[Bug c/97578] New: ice during IPA pass: inline

[Bug c/97578] New: ice during IPA pass: inline

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

            Bug ID: 97578
           Summary: ice during IPA pass: inline
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

For this C code:

typedef long unsigned int size_t;
   typedef unsigned char __uint8_t;
   typedef unsigned int __uint32_t;
   typedef __uint8_t uint8_t;
   typedef __uint32_t uint32_t;
   struct md5_s {
                            uint32_t nblocks;
                            uint8_t buf[64];
                            int count;
  };
   typedef struct md5_s MD5_CONTEXT;
   void * md5_write_context;
   static void md5_write(  const void *inbuf_arg , size_t inlen) {
        const unsigned char *inbuf = inbuf_arg;
        MD5_CONTEXT *hd = md5_write_context;
        if( hd->count == 64 )           transform( hd, hd->buf );
        hd->nblocks++;
        if( !inbuf )                    return;
        if( hd->count )                 md5_write( 0, 0 );
        while( inlen >= 64 )     ;
        for( ;
  inlen && hd->count < 64;
  inlen-- )                     hd->buf[hd->count++] = *inbuf++;
  }
   void * md5_final_context;
   static void md5_final( void) {
        md5_write( 0, 0);
  }
   void AddMD5(  const void *data, size_t len ) {
        md5_write(  data, len );
  }
   void EndMD5( struct md5_s *h ) {
        md5_final(  );
  }

compiled with recent gcc trunk and flag -g -O3, does this:

during IPA pass: inline
bug659.c: In function ‘AddMD5’:
bug659.c:30:9: internal compiler error: Segmentation fault
   30 |         md5_write(  data, len );
      |         ^~~~~~~~~~~~~~~~~~~~~~~
0xbd15df crash_signal
        ../../trunk.git/gcc/toplev.c:330
0xc4b608 copy_cfg_body
        ../../trunk.git/gcc/tree-inline.c:3118

The bug first seems to occur sometime between 20201022 and 20201023.

[Bug c/97578] ice during IPA pass: inline

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |ice-on-valid-code
                 CC|                            |hubicka at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
   Last reconfirmed|                            |2020-10-26
           Priority|P3                          |P1
      Known to work|                            |10.2.0
      Known to fail|                            |11.0
     Ever confirmed|0                           |1
   Target Milestone|---                         |11.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r11-4267-g0e590b68fa374365.

[Bug c/97578] ice during IPA pass: inline

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #2 from David Binderman <dcb314 at hotmail dot com> ---
Here is a second simpler test case:

int a;
static void b(int c) {
  if (a)
    while (c)
      b(0);
  d();
}
void e(c) { b(c); }
void f() { e(0); }

[Bug c/97578] ice during IPA pass: inline

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at redhat dot com,
                   |                            |mjambor at suse dot cz
          Component|ipa                         |c
            Summary|[11 Regression] ice during  |ice during IPA pass: inline
                   |IPA pass: inline            |

--- Comment #3 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
What hits us here is the hack I needed to introduce to
ipa_param_adjustments::modify_call which triggers materialization to make debug
info code working.  In this case redirection happens from tree-inline and
materialization gets us back to tree-inline. Inliner is however not intended to
be recursive (it uses bb->aux pointers and in this case it will use it twice).

Martin, Jambor,
it would be really great if we did not need to materialize.  I do not see how
attaching debug info to decls can work if caller is in one partition and callee
in another.

We could also just add a loop walking all such calls and trigger
materialization before going to tree-inline to avoid the recursion problem, but
still IMO debug info will get missing on the partitioning boundary. We could
also just avoid the (ab)use of bb->aux and replace it by a vector here which
would be also an option.

[Bug c/97578] ice during IPA pass: inline

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Zhendong Su <su at cs dot ucdavis.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |su at cs dot ucdavis.edu

--- Comment #4 from Zhendong Su <su at cs dot ucdavis.edu> ---
Another test for the same crash (at -Os and -O2 w/o -g, but not at -O3):

