[Bug tree-optimization/64098] New: ICE isl_ctx.c:172: isl_ctx freed, but some objects still referenced

[Bug tree-optimization/64098] New: ICE isl_ctx.c:172: isl_ctx freed, but some objects still referenced

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64098

            Bug ID: 64098
           Summary: ICE isl_ctx.c:172: isl_ctx freed, but some objects
                    still referenced
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rguenth at gcc dot gnu.org
                CC: mircea.namolaru at inria dot fr

#include <stdio.h>
#include <endian.h>
#include <inttypes.h>

uint16_t dhcp_packet_checksum(void * restrict buf, int len) {
          uint32_t sum;
          uint16_t * restrict check;
          int i;
          uint8_t * restrict odd;
          sum = 0;
          check = buf;

            for (i = 0; i < len / 2 ; i++)
                  sum += check[i];

          if (len & 0x01) {
                  odd = buf;
                  sum += odd[len - 1]; 
          }

          while (sum >> 16)
                  sum = (sum & 0xffff) + (sum >> 16);
          return ~sum;
  }

int main(void)

{
        const uint8_t buf[20] = {
                0x45, 0x00, 0x02, 0x40, 0x00, 0x00, 0x00, 0x00,
                0x40, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0xff, 0xff, 0xff, 0xff
        };


        return dhcp_packet_checksum(&buf, 20) == be16toh(0x78ae);

}


gcc-5 -Wall $(rpm --eval %optflags) -floop-unroll-and-jam test.c


isl_ctx.c:172: isl_ctx freed, but some objects still reference it
chk.c: In function ‘dhcp_packet_checksum’:
chk.c:5:10: internal compiler error: Abortado
 uint16_t dhcp_packet_checksum(void * restrict buf, int len) {
          ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://bugs.opensuse.org/> for instructions.
>From gcc-bugs-return-468824-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Nov 28 09:17:10 2014
Return-Path: <gcc-bugs-return-468824-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 13845 invoked by alias); 28 Nov 2014 09:17:09 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 13816 invoked by uid 48); 28 Nov 2014 09:17:05 -0000
From: "leimaohui at cn dot fujitsu.com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/63908] [e500v2] "float_bessel"case failed on e500v2 platforms
Date: Fri, 28 Nov 2014 09:17:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.9.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: leimaohui at cn dot fujitsu.com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-63908-4-a3amgtUetb@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-63908-4@http.gcc.gnu.org/bugzilla/>
References: <bug-63908-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-11/txt/msg03296.txt.bz2
Content-length: 2425

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63908

--- Comment #3 from leimaohui <leimaohui at cn dot fujitsu.com> ---
Thanks for joseph's reply.

But I found the reason is the founction "pthread_exit(0)" can't execut
normally。
Because it will lead a SIGABRT signal and aborted .

I wrote a test program and make a test.The enviroment is below:
------------------------------------------------
rootfs: 
http://downloads.yoctoproject.org/releases/yocto/yocto-1.7/machines/p1022ds/core-image-sato-sdk-p1022ds-20141018182842.rootfs.tar.gz

toolchain:
http://downloads.yoctoproject.org/releases/yocto/yocto-1.7/toolchain/x86_64/poky-glibc-x86_64-core-image-sato-ppce500v2-toolchain-1.7.sh

kernel: 3.14 and 3.4.74 have the same appearance

hostOS: RHEL 6.3

Below is my test program
------------------------------------------------

[root@RHEL6U3 pthread-test]# cat pthread-test.c
#include <stdio.h>
#include <pthread.h>
#include <stdlib.h>

pthread_t       tid1, tid2;
void            *tret;

void *
thr_fn1(void *arg)
{
    sleep(1);

    printf("it's thread 1 \n");
    pthread_exit(0);

//    pthread_join(tid2, &tret);
}

int
main(void)
{
    int err;

    err = pthread_create(&tid1, NULL, thr_fn1, NULL);
    if (err != 0)
        printf("can't create thread 1\n");

    printf("I will join thread 1... 1\n");
    err = pthread_join(tid1, &tret);
    if (err != 0)
        printf("can't join with thread 1\n");

    printf("thread 1 exit code %d\n", (int)tret);
}
[root@RHEL6U3 pthread-test]#.
/opt/poky/1.7/environment-setup-ppce500v2-poky-linux-gnuspe
[root@RHEL6U3 pthread-test]# ${CC} pthread-test.c -lpthread -o pthread-test

------------------------------------------------
And then execut "pthread-test" in e500v2.The result is like below
------------------------------------------------

root@p1022ds:/root# strace -f -o pthread-test.log ./pthread-test
I will join thread 1... 1
it's thread 1
Aborted
root@p1022ds:/root# cat pthread-test.log
...
1009  futex(0xfa999ac, FUTEX_WAKE_PRIVATE, 2147483647) = 0
1009  rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
1009  tgkill(1008, 1009, SIGABRT)       = 0
1009  --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=1008, si_uid=0}
---
1009  +++ killed by SIGABRT +++
1008  +++ killed by SIGABRT +++
root@p1022ds:/root# 
root@p1022ds:/root# 

But I dont't know the root cause. That's the gcc 's bug or the glibc's bug?
>From gcc-bugs-return-468825-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Nov 28 09:19:41 2014
Return-Path: <gcc-bugs-return-468825-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 15491 invoked by alias); 28 Nov 2014 09:19:41 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 15420 invoked by uid 48); 28 Nov 2014 09:19:38 -0000
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/63697] -fsanitize=undefined doesn't detect some subtraction overflows
Date: Fri, 28 Nov 2014 09:19:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: sanitizer
X-Bugzilla-Version: 4.9.2
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: jakub at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status resolution
Message-ID: <bug-63697-4-ZiPxZN8fAM@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-63697-4@http.gcc.gnu.org/bugzilla/>
References: <bug-63697-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-11/txt/msg03297.txt.bz2
Content-length: 422

https://gcc.gnu.org/bugzilla/show_bug.cgi?idc697

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/64098] ICE isl_ctx.c:172: isl_ctx freed, but some objects still referenced

[mircea.namolaru at inria dot fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64098

--- Comment #1 from Mircea Namolaru <mircea.namolaru at inria dot fr> ---
Bug confirmed. The error message points to a problem in the way in which the 
unroll-and-jam code manage the isl objects (the space is not freed properly). 

I pinned down the function causing the problem, but work is still needed. I
will send a patch in the following days. The patch will also add some test
cases (including this one) for loop-unroll-and-jam.

[Bug tree-optimization/64098] ICE isl_ctx.c:172: isl_ctx freed, but some objects still referenced

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64098

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
         Resolution|---                         |FIXED
   Target Milestone|---                         |6.0
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed by the removal of the support for this in r6-3014.

Also floop-unroll-and-jam has been rewritten not to need to use ISL at r8-5159
and r8-5204.