[PATCH] Fix IPA crash in libgccjit

[PATCH] Fix IPA crash in libgccjit

[David Malcolm]

All/most of the jit.dg testcases are segfaulting on cleanup of
the 2nd in-process iteration:

PATH=.:$PATH LD_LIBRARY_PATH=. LIBRARY_PATH=. \
 gdb --args \
   testsuite/jit/test-factorial.c.exe

Starting program: /home/david/coding-3/gcc-git-static-analysis/build/gcc/testsuite/jit/test-factorial.c.exe 
	PASSED: test-factorial.c.exe iteration 1 of 5: set_up_logging: logfile is non-null
	NOTE: test-factorial.c.exe iteration 1 of 5: writing reproducer to /home/david/coding-3/gcc-git-static-analysis/build/gcc/testsuite/jit/test-factorial.c.exe.reproducer.c
Detaching after fork from child process 35787.
Detaching after fork from child process 35789.
	PASSED: test-factorial.c.exe iteration 1 of 5: verify_code: result is non-null
	PASSED: test-factorial.c.exe iteration 1 of 5: verify_code: my_factorial is non-null
	NOTE: my_factorial returned: 3628800
	PASSED: test-factorial.c.exe iteration 1 of 5: verify_code: actual: val == expected: 3628800
	PASSED: test-factorial.c.exe iteration 2 of 5: set_up_logging: logfile is non-null
	NOTE: test-factorial.c.exe iteration 2 of 5: writing reproducer to /home/david/coding-3/gcc-git-static-analysis/build/gcc/testsuite/jit/test-factorial.c.exe.reproducer.c

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff71abc75 in ipcp_driver () at ../../src/gcc/ipa-cp.c:5091
5091	  delete edge_clone_summaries;

This appears to be due to recent(?) IPA changes that appear to assume
that the IPA code is only initialized and cleaned up once.

This patch fixes the crashes:

Changes to jit.sum
------------------

  FAIL: 65->0 (-65)
  PASS: 3186->10290 (+7104)
  UNRESOLVED: 1->0 (-1)

Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.

OK for trunk?

gcc/ChangeLog:
	* ipa-cp.c (ipcp_driver): Set edge_clone_summaries to NULL after
	deleting it.
	* ipa-reference.c (ipa_reference_c_finalize): Delete
	ipa_ref_opt_sum_summaries and set it to NULL.
---
 gcc/ipa-cp.c        | 1 +
 gcc/ipa-reference.c | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/gcc/ipa-cp.c b/gcc/ipa-cp.c
index c192e84..42dd4cc 100644
--- a/gcc/ipa-cp.c
+++ b/gcc/ipa-cp.c
@@ -5089,6 +5089,7 @@ ipcp_driver (void)
   /* Free all IPCP structures.  */
   free_toporder_info (&topo);
   delete edge_clone_summaries;
+  edge_clone_summaries = NULL;
   ipa_free_all_structures_after_ipa_cp ();
   if (dump_file)
     fprintf (dump_file, "\nIPA constant propagation end\n");
diff --git a/gcc/ipa-reference.c b/gcc/ipa-reference.c
index 9a9e94c..43bbdae 100644
--- a/gcc/ipa-reference.c
+++ b/gcc/ipa-reference.c
@@ -1230,6 +1230,12 @@ make_pass_ipa_reference (gcc::context *ctxt)
 void
 ipa_reference_c_finalize (void)
 {
+  if (ipa_ref_opt_sum_summaries != NULL)
+    {
+      delete ipa_ref_opt_sum_summaries;
+      ipa_ref_opt_sum_summaries = NULL;
+    }
+
   if (ipa_init_p)
     {
       bitmap_obstack_release (&optimization_summary_obstack);
-- 
1.8.5.3

Re: [PATCH] Fix IPA crash in libgccjit

[Richard Biener]