[533] % gcctk -O2 -c small.c
during IPA pass: inline
small.c: In function ‘e’:
small.c:10:3: internal compiler error: Segmentation fault
   10 |   b(d);
      |   ^~~~
0xcf71ef crash_signal
        ../../gcc-trunk/gcc/toplev.c:330
0x825aad function_summary<clone_info*>::get(cgraph_node*)
        ../../gcc-trunk/gcc/symbol-summary.h:212
0x825aad clone_info::get(cgraph_node*)
        ../../gcc-trunk/gcc/symtab-clones.h:70
0x825aad cgraph_edge::redirect_call_stmt_to_callee(cgraph_edge*)
        ../../gcc-trunk/gcc/cgraph.c:1495
0xd932bf redirect_all_calls(copy_body_data*, basic_block_def*)
        ../../gcc-trunk/gcc/tree-inline.c:2963
0xd9697e copy_cfg_body
        ../../gcc-trunk/gcc/tree-inline.c:3118
0xd9697e copy_body
        ../../gcc-trunk/gcc/tree-inline.c:3294
0xd99ec0 expand_call_inline
        ../../gcc-trunk/gcc/tree-inline.c:5084
0xd9beb9 gimple_expand_calls_inline
        ../../gcc-trunk/gcc/tree-inline.c:5274
0xd9beb9 optimize_inline_calls(tree_node*)
        ../../gcc-trunk/gcc/tree-inline.c:5447
0xa968fb inline_transform(cgraph_node*)
        ../../gcc-trunk/gcc/ipa-inline-transform.c:763
0xc00f79 execute_one_ipa_transform_pass
        ../../gcc-trunk/gcc/passes.c:2240
0xc00f79 execute_all_ipa_transforms(bool)
        ../../gcc-trunk/gcc/passes.c:2287
0x82dbf5 cgraph_node::expand()
        ../../gcc-trunk/gcc/cgraphunit.c:1822
0x82f596 expand_all_functions
        ../../gcc-trunk/gcc/cgraphunit.c:1997
0x82f596 symbol_table::compile()
        ../../gcc-trunk/gcc/cgraphunit.c:2361
0x832b6f symbol_table::compile()
        ../../gcc-trunk/gcc/cgraphunit.c:2545
0x832b6f symbol_table::finalize_compilation_unit()
        ../../gcc-trunk/gcc/cgraphunit.c:2542
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[534] % 
[534] % cat small.c
int printf (const char *, ...);

int a;
static void b(int c) {
  if (c)
    printf("%d", a);
}
void e() {
  int d = 0;
  b(d);
}

Re: [Bug c/97578] ice during IPA pass: inline

[Jan Hubicka]

Hi,
this patch fixes the ICE, though I think we do have a design issue here
while producing debug info across ltrans boundary.

Martin, Jakub: as discussed on IRC it would be nice to add predicate
when the body is really needed and avoid materializing if it is not.
Can you add one?

Something like param_adjustemnts->need_callee_parm_decls_p ()

Honza

diff --git a/gcc/ipa-inline-transform.c b/gcc/ipa-inline-transform.c
index 4df1b7fb9ee..907a95cac5a 100644
--- a/gcc/ipa-inline-transform.c
+++ b/gcc/ipa-inline-transform.c
@@ -51,6 +51,7 @@ along with GCC; see the file COPYING3.  If not see
 #include "ipa-modref-tree.h"
 #include "ipa-modref.h"
 #include "symtab-thunks.h"
+#include "symtab-clones.h"
 
 int ncalls_inlined;
 int nfunctions_inlined;
@@ -695,6 +696,31 @@ preserve_function_body_p (struct cgraph_node *node)
   return false;
 }
 
+/* tree-inline can not recurse; materialize all function bodie we will need
+   during inlining.  This includes inlined functions, but also called functions
+   with param manipulation because IPA param manipulation attaches debug
+   statements to PARM_DECLs of called clone.  Materialize them if needed.
+
+   FIXME: This is somehwat broken by design because it does not play well
+   with partitioning.  */
+
+static void
+maybe_materialize_called_clones (cgraph_node *node)
+{
+  for (cgraph_edge *e = node->callees; e; e = e->next_callee)
+    {
+      clone_info *info;
+
+      if (!e->inline_failed)
+	maybe_materialize_called_clones (e->callee);
+
+      cgraph_node *callee = cgraph_node::get (e->callee->decl);
+      if (callee->clone_of
+	  && (info = clone_info::get (callee)) && info->param_adjustments)
+	callee->get_untransformed_body ();
+    }
+}
+
 /* Apply inline plan to function.  */
 
 unsigned int
@@ -748,6 +774,7 @@ inline_transform (struct cgraph_node *node)
       ENTRY_BLOCK_PTR_FOR_FN (cfun)->count = node->count;
     }
 
+  maybe_materialize_called_clones (node);
   for (e = node->callees; e; e = next)
     {
       if (!e->inline_failed)

[Bug c/97578] ice during IPA pass: inline

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #5 from Jan Hubicka <hubicka at ucw dot cz> ---
Hi,
this patch fixes the ICE, though I think we do have a design issue here
while producing debug info across ltrans boundary.

Martin, Jakub: as discussed on IRC it would be nice to add predicate
when the body is really needed and avoid materializing if it is not.
Can you add one?

Something like param_adjustemnts->need_callee_parm_decls_p ()

Honza

diff --git a/gcc/ipa-inline-transform.c b/gcc/ipa-inline-transform.c
index 4df1b7fb9ee..907a95cac5a 100644
--- a/gcc/ipa-inline-transform.c
+++ b/gcc/ipa-inline-transform.c
@@ -51,6 +51,7 @@ along with GCC; see the file COPYING3.  If not see
 #include "ipa-modref-tree.h"
 #include "ipa-modref.h"
 #include "symtab-thunks.h"
+#include "symtab-clones.h"

 int ncalls_inlined;
 int nfunctions_inlined;
@@ -695,6 +696,31 @@ preserve_function_body_p (struct cgraph_node *node)
   return false;
 }

+/* tree-inline can not recurse; materialize all function bodie we will need
+   during inlining.  This includes inlined functions, but also called
functions
+   with param manipulation because IPA param manipulation attaches debug
+   statements to PARM_DECLs of called clone.  Materialize them if needed.
+
+   FIXME: This is somehwat broken by design because it does not play well
+   with partitioning.  */
+
+static void
+maybe_materialize_called_clones (cgraph_node *node)
+{
+  for (cgraph_edge *e = node->callees; e; e = e->next_callee)
+    {
+      clone_info *info;
+
+      if (!e->inline_failed)
+       maybe_materialize_called_clones (e->callee);
+
+      cgraph_node *callee = cgraph_node::get (e->callee->decl);
+      if (callee->clone_of
+         && (info = clone_info::get (callee)) && info->param_adjustments)
+       callee->get_untransformed_body ();
+    }
+}
+
 /* Apply inline plan to function.  */

 unsigned int
@@ -748,6 +774,7 @@ inline_transform (struct cgraph_node *node)
       ENTRY_BLOCK_PTR_FOR_FN (cfun)->count = node->count;
     }

+  maybe_materialize_called_clones (node);
   for (e = node->callees; e; e = next)
     {
       if (!e->inline_failed)

[Bug c/97578] ice during IPA pass: inline

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #5)
> Hi,
> this patch fixes the ICE, though I think we do have a design issue here
> while producing debug info across ltrans boundary.
> 
> Martin, Jakub: as discussed on IRC it would be nice to add predicate
> when the body is really needed and avoid materializing if it is not.
> Can you add one?
> 
> Something like param_adjustemnts->need_callee_parm_decls_p ()

I think that in practice the existence of param_adjustemnts is by far
the biggest part of the test and the patch already checks for that.

A more precise check would probably be the following?


/* Return true if any of the original parameters of the function has been
   removed or replaced.  */

bool
ipa_param_adjustments::orig_parameter_removed_p ()
{
  if (m_always_copy_start == 0)
    return false;

  unsigned adj_len = vec_safe_length (m_adj_params);
  if (adj_len < m_always_copy_start)
    return true;

  unsigned i;
  for (i = 0; i < m_always_copy_start; i++)
    {
      ipa_adjusted_param *apm = &(*m_adj_params)[i];
      if (apm->op != IPA_PARAM_OP_COPY
          || apm->base_index != i)
        break;
    }
  if (i == m_always_copy_start)
    return false;

  /* In all likelihood, the ith parameter has been removed, verify. */
  bool complex_case = false;
  for (unsigned j = i; j < adj_len; j++)
    {
      ipa_adjusted_param *apm = &(*m_adj_params)[j];
      if (apm->op == IPA_PARAM_OP_COPY
          || apm->base_index == i)
        {
          complex_case = true;
          break;
        }
    }
  if (!complex_case)
    return true;

  auto_vec<bool, 16> kept;
  kept.safe_grow_cleared (m_always_copy_start - i, true);
  for (unsigned j = i; j < adj_len; j++)
    {
      ipa_adjusted_param *apm = &(*m_adj_params)[j];
      if (apm->op == IPA_PARAM_OP_COPY)
        kept[apm->base_index - i] = true;
    }
  for (unsigned j = 0; j < m_always_copy_start - i; j++)
    if (!kept[j])
      return true;

  return false;
}

[Bug c/97578] ice during IPA pass: inline

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jan Hubicka <hubicka@gcc.gnu.org>:

https://gcc.gnu.org/g:f89dcf93348b44b8ea2b57f940fcdaeae0f764f6

commit r11-4648-gf89dcf93348b44b8ea2b57f940fcdaeae0f764f6
Author: Jan Hubicka <jh@suse.cz>
Date:   Tue Nov 3 11:56:05 2020 +0100

