[Bug gcov-profile/99385] New: [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[Bug gcov-profile/99385] New: [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[ro at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

            Bug ID: 99385
           Summary: [11 regression]
                    gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: gcov-profile
          Assignee: unassigned at gcc dot gnu.org
          Reporter: ro at gcc dot gnu.org
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---
            Target: *-*-solaris2.11

Between 20210302 (f8e4d7a6597fa81ff927156a5f5d10b7fdaa0bc0) and 20210303
(39d7eb8a73d5f8c09db20926a98181181d9dd2c2), two tests began to FAIL on Solaris
(sparc and x86, 32 and 64-bit):

+UNRESOLVED: gcc.dg/tree-prof/indir-call-prof-malloc.c compilation, 
-fprofile-use -D_PROFILE_USE
+FAIL: gcc.dg/tree-prof/indir-call-prof-malloc.c execution,   
-fprofile-generate -D_PROFILE_GENERATE
+UNRESOLVED: gcc.dg/tree-prof/indir-call-prof-malloc.c execution,   
-fprofile-use -D_PROFILE_USE
+UNRESOLVED: gcc.dg/tree-prof/pr97461.c compilation,  -fprofile-use
-D_PROFILE_USE
+FAIL: gcc.dg/tree-prof/pr97461.c execution,    -fprofile-generate
-D_PROFILE_GENERATE
+UNRESOLVED: gcc.dg/tree-prof/pr97461.c execution,    -fprofile-use
-D_PROFILE_USE

The first failure is a regression, the second test is new from 

commit 00d79dc4be0b86ec564cfa2b32c47de6c07449e6
Author: Martin Liska <mliska@suse.cz>
Date:   Wed Jan 13 11:17:03 2021 +0100

    gcov: use mmap pools for KVP.

The failure looks like this:

Thread 2 received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1 (LWP 1)]
0xfeb7d464 in _malloc_unlocked () from /lib/libc.so.1
(gdb) where
#0  0xfeb7d464 in _malloc_unlocked () from /lib/libc.so.1
#1  0xfeb7d318 in do_malloc () from /lib/libc.so.1

Running the test under truss shows

[...]
mmap64(0x00000000, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, 0, 0)
Err#22 EINVAL
    Incurred fault #6, FLTBOUNDS  %pc = 0xFEC546B0
      siginfo: SIGSEGV SEGV_MAPERR addr=0xFF3FFFA8
    Received signal #11, SIGSEGV [default]
      siginfo: SIGSEGV SEGV_MAPERR addr=0xFF3FFFA8

Every single mmap64 call fails with EINVAL.  According to Solaris mmap(2),
this is due to

                    MAP_ANON  was  specified,  but the file descriptor was not
                    -1.

Linux mmap(2) also documents

       MAP_ANONYMOUS
              The mapping is not backed by any file; its contents are initial-
              ized  to zero.  The fd argument is ignored; however, some imple-
              mentations require fd to be -1 if MAP_ANONYMOUS (or MAP_ANON) is
              specified,  and  portable  applications should ensure this.  The

and indeed changing the fd arg in the mmap call to -1 lets the tests PASS.

However, I believe there's more: imagine the mmap calls fails for other
reasons: I don't think the code should simply SEGV then, but I didn't easily
see where to do proper error handling for this case.

[Bug gcov-profile/99385] [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[ro at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

Rainer Orth <ro at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.0

[Bug gcov-profile/99385] [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-03-04
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Thanks for the report and the analysis.
The code should not segfault as we do:

      if (ptr != MAP_FAILED)
        {
          __gcov_kvp_dynamic_pool = ptr;
          __gcov_kvp_dynamic_pool_size = MMAP_CHUNK_SIZE / kvp_sizeof;
          __gcov_kvp_dynamic_pool_index = 0;
        }
...
  if (new_node == NULL)
    new_node = (struct gcov_kvp *)xcalloc (1, kvp_sizeof);

can you please investigate why it crashes?

[Bug gcov-profile/99385] [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug gcov-profile/99385] [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[ro at CeBiTec dot Uni-Bielefeld.DE]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

--- Comment #2 from ro at CeBiTec dot Uni-Bielefeld.DE <ro at CeBiTec dot Uni-Bielefeld.DE> ---
> --- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
> Thanks for the report and the analysis.
> The code should not segfault as we do:
>
>       if (ptr != MAP_FAILED)
>         {
>           __gcov_kvp_dynamic_pool = ptr;
>           __gcov_kvp_dynamic_pool_size = MMAP_CHUNK_SIZE / kvp_sizeof;
>           __gcov_kvp_dynamic_pool_index = 0;
>         }
> ...
>   if (new_node == NULL)
>     new_node = (struct gcov_kvp *)xcalloc (1, kvp_sizeof);
>
> can you please investigate why it crashes?

