[Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry)

[Bug fortran/98638] New: ICE: Segmentation fault (in lookup_page_table_entry)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

            Bug ID: 98638
           Summary: ICE: Segmentation fault (in lookup_page_table_entry)
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: GC, ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---
            Target: powerpc-*-linux-gnu

Created attachment 49950
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49950&action=edit
Testcase

gfortran-11.0.0-alpha20210110 snapshot
(g:872373360dab259d51caa002ff1722ff84746d8b) ICEs when compiling the attached
testcase, only mildly reduced from test/f90_correct/src/oop324.f90 from the
flang test suite, w/ -mcpu=860 -O2 -fexceptions -fnon-call-exceptions -fopenacc
-fpredictive-commoning --param integer-share-limit=20000:

% powerpc-e300c3-linux-gnu-gfortran-11.0.0 -mcpu=860 -O2 -fexceptions
-fnon-call-exceptions -fopenacc -fpredictive-commoning --param
integer-share-limit=20000 -c qvft2ssg.f90
qvft2ssg.f90:18:20:

   18 | end module shape_mod
      |                    ^
internal compiler error: Segmentation fault
0xe8d916 crash_signal
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/gcc-11-20210110/gcc/toplev.c:327
0x97e833 lookup_page_table_entry
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/gcc-11-20210110/gcc/ggc-page.c:630
0x97e833 ggc_set_mark(void const*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/gcc-11-20210110/gcc/ggc-page.c:1544
0xbf92c1 gt_ggc_mx_basic_block_def(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1517
0xbfb707 gt_ggc_mx_gimple(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1287
0x8cd40f gt_ggc_mx_lang_tree_node(void*)
        ./gt-fortran-f95-lang.h:403
0x8cd4b0 gt_ggc_mx_lang_tree_node(void*)
        ./gt-fortran-f95-lang.h:394
0x8cd4b0 gt_ggc_mx_lang_tree_node(void*)
        ./gt-fortran-f95-lang.h:394
0x8ccfa9 gt_ggc_mx_lang_decl(void*)
        ./gtype-fortran.h:72
0x8ccfa9 gt_ggc_mx_lang_decl(void*)
        ./gtype-fortran.h:67
0x8cd3ab gt_ggc_mx_lang_tree_node(void*)
        ./gt-fortran-f95-lang.h:177
0x8cd39d gt_ggc_mx_lang_tree_node(void*)
        ./gt-fortran-f95-lang.h:176
0xbfb9ae gt_ggc_mx_gimple(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1268
0xbf9379 gt_ggc_mx_basic_block_def(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1537
0xbfb707 gt_ggc_mx_gimple(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1287
0xbfe261 gt_ggc_mx_cgraph_edge(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1403
0xbfe253 gt_ggc_mx_cgraph_edge(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1402
0xbfe253 gt_ggc_mx_cgraph_edge(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1402
0xbfe253 gt_ggc_mx_cgraph_edge(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1402
0xbfdfee gt_ggc_mx_symtab_node(void*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-11.0.0_alpha20210110/work/build/gcc/gtype-desc.c:1349

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW
            Summary|ICE: Segmentation fault (in |[11 Regression] ICE:
                   |lookup_page_table_entry)    |Segmentation fault (in
                   |                            |lookup_page_table_entry)
                   |                            |since
                   |                            |r11-6411-gae99b315ba5b9e1c
             Target|powerpc-*-linux-gnu         |powerpc-*-linux-gnu,
                   |                            |x86_64-linux-gnu
      Known to work|                            |10.2.0
   Target Milestone|---                         |11.0
   Last reconfirmed|                            |2021-01-12
     Ever confirmed|0                           |1
      Known to fail|                            |11.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed on x86_64-linux-gnu with --param=ggc-min-expand=0
--param=ggc-min-heapsize=0. Started with r11-6411-gae99b315ba5b9e1c.

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
SSA name in some TYPE/DECL_SIZE tree?

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Reduced test-case:

module shape_mod
  type rectangle
     end type 
  type, extends (rectangle) :: square
     real, allocatable :: r(:)
  end type 
end  
use shape_mod
  logical results(8)
  class(rectangle),allocatable :: r
  class(rectangle),allocatable :: r2
  allocatable rr(:)
  select type(o=>r)
  class is (square)
     allocate(rr,source=o%r)
     select type(r2)
     class is (square)
        results = or .eq. rr
     end select
  end select
end

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fortran lang_decl has

struct GTY(()) lang_decl {
  /* Dummy variables.  */
  tree saved_descriptor;

and that eventually contains _121->r (SSA names which refer to def stmts
which refer to BBs).  The decl is reachable via an abstract origin.