    Avoid recursion in tree-inline

    gcc/ChangeLog:

    2020-11-03  Jan Hubicka  <hubicka@ucw.cz>

            PR ipa/97578
            * ipa-inline-transform.c (maybe_materialize_called_clones): New
            function.
            (inline_transform): Use it.

    gcc/testsuite/ChangeLog:

    2020-11-03  Jan Hubicka  <hubicka@ucw.cz>

            * gcc.c-torture/compile/pr97578.c: New test.

[Bug c/97578] ice during IPA pass: inline

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #8 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
OK, I comitted patch as is and we could see if any memory can be conserved by
being more precise.  I still think the debug info should not need decls here.
Honza

[Bug c/97578] ice during IPA pass: inline

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It needs to refer to the DW_TAG_formal_parameter DIEs, and only the PARM_DECLs
map to those.

Re: [Bug c/97578] ice during IPA pass: inline

[Jan Hubicka]

> It needs to refer to the DW_TAG_formal_parameter DIEs, and only the PARM_DECLs
> map to those.
It has problem with the partitioning (if we call a callee from different
parititon) and also if the callee is compiled before caller (as it
should) we will call cgraph_node::release_body and that will likely
remove pointer to them.

[Bug c/97578] ice during IPA pass: inline

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #10 from Jan Hubicka <hubicka at ucw dot cz> ---
> It needs to refer to the DW_TAG_formal_parameter DIEs, and only the PARM_DECLs
> map to those.
It has problem with the partitioning (if we call a callee from different
parititon) and also if the callee is compiled before caller (as it
should) we will call cgraph_node::release_body and that will likely
remove pointer to them.

[Bug c/97578] ice during IPA pass: inline

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.0                        |11.2

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 11.1 has been released, retargeting bugs to GCC 11.2.

[Bug c/97578] ice during IPA pass: inline

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.2                        |11.3

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11.2 is being released, retargeting bugs to GCC 11.3

[Bug c/97578] [11 Regression] ice during IPA pass: inline

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #13 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I've put the [11 Regression] marker back in the summary, since it looks to have
been removed accidentally. But maybe it's fixed since comment 7, so not a
regression now? In which case, it shouldn't be P1, and a comment saying why
it's still open would help.

[Bug c/97578] [11 Regression] ice during IPA pass: inline

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P1                          |P3

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Resetting to P3, as the state is unknown.
It really can't be a P1, at least not for 11.3, if it has been introduced in
r11-4267, i.e. before 11.1 release, because if it is still not fixed, 11.1 and
11.2 would have the same bug.

[Bug c/97578] [11 Regression] ice during IPA pass: inline

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #15 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Jakub Jelinek from comment #14)
> Resetting to P3, as the state is unknown.

I tried out the code in the original bug, and it looks fine to me.

$ /home/dcb/gcc/results/bin/gcc -c bug659.c 
$ /home/dcb/gcc/results/bin/gcc -c -g -O1 bug659.c 
$ /home/dcb/gcc/results/bin/gcc -c -g -O2 bug659.c 
$ /home/dcb/gcc/results/bin/gcc -c -g -O3 bug659.c 
$ /home/dcb/gcc/results/bin/gcc -c -g -O3 -march=native bug659.c 
$ /home/dcb/gcc/results/bin/gcc -c -g -Ofast -march=native bug659.c 
$ /home/dcb/gcc/results/bin/gcc -c -g -Os -march=native bug659.c 
$ /home/dcb/gcc/results/bin/gcc -v 2>&1 | fgrep exp
gcc version 12.0.1 20220412 (experimental) (82a4c5c704433249)
$

[Bug c/97578] [11 Regression] ice during IPA pass: inline

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

--- Comment #16 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I tend to think Honza kept the bug open as a reminder to look into things
listed in comment #8.  Those should probably be tracked in another bug,
alternatively this one should be adjusted to reflect that.

[Bug c/97578] [11 Regression] ice during IPA pass: inline

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.3                        |11.4

--- Comment #17 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11.3 is being released, retargeting bugs to GCC 11.4.

[Bug c/97578] [11 Regression] ice during IPA pass: inline

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97578

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.4                        |11.5

--- Comment #18 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 11.4 is being released, retargeting bugs to GCC 11.5.