cost called by doloop_optimize_loops for PPC

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56921

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> 2013-04-17 12:02:05 UTC ---
Author: rguenth
Date: Wed Apr 17 12:01:46 2013
New Revision: 198025

URL: http://gcc.gnu.org/viewcvs?rev=198025&root=gcc&view=rev
Log:
2013-04-17  Richard Biener  <rguenther@suse.de>

    PR rtl-optimization/56921
    * cfgloop.h (struct loop): Add simple_loop_desc member.
    (struct niter_desc): Mark with GTY(()).
    (simple_loop_desc): Do not use aux field but simple_loop_desc.
    * loop-iv.c (get_simple_loop_desc): Likewise.
    (free_simple_loop_desc): Likewise.

    Revert
    2013-04-16  Richard Biener  <rguenther@suse.de>

    PR rtl-optimization/56921
    * loop-init.c (pass_rtl_move_loop_invariants): Add
    TODO_do_not_ggc_collect to todo_flags_finish.
    (pass_rtl_unswitch): Same.
    (pass_rtl_unroll_and_peel_loops): Same.
    (pass_rtl_doloop): Same.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/cfgloop.h
    trunk/gcc/loop-init.c
    trunk/gcc/loop-iv.c