Bug 111279 - ICE: Segmentation fault with m68k,SJLJ and -malign-int
Summary: ICE: Segmentation fault with m68k,SJLJ and -malign-int
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: target (show other bugs)
Version: 14.0
: P3 normal
Target Milestone: 14.0
Assignee: Not yet assigned to anyone
URL:
Keywords: EH, ice-on-valid-code, sjlj-eh
Depends on:
Blocks:
 
Reported: 2023-09-03 22:37 UTC by Vincent Riviere
Modified: 2024-01-21 23:01 UTC (History)
4 users (show)

See Also:
Host:
Target: m68k-elf
Build:
Known to work:
Known to fail: 13.2.0
Last reconfirmed:


Attachments
Avoid segmentation fault when calling assign_temp with a NULL type pointer (602 bytes, patch)
2023-09-04 13:21 UTC, Thorsten Otto
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Vincent Riviere 2023-09-03 22:37:40 UTC
m68k-elf-g++ causes "internal compiler error: Segmentation fault" when configured for m68k-elf, SJLJ exceptions, and compiling a specific program with -malign-int.

$ cat >bug.cc <<EOF
template<typename T>
struct A
{
  A()
  { }

  char buf[4];
};

template<typename T>
struct B : public A<T>
{
  B()
  { }
};

template<typename T>
struct C : public B<T>
{
  C() throw()
  { }
};

void f()
{
  C<char> tmp;
}
EOF

gcc was configured with:
~/sources/gcc/configure --target=m68k-elf --disable-nls --disable-multilib --enable-languages="c,c++" --disable-libstdc++-pch --disable-lto --enable-sjlj-exceptions

$ /home/vincent/compil/gccelfsjlj.obj/gcc/cc1plus bug.cc -malign-int
 A<T>::A() B<T>::B() C<T>::C() void f() C<char> B<char> A<char> C<T>::C() [with T = char] C<T>::C() [with T = char] C<T>::C() [with T = char] B<T>::B() [with T = char] B<T>::B() [with T = char] B<T>::B() [with T = char] A<T>::A() [with T = char] A<T>::A() [with T = char] A<T>::A() [with T = char]
Analyzing compilation unit
Performing interprocedural optimizations
 <*free_lang_data> {heap 1068k} <visibility> {heap 1068k} <build_ssa_passes> {heap 1068k} <opt_local_passes> {heap 1348k} <remove_symbols> {heap 1348k} <targetclone> {heap 1348k} <free-fnsummary> {heap 1348k}Streaming LTO
 <whole-program> {heap 1348k} <fnsummary> {heap 1348k} <inline> {heap 1348k} <modref> {heap 1348k} <free-fnsummary> {heap 1348k} <single-use> {heap 1348k} <comdats> {heap 1348k}Assembling functions:
 void f() C<T>::C() [with T = char]during RTL pass: expand

bug.cc: In constructor 'C<T>::C() [with T = char]':
bug.cc:21:5: internal compiler error: Segmentation fault
   21 |   { }
      |     ^
0x1174ec3 crash_signal
	/home/vincent/sources/gcc/gcc/toplev.cc:314
0x7f7ca4a3c4af ???
	./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0xe08653 assign_temp(tree_node*, int, int)
	/home/vincent/sources/gcc/gcc/function.cc:976
0xdab01f emit_push_insn(rtx_def*, machine_mode, tree_node*, rtx_def*, unsigned int, int, rtx_def*, poly_int<1u, long>, rtx_def*, rtx_def*, int, rtx_def*, bool)
	/home/vincent/sources/gcc/gcc/expr.cc:4920
0xc5f915 emit_library_call_value_1(int, rtx_def*, rtx_def*, libcall_type, machine_mode, int, std::pair<rtx_def*, machine_mode>*)
	/home/vincent/sources/gcc/gcc/calls.cc:4585
0xd765bf emit_library_call(rtx_def*, libcall_type, machine_mode, rtx_def*, machine_mode)
	/home/vincent/sources/gcc/gcc/rtl.h:4343
0xd765bf sjlj_emit_function_enter
	/home/vincent/sources/gcc/gcc/except.cc:1212
0xd7b90d sjlj_build_landing_pads
	/home/vincent/sources/gcc/gcc/except.cc:1491
0xd7b90d finish_eh_generation()
	/home/vincent/sources/gcc/gcc/except.cc:1520
0xc7c1a6 execute
	/home/vincent/sources/gcc/gcc/cfgexpand.cc:6940
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
$ /home/vincent/compil/gccelfsjlj.obj/gcc/cc1plus bug.cc -malign-int
 A<T>::A() B<T>::B() C<T>::C() void f() C<char> B<char> A<char> C<T>::C() [with T = char] C<T>::C() [with T = char] C<T>::C() [with T = char] B<T>::B() [with T = char] B<T>::B() [with T = char] B<T>::B() [with T = char] A<T>::A() [with T = char] A<T>::A() [with T = char] A<T>::A() [with T = char]
Analyzing compilation unit
Performing interprocedural optimizations
 <*free_lang_data> {heap 1068k} <visibility> {heap 1068k} <build_ssa_passes> {heap 1068k} <opt_local_passes> {heap 1348k} <remove_symbols> {heap 1348k} <targetclone> {heap 1348k} <free-fnsummary> {heap 1348k}Streaming LTO
 <whole-program> {heap 1348k} <fnsummary> {heap 1348k} <inline> {heap 1348k} <modref> {heap 1348k} <free-fnsummary> {heap 1348k} <single-use> {heap 1348k} <comdats> {heap 1348k}Assembling functions:
 void f() C<T>::C() [with T = char]during RTL pass: expand