I suppose the saved_descriptor has a tree sharing "issue" with sth
gimplified.

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Note not releasing SSA names but ggc_freeing basic-block will also increase the
"attack surface" to the existing VLA missing DECL_EXPR issues which also cause
SSA names to leak into size fields of decls and types.  So one "fix" might be
to make sure to release SSA names (which will NULL their def_stmt field)
when we free the CFG.

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
I see a similar ICE happening in libretro-mame package where a PCH is used:

../../../../../src/emu/screen.h: In member function
'std::enable_if_t<emu::device_delegate<unsigned int(screen_device&,
bitmap_ind16&, const rectangle&)>::supports_callback<T>::value, void>
screen_device::set_screen_update(F&&, const char*) [with F = unsigned int
(pacman_state::*)(screen_device&, bitmap_ind16&, const rectangle&)]':
../../../../../src/emu/screen.h:344:85: internal compiler error: Segmentation
fault
  344 |        
std::enable_if_t<screen_update_ind16_delegate::supports_callback<F>::value>
set_screen_update(F &&callback, const char *name)
      |                                                                        
            ^~~~~~~~~~~~~~~~~
0x1387176 diagnostic_impl(rich_location*, diagnostic_metadata const*, int, char
const*, __va_list_tag (*) [1], diagnostic_t) [clone .lto_priv.0]
        ???:0
0xe20f60 internal_error(char const*, ...)
        ???:0
0xb1c906 crash_signal(int) [clone .lto_priv.0]
        ???:0
0x8bfcde ggc_set_mark(void const*) [clone .cold]
        ???:0
0x1362a45 gt_ggc_mx_vec_edge_va_gc_(void*)
        ???:0
0x1362974 gt_ggc_mx_basic_block_def(void*)
        ???:0
0x1362499 gt_ggc_mx_gimple(void*)
        ???:0
0x13006d1 gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x1300629 gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x1300d3a gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x8bc53b gt_ggc_mx_lang_tree_node(void*) [clone .cold]
        ???:0
0x13019b4 gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x1300e35 gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x1300d3a gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x1300eff gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x130108f gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x13012c5 gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x130193d gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x1300fed gt_ggc_mx_lang_tree_node(void*)
        ???:0
0x1301005 gt_ggc_mx_lang_tree_node(void*)
        ???:0
Please submit a full bug report,

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
I am testing the following which fixes the ICE (but not the bogus leak
of SSA names into global tree structs)

diff --git a/gcc/tree-ssanames.c b/gcc/tree-ssanames.c
index c293cc44189..51a26d2fce1 100644
--- a/gcc/tree-ssanames.c
+++ b/gcc/tree-ssanames.c
@@ -102,6 +102,14 @@ init_ssanames (struct function *fn, int size)
 void
 fini_ssanames (struct function *fn)
 {
+  unsigned i;
+  tree name;
+  /* Some SSA names leak into global tree data structures so we can't simply
+     ggc_free them.  But make sure to clear references to stmts since we now
+     ggc_free the CFG itself.  */
+  FOR_EACH_VEC_SAFE_ELT (SSANAMES (fn), i, name)
+    if (name)
+      SSA_NAME_DEF_STMT (name) = NULL;
   vec_free (SSANAMES (fn));
   vec_free (FREE_SSANAMES (fn));
   vec_free (FREE_SSANAMES_QUEUE (fn));

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:f27cd6f42261e838677dfd0652f09cc0dfd6a42b

commit r11-6790-gf27cd6f42261e838677dfd0652f09cc0dfd6a42b
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jan 19 13:40:39 2021 +0100

    middle-end/98638 - avoid SSA reference to stmts after SSA deconstruction

    Since SSA names do leak into global tree data structures like
    TYPE_SIZE or in this case GFC_DECL_SAVED_DESCRIPTOR because of
    frontend bugs we have to be careful to wipe references to the
    CFG when we deconstruct SSA form because we now do ggc_free that.

    2021-01-19  Richard Biener  <rguenther@suse.de>

            PR middle-end/98638
            * tree-ssanames.c (fini_ssanames): Zero SSA_NAME_DEF_STMT.

[Bug fortran/98638] [11 Regression] ICE: Segmentation fault (in lookup_page_table_entry) since r11-6411-gae99b315ba5b9e1c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98638

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mitigated.