On Thu, Jun 21, 2018 at 1:07 AM David Malcolm <dmalcolm@redhat.com> wrote:
>
> All/most of the jit.dg testcases are segfaulting on cleanup of
> the 2nd in-process iteration:
>
> PATH=.:$PATH LD_LIBRARY_PATH=. LIBRARY_PATH=. \
>  gdb --args \
>    testsuite/jit/test-factorial.c.exe
>
> Starting program: /home/david/coding-3/gcc-git-static-analysis/build/gcc/testsuite/jit/test-factorial.c.exe
>         PASSED: test-factorial.c.exe iteration 1 of 5: set_up_logging: logfile is non-null
>         NOTE: test-factorial.c.exe iteration 1 of 5: writing reproducer to /home/david/coding-3/gcc-git-static-analysis/build/gcc/testsuite/jit/test-factorial.c.exe.reproducer.c
> Detaching after fork from child process 35787.
> Detaching after fork from child process 35789.
>         PASSED: test-factorial.c.exe iteration 1 of 5: verify_code: result is non-null
>         PASSED: test-factorial.c.exe iteration 1 of 5: verify_code: my_factorial is non-null
>         NOTE: my_factorial returned: 3628800
>         PASSED: test-factorial.c.exe iteration 1 of 5: verify_code: actual: val == expected: 3628800
>         PASSED: test-factorial.c.exe iteration 2 of 5: set_up_logging: logfile is non-null
>         NOTE: test-factorial.c.exe iteration 2 of 5: writing reproducer to /home/david/coding-3/gcc-git-static-analysis/build/gcc/testsuite/jit/test-factorial.c.exe.reproducer.c
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff71abc75 in ipcp_driver () at ../../src/gcc/ipa-cp.c:5091
> 5091      delete edge_clone_summaries;
>
> This appears to be due to recent(?) IPA changes that appear to assume
> that the IPA code is only initialized and cleaned up once.
>
> This patch fixes the crashes:
>
> Changes to jit.sum
> ------------------
>
>   FAIL: 65->0 (-65)
>   PASS: 3186->10290 (+7104)
>   UNRESOLVED: 1->0 (-1)
>
> Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
>
> OK for trunk?

OK.

RIchard.

> gcc/ChangeLog:
>         * ipa-cp.c (ipcp_driver): Set edge_clone_summaries to NULL after
>         deleting it.
>         * ipa-reference.c (ipa_reference_c_finalize): Delete
>         ipa_ref_opt_sum_summaries and set it to NULL.
> ---
>  gcc/ipa-cp.c        | 1 +
>  gcc/ipa-reference.c | 6 ++++++
>  2 files changed, 7 insertions(+)
>
> diff --git a/gcc/ipa-cp.c b/gcc/ipa-cp.c
> index c192e84..42dd4cc 100644
> --- a/gcc/ipa-cp.c
> +++ b/gcc/ipa-cp.c
> @@ -5089,6 +5089,7 @@ ipcp_driver (void)
>    /* Free all IPCP structures.  */
>    free_toporder_info (&topo);
>    delete edge_clone_summaries;
> +  edge_clone_summaries = NULL;
>    ipa_free_all_structures_after_ipa_cp ();
>    if (dump_file)
>      fprintf (dump_file, "\nIPA constant propagation end\n");
> diff --git a/gcc/ipa-reference.c b/gcc/ipa-reference.c
> index 9a9e94c..43bbdae 100644
> --- a/gcc/ipa-reference.c
> +++ b/gcc/ipa-reference.c
> @@ -1230,6 +1230,12 @@ make_pass_ipa_reference (gcc::context *ctxt)
>  void
>  ipa_reference_c_finalize (void)
>  {
> +  if (ipa_ref_opt_sum_summaries != NULL)
> +    {
> +      delete ipa_ref_opt_sum_summaries;
> +      ipa_ref_opt_sum_summaries = NULL;
> +    }
> +
>    if (ipa_init_p)
>      {
>        bitmap_obstack_release (&optimization_summary_obstack);
> --
> 1.8.5.3
>