When I compile both libgcc and the indir-call-prof-malloc.c testcase
with -g3 -O0, it turns out the SEGV is caused by a stack overflow.  The
default stack size is 8 MB, and with bt 20 I get

#0  0x0805279a in calloc (n=1, size=20) at
/vol/gcc/src/hg/master/local/gcc/testsuite/gcc.dg/tree-prof/indir-call-prof-malloc.c:37
#1  0x080535ac in allocate_gcov_kvp () at
/vol/gcc/src/hg/master/local/libgcc/libgcov.h:455
#2  0x08053711 in gcov_topn_add_value (counters=0x8065df8 <__gcov4.malloc+24>,
value=629554396, count=1, use_atomic=0, increment_total=1) at
/vol/gcc/src/hg/master/local/libgcc/libgcov.h:510
#3  0x0805383d in __gcov_topn_values_profiler_body (counters=0x8065df8
<__gcov4.malloc+24>, value=629554396, use_atomic=0) at
/vol/gcc/src/hg/master/local/libgcc/libgcov-profiler.c:103
#4  0x08053892 in __gcov_indirect_call_profiler_body (value=629554396,
cur_func=0x80524ad <report1>, use_atomic=0) at
/vol/gcc/src/hg/master/local/libgcc/libgcov-profiler.c:163
#5  0x080538d9 in __gcov_indirect_call_profiler_v4 (value=629554396,
cur_func=0x80524ad <report1>) at
/vol/gcc/src/hg/master/local/libgcc/libgcov-profiler.c:172
#6  0x080524da in report1 (size=20) at
/vol/gcc/src/hg/master/local/gcc/testsuite/gcc.dg/tree-prof/indir-call-prof-malloc.c:12
#7  0x08052748 in malloc (size=20) at
/vol/gcc/src/hg/master/local/gcc/testsuite/gcc.dg/tree-prof/indir-call-prof-malloc.c:31
#8  0x08052806 in calloc (n=1, size=20) at
/vol/gcc/src/hg/master/local/gcc/testsuite/gcc.dg/tree-prof/indir-call-prof-malloc.c:38
#9  0x080535ac in allocate_gcov_kvp () at
/vol/gcc/src/hg/master/local/libgcc/libgcov.h:455
#10 0x08053711 in gcov_topn_add_value (counters=0x8065df8 <__gcov4.malloc+24>,
value=629554396, count=1, use_atomic=0, increment_total=1) at
/vol/gcc/src/hg/master/local/libgcc/libgcov.h:510
#11 0x0805383d in __gcov_topn_values_profiler_body (counters=0x8065df8
<__gcov4.malloc+24>, value=629554396, use_atomic=0) at
/vol/gcc/src/hg/master/local/libgcc/libgcov-profiler.c:103
#12 0x08053892 in __gcov_indirect_call_profiler_body (value=629554396,
cur_func=0x80524ad <report1>, use_atomic=0) at
/vol/gcc/src/hg/master/local/libgcc/libgcov-profiler.c:163
#13 0x080538d9 in __gcov_indirect_call_profiler_v4 (value=629554396,
cur_func=0x80524ad <report1>) at
/vol/gcc/src/hg/master/local/libgcc/libgcov-profiler.c:172
#14 0x080524da in report1 (size=20) at
/vol/gcc/src/hg/master/local/gcc/testsuite/gcc.dg/tree-prof/indir-call-prof-malloc.c:12
#15 0x08052748 in malloc (size=20) at
/vol/gcc/src/hg/master/local/gcc/testsuite/gcc.dg/tree-prof/indir-call-prof-malloc.c:31
#16 0x08052806 in calloc (n=1, size=20) at
/vol/gcc/src/hg/master/local/gcc/testsuite/gcc.dg/tree-prof/indir-call-prof-malloc.c:38
#17 0x080535ac in allocate_gcov_kvp () at
/vol/gcc/src/hg/master/local/libgcc/libgcov.h:455
#18 0x08053711 in gcov_topn_add_value (counters=0x8065df8 <__gcov4.malloc+24>,
value=629554396, count=1, use_atomic=0, increment_total=1) at
/vol/gcc/src/hg/master/local/libgcc/libgcov.h:510
#19 0x0805383d in __gcov_topn_values_profiler_body (counters=0x8065df8
<__gcov4.malloc+24>, value=629554396, use_atomic=0) at
/vol/gcc/src/hg/master/local/libgcc/libgcov-profiler.c:103
(More stack frames follow...)

Running bt without a count gets into the 20000s when I stopped it.

[Bug gcov-profile/99385] [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
I see, that's expected behavior from the test-case then.

[Bug gcov-profile/99385] [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Liska <marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:4c955b4ad37cf31c1d7cfa146c2b3ead2042869b

commit r11-7505-g4c955b4ad37cf31c1d7cfa146c2b3ead2042869b
Author: Martin Liska <mliska@suse.cz>
Date:   Thu Mar 4 11:45:47 2021 +0100

    gcov: call mmap MAP_ANONYMOUS with fd equal to -1

    libgcc/ChangeLog:

            PR gcov-profile/99385
            * libgcov.h (allocate_gcov_kvp): Call mmap with fd equal to -1.

[Bug gcov-profile/99385] [11 regression] gcc.dg/tree-prof/indir-call-prof-malloc.c etc. FAIL

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99385

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed.