[Bug other/67659] New: ICE: Linux kernel/rcu/tree.c:3261:6

[Bug other/67659] New: ICE: Linux kernel/rcu/tree.c:3261:6

[nwmcsween at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67659

            Bug ID: 67659
           Summary: ICE: Linux kernel/rcu/tree.c:3261:6
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: other
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nwmcsween at gmail dot com
  Target Milestone: ---

ICE while compiling linux kernel, at kernel/rcu/tree.c:3261:6 using latest git
as of sunday 2015-09-20

[Bug other/67659] ICE: Linux kernel/rcu/tree.c:3261:6

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67659

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2015-09-21
     Ever confirmed|0                           |1

--- Comment #1 from Uroš Bizjak <ubizjak at gmail dot com> ---
(In reply to Nathan McSween from comment #0)
> ICE while compiling linux kernel, at kernel/rcu/tree.c:3261:6 using latest
> git as of sunday 2015-09-20

Please provide all required information, as instructed in [1].

[1] https://gcc.gnu.org/bugs/
>From gcc-bugs-return-497654-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Sep 21 06:29:56 2015
Return-Path: <gcc-bugs-return-497654-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 52969 invoked by alias); 21 Sep 2015 06:29:56 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 52905 invoked by uid 48); 21 Sep 2015 06:29:52 -0000
From: "pinskia at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/67662] -fsanitize=undefined cries wolf for X - 1 + X when X is 2**30
Date: Mon, 21 Sep 2015 06:29:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 5.2.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: pinskia at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status cf_reconfirmed_on component everconfirmed
Message-ID: <bug-67662-4-SCzBnCR8P1@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-67662-4@http.gcc.gnu.org/bugzilla/>
References: <bug-67662-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-09/txt/msg01632.txt.bz2
Content-length: 764

https://gcc.gnu.org/bugzilla/show_bug.cgi?idg662

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-09-21
          Component|sanitizer                   |middle-end
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This is a reassociation issue inside fold-const.  Basically we change x - 1 + x
to x + x - 1 which is invalid as it introduces an overflow which was not there
before.  (This is why we need an addition tree where overflow is defined).

[Bug tree-optimization/67659] [5 regression] ICE: segfault: Linux kernel/rcu/tree.c:3261:6

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67659

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW
                 CC|                            |trippels at gcc dot gnu.org
          Component|other                       |tree-optimization
      Known to work|                            |4.9.3, 6.0
            Summary|ICE: Linux                  |[5 regression] ICE:
                   |kernel/rcu/tree.c:3261:6    |segfault: Linux
                   |                            |kernel/rcu/tree.c:3261:6
      Known to fail|                            |5.2.1

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
markus@x4 tmp % cat tree.i
struct list_head {
  struct list_head *next, *prev;
} typedef call_rcu_func_t;
struct __wait_queue_head {
  int lock;
  struct list_head task_list;
};
struct completion {
  int done;
  struct __wait_queue_head wait;
};
int call_rcu_sched;
void fn1(unsigned long p1) {
  __asm__("" : : : "memory");
  if (~0UL / 2 >= p1) {
    call_rcu_func_t __crcu_array[] = {call_rcu_sched};
    int __n = sizeof({});
    struct completion __rs_array[__n];
    fn2(0, 1, __crcu_array, __rs_array);
  }
}

void fn3(unsigned long p1) {
  __asm__("" : : : "memory");
  if (~0UL / 2 >= p1) {
    call_rcu_func_t __crcu_array[] = {call_rcu_sched};
    int __n = sizeof({});
    struct completion __rs_array[__n];
    fn2(0, 1, __crcu_array, __rs_array);
  }
}

markus@x4 tmp % gdb --args gcc -O3 -c -w tree.i
Reading symbols from gcc...done.
(gdb) run
Starting program: /usr/bin/gcc -O3 -c -w tree.i
process 16753 is executing new program:
/usr/x86_64-pc-linux-gnu/gcc-bin/5.2.1/gcc
[New process 16757]
process 16757 is executing new program:
/usr/libexec/gcc/x86_64-pc-linux-gnu/5.2.1/cc1

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 16757]
0x00000000007fce50 in ccp_fold_stmt(gimple_stmt_iterator*) [clone .cold.97] ()
(gdb) bt
#0  0x00000000007fce50 in ccp_fold_stmt(gimple_stmt_iterator*) [clone .cold.97]
()
#1  0x0000000000f509c1 in
substitute_and_fold_dom_walker::before_dom_children(basic_block_def*) ()
#2  0x000000000107f821 in dom_walker::walk(basic_block_def*) ()
#3  0x0000000000f505e1 in substitute_and_fold(tree_node* (*)(tree_node*), bool
(*)(gimple_stmt_iterator*), bool) ()
#4  0x0000000000ee9b2a in (anonymous namespace)::pass_ccp::execute(function*)
()
#5  0x0000000000721a13 in execute_one_pass(opt_pass*) ()
#6  0x0000000000722fb2 in execute_pass_list_1(opt_pass*) ()
#7  0x0000000000722fe3 in execute_pass_list_1(opt_pass*) ()
#8  0x0000000000e34619 in execute_pass_list(function*, opt_pass*) ()
#9  0x0000000001104e27 in symbol_table::compile() ()
#10 0x00000000011045fe in symbol_table::finalize_compilation_unit() ()
#11 0x0000000000c2b473 in c_write_global_declarations() ()
#12 0x0000000001148411 in compile_file() ()
#13 0x0000000000c20831 in toplev::main(int, char**) ()
#14 0x0000000000c20c8e in main ()

-fno-ipa-icf "fixes" the issue.

[Bug tree-optimization/67659] [5 regression] ICE: segfault: Linux kernel/rcu/tree.c:3261:6

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67659

--- Comment #3 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---

tree.i:13:6: internal compiler error: Segmentation fault
 void fn1(unsigned long p1) {
      ^
0x99d1ef crash_signal
        ../../gcc/gcc/toplev.c:383
0xa5cc22 fold_builtin_alloca_with_align
        ../../gcc/gcc/tree-ssa-ccp.c:2067
0xa5cc22 ccp_fold_stmt
        ../../gcc/gcc/tree-ssa-ccp.c:2172
0xac6866 substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/gcc/tree-ssa-propagate.c:1177
0xea6077 dom_walker::walk(basic_block_def*)
        ../../gcc/gcc/domwalk.c:188
0xac62a9 substitute_and_fold(tree_node* (*)(tree_node*), bool
(*)(gimple_stmt_iterator*), bool)
        ../../gcc/gcc/tree-ssa-propagate.c:1272
0xa54108 ccp_finalize
        ../../gcc/gcc/tree-ssa-ccp.c:941
0xa54108 do_ssa_ccp
        ../../gcc/gcc/tree-ssa-ccp.c:2382
0xa54108 execute
        ../../gcc/gcc/tree-ssa-ccp.c:2414
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

I think there is a dup somewhere, but I cannot find it at the moment.

[Bug tree-optimization/67659] [5 regression] ICE: segfault: Linux kernel/rcu/tree.c:3261:6

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67659

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #4 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
dup.

*** This bug has been marked as a duplicate of bug 67055 ***