bug.cc: In constructor 'C<T>::C() [with T = char]':
bug.cc:21:5: internal compiler error: Segmentation fault
   21 |   { }
      |     ^
0x1174ec3 crash_signal
	/home/vincent/sources/gcc/gcc/toplev.cc:314
0x7f7ca4a3c4af ???
	./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0xe08653 assign_temp(tree_node*, int, int)
	/home/vincent/sources/gcc/gcc/function.cc:976
0xdab01f emit_push_insn(rtx_def*, machine_mode, tree_node*, rtx_def*, unsigned int, int, rtx_def*, poly_int<1u, long>, rtx_def*, rtx_def*, int, rtx_def*, bool)
	/home/vincent/sources/gcc/gcc/expr.cc:4920
0xc5f915 emit_library_call_value_1(int, rtx_def*, rtx_def*, libcall_type, machine_mode, int, std::pair<rtx_def*, machine_mode>*)
	/home/vincent/sources/gcc/gcc/calls.cc:4585
0xd765bf emit_library_call(rtx_def*, libcall_type, machine_mode, rtx_def*, machine_mode)
	/home/vincent/sources/gcc/gcc/rtl.h:4343
0xd765bf sjlj_emit_function_enter
	/home/vincent/sources/gcc/gcc/except.cc:1212
0xd7b90d sjlj_build_landing_pads
	/home/vincent/sources/gcc/gcc/except.cc:1491
0xd7b90d finish_eh_generation()
	/home/vincent/sources/gcc/gcc/except.cc:1520
0xc7c1a6 execute
	/home/vincent/sources/gcc/gcc/cfgexpand.cc:6940
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Tested with the current master branch (GCC 14), and also with GCC 13.2.0.
Comment 1 Andrew Pinski 2023-09-03 22:43:33 UTC
sjlj-exceptions is very much not tested as much as the others.
Comment 2 Thorsten Otto 2023-09-04 05:06:21 UTC
emit_push_insn is called from https://gcc.gnu.org/git?p=gcc.git;a=blob;f=gcc/calls.cc;h=1f3a6d5c45099499deeef63f867ed11774dec47e;hb=HEAD#l4585 where only a NULL_TREE pointer is passed for the type, and crashes when trying to access the TREE_CODE.

The call to assign_temp was inserted by https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=46bd2beed4c78dcb32fcde4913815527c14e5e17
Comment 3 Thorsten Otto 2023-09-04 13:21:17 UTC
Created attachment 55837 [details]
Avoid segmentation fault when calling assign_temp with a NULL type pointer

Attached is a potential patch to fix that.

The above mentioned commit was made for gcc 4.3, and all compiler versions after that are affected by it.
Comment 4 Mikael Pettersson 2024-01-03 16:06:59 UTC
(In reply to Thorsten Otto from comment #3)
> Created attachment 55837 [details]
> Avoid segmentation fault when calling assign_temp with a NULL type pointer
> 
> Attached is a potential patch to fix that.
> 
> The above mentioned commit was made for gcc 4.3, and all compiler versions
> after that are affected by it.

This patch also fixes PR82420. That PR contains a tidied up patch with a test case and proper attribution to your original. Will you submit your patch or should I submit mine?
Comment 5 Thorsten Otto 2024-01-03 22:29:24 UTC
I don't mind. If your patch also contains a test case, just use that.
Comment 6 GCC Commits 2024-01-21 22:59:52 UTC
The master branch has been updated by Jeff Law <law@gcc.gnu.org>:

https://gcc.gnu.org/g:bdcf7226c9fe87352466eb9a6bfc58fa24b3e5e1

commit r14-8324-gbdcf7226c9fe87352466eb9a6bfc58fa24b3e5e1
Author: Mikael Pettersson <mikpelinux@gmail.com>
Date:   Sun Jan 21 15:55:49 2024 -0700

    Re: [PATCH] Avoid ICE with m68k-elf -malign-int and libcalls
    
    >> emit_library_call_value_1 calls emit_push_insn with NULL_TREE
    >> for TYPE.  Sometimes emit_push_insn needs to assign a temp with
    >> that TYPE, which causes a segfault.
    >>
    >> Fixed by computing the TYPE from MODE when needed.
    >>
    >> Original patch by Thorsten Otto.
    >>
    [ ... ]
    > This really needs to happen in the two call paths which pass in
    > NULL_TREE for the type.  Note how the type is used to determine padding
    > earlier in emit_push_insn.  That would also make the code more
    > consistent with the comment before emit_push_insn which implies that
    > both MODE and TYPE are valid.
    >
    >
    > Additionally you should bootstrap and regression test this patch on at
    > least one target.
    
    Updated as requested, and bootstrapped and tested on
    {x86_64,aarch64,m68k}-linux-gnu without regressions.
    
    gcc/
    
            PR target/82420
            PR target/111279
            * calls.cc (emit_library_call_value_1): Pass valid TYPE
            to emit_push_insn.
            * expr.cc (emit_push_insn): Likewise.
    
    gcc/testsuite/
    
            PR target/82420
            * gcc.target/m68k/pr82420.c: New test.
    
                Co-authored-by: Thorsten Otto  <admin@tho-otto.de>
Comment 7 Jeffrey A. Law 2024-01-21 23:01:25 UTC
Should be fixed on the trunk.  No plans to backport.