* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
@ 2021-01-12 12:59 ` marxin at gcc dot gnu.org
2021-01-12 13:04 ` rguenth at gcc dot gnu.org
` (7 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: marxin at gcc dot gnu.org @ 2021-01-12 12:59 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
Martin Liška <marxin at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |hubicka at gcc dot gnu.org,
| |marxin at gcc dot gnu.org
Priority|P3 |P1
Status|UNCONFIRMED |NEW
Summary|ICE: Segmentation fault (in |[11 Regression] ICE:
|lookup_page_table_entry) |Segmentation fault (in
| |lookup_page_table_entry)
| |since
| |r11-6411-gae99b315ba5b9e1c
Target|powerpc-*-linux-gnu |powerpc-*-linux-gnu,
| |x86_64-linux-gnu
Known to work| |10.2.0
Target Milestone|--- |11.0
Last reconfirmed| |2021-01-12
Ever confirmed|0 |1
Known to fail| |11.0
--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed on x86_64-linux-gnu with --param=ggc-min-expand=0
--param=ggc-min-heapsize=0. Started with r11-6411-gae99b315ba5b9e1c.
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
2021-01-12 12:59 ` [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c marxin at gcc dot gnu.org
@ 2021-01-12 13:04 ` rguenth at gcc dot gnu.org
2021-01-12 13:06 ` marxin at gcc dot gnu.org
` (6 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: rguenth at gcc dot gnu.org @ 2021-01-12 13:04 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
SSA name in some TYPE/DECL_SIZE tree?
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
2021-01-12 12:59 ` [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c marxin at gcc dot gnu.org
2021-01-12 13:04 ` rguenth at gcc dot gnu.org
@ 2021-01-12 13:06 ` marxin at gcc dot gnu.org
2021-01-12 13:13 ` rguenth at gcc dot gnu.org
` (5 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: marxin at gcc dot gnu.org @ 2021-01-12 13:06 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Reduced test-case:
module shape_mod
type rectangle
end type
type, extends (rectangle) :: square
real, allocatable :: r(:)
end type
end
use shape_mod
logical results(8)
class(rectangle),allocatable :: r
class(rectangle),allocatable :: r2
allocatable rr(:)
select type(o=>r)
class is (square)
allocate(rr,source=o%r)
select type(r2)
class is (square)
results = or .eq. rr
end select
end select
end
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
` (2 preceding siblings ...)
2021-01-12 13:06 ` marxin at gcc dot gnu.org
@ 2021-01-12 13:13 ` rguenth at gcc dot gnu.org
2021-01-12 13:18 ` rguenth at gcc dot gnu.org
` (4 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: rguenth at gcc dot gnu.org @ 2021-01-12 13:13 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fortran lang_decl has
struct GTY(()) lang_decl {
/* Dummy variables. */
tree saved_descriptor;
and that eventually contains _121->r (SSA names which refer to def stmts
which refer to BBs). The decl is reachable via an abstract origin.
I suppose the saved_descriptor has a tree sharing "issue" with sth
gimplified.
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
` (3 preceding siblings ...)
2021-01-12 13:13 ` rguenth at gcc dot gnu.org
@ 2021-01-12 13:18 ` rguenth at gcc dot gnu.org
2021-01-13 14:03 ` marxin at gcc dot gnu.org
` (3 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: rguenth at gcc dot gnu.org @ 2021-01-12 13:18 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rguenth at gcc dot gnu.org
--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Note not releasing SSA names but ggc_freeing basic-block will also increase the
"attack surface" to the existing VLA missing DECL_EXPR issues which also cause
SSA names to leak into size fields of decls and types. So one "fix" might be
to make sure to release SSA names (which will NULL their def_stmt field)
when we free the CFG.
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
` (4 preceding siblings ...)
2021-01-12 13:18 ` rguenth at gcc dot gnu.org
@ 2021-01-13 14:03 ` marxin at gcc dot gnu.org
2021-01-19 12:40 ` rguenth at gcc dot gnu.org
` (2 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: marxin at gcc dot gnu.org @ 2021-01-13 14:03 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
I see a similar ICE happening in libretro-mame package where a PCH is used:
../../../../../src/emu/screen.h: In member function
'std::enable_if_t<emu::device_delegate<unsigned int(screen_device&,
bitmap_ind16&, const rectangle&)>::supports_callback<T>::value, void>
screen_device::set_screen_update(F&&, const char*) [with F = unsigned int
(pacman_state::*)(screen_device&, bitmap_ind16&, const rectangle&)]':
../../../../../src/emu/screen.h:344:85: internal compiler error: Segmentation
fault
344 |
std::enable_if_t<screen_update_ind16_delegate::supports_callback<F>::value>
set_screen_update(F &&callback, const char *name)
|
^~~~~~~~~~~~~~~~~
0x1387176 diagnostic_impl(rich_location*, diagnostic_metadata const*, int, char
const*, __va_list_tag (*) [1], diagnostic_t) [clone .lto_priv.0]
???:0
0xe20f60 internal_error(char const*, ...)
???:0
0xb1c906 crash_signal(int) [clone .lto_priv.0]
???:0
0x8bfcde ggc_set_mark(void const*) [clone .cold]
???:0
0x1362a45 gt_ggc_mx_vec_edge_va_gc_(void*)
???:0
0x1362974 gt_ggc_mx_basic_block_def(void*)
???:0
0x1362499 gt_ggc_mx_gimple(void*)
???:0
0x13006d1 gt_ggc_mx_lang_tree_node(void*)
???:0
0x1300629 gt_ggc_mx_lang_tree_node(void*)
???:0
0x1300d3a gt_ggc_mx_lang_tree_node(void*)
???:0
0x8bc53b gt_ggc_mx_lang_tree_node(void*) [clone .cold]
???:0
0x13019b4 gt_ggc_mx_lang_tree_node(void*)
???:0
0x1300e35 gt_ggc_mx_lang_tree_node(void*)
???:0
0x1300d3a gt_ggc_mx_lang_tree_node(void*)
???:0
0x1300eff gt_ggc_mx_lang_tree_node(void*)
???:0
0x130108f gt_ggc_mx_lang_tree_node(void*)
???:0
0x13012c5 gt_ggc_mx_lang_tree_node(void*)
???:0
0x130193d gt_ggc_mx_lang_tree_node(void*)
???:0
0x1300fed gt_ggc_mx_lang_tree_node(void*)
???:0
0x1301005 gt_ggc_mx_lang_tree_node(void*)
???:0
Please submit a full bug report,
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
` (5 preceding siblings ...)
2021-01-13 14:03 ` marxin at gcc dot gnu.org
@ 2021-01-19 12:40 ` rguenth at gcc dot gnu.org
2021-01-19 13:32 ` cvs-commit at gcc dot gnu.org
2021-01-19 13:32 ` rguenth at gcc dot gnu.org
8 siblings, 0 replies; 10+ messages in thread
From: rguenth at gcc dot gnu.org @ 2021-01-19 12:40 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|unassigned at gcc dot gnu.org |rguenth at gcc dot gnu.org
Status|NEW |ASSIGNED
--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
I am testing the following which fixes the ICE (but not the bogus leak
of SSA names into global tree structs)
diff --git a/gcc/tree-ssanames.c b/gcc/tree-ssanames.c
index c293cc44189..51a26d2fce1 100644
--- a/gcc/tree-ssanames.c
+++ b/gcc/tree-ssanames.c
@@ -102,6 +102,14 @@ init_ssanames (struct function *fn, int size)
void
fini_ssanames (struct function *fn)
{
+ unsigned i;
+ tree name;
+ /* Some SSA names leak into global tree data structures so we can't simply
+ ggc_free them. But make sure to clear references to stmts since we now
+ ggc_free the CFG itself. */
+ FOR_EACH_VEC_SAFE_ELT (SSANAMES (fn), i, name)
+ if (name)
+ SSA_NAME_DEF_STMT (name) = NULL;
vec_free (SSANAMES (fn));
vec_free (FREE_SSANAMES (fn));
vec_free (FREE_SSANAMES_QUEUE (fn));
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
` (6 preceding siblings ...)
2021-01-19 12:40 ` rguenth at gcc dot gnu.org
@ 2021-01-19 13:32 ` cvs-commit at gcc dot gnu.org
2021-01-19 13:32 ` rguenth at gcc dot gnu.org
8 siblings, 0 replies; 10+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2021-01-19 13:32 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:
https://gcc.gnu.org/g:f27cd6f42261e838677dfd0652f09cc0dfd6a42b
commit r11-6790-gf27cd6f42261e838677dfd0652f09cc0dfd6a42b
Author: Richard Biener <rguenther@suse.de>
Date: Tue Jan 19 13:40:39 2021 +0100
middle-end/98638 - avoid SSA reference to stmts after SSA deconstruction
Since SSA names do leak into global tree data structures like
TYPE_SIZE or in this case GFC_DECL_SAVED_DESCRIPTOR because of
frontend bugs we have to be careful to wipe references to the
CFG when we deconstruct SSA form because we now do ggc_free that.
2021-01-19 Richard Biener <rguenther@suse.de>
PR middle-end/98638
* tree-ssanames.c (fini_ssanames): Zero SSA_NAME_DEF_STMT.
^ permalink raw reply [flat|nested] 10+ messages in thread* [Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c
2021-01-12 11:46 [Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry) asolokha at gmx dot com
` (7 preceding siblings ...)
2021-01-19 13:32 ` cvs-commit at gcc dot gnu.org
@ 2021-01-19 13:32 ` rguenth at gcc dot gnu.org
8 siblings, 0 replies; 10+ messages in thread
From: rguenth at gcc dot gnu.org @ 2021-01-19 13:32 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution|--- |FIXED
--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mitigated.
^ permalink raw reply [flat|nested] 10+ messages in thread