Bug 58739 - libgomp/testsuite/libgomp.c/simd-3.c causes ICE in the vectorizer.
Summary: libgomp/testsuite/libgomp.c/simd-3.c causes ICE in the vectorizer.
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: middle-end (show other bugs)
Version: 4.9.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-15 13:18 UTC by Tejas Belagod
Modified: 2015-01-13 11:03 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tejas Belagod 2013-10-15 13:18:58 UTC
This reduced testcase ICEs when compiled with -O2 -fopenmp

/* rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1 -O2 besttry.c -fopenmp */

int a[1024] __attribute__ ((aligned (32))) =
{
1};
int b[1024] __attribute__ ((aligned (32))) =
{
1};
int k, m;
long unsigned int u, u2, u3;
__attribute__ ((noinline, noclone))
     int foo (int *p)
{
  int i, s = 0, s2 = 0, t, t2;
#pragma omp simd aligned(a, b, p : 32) linear(k: m + 1) reduction(+:s2) lastprivate (t, u, u2, u3)
  for (i = 512; i < 1024; i++)
    {
      u = (long unsigned int) &k;
    }
}

This seems to be a memory corruption in the vectorizer where we try to free unallocated memory. Here is the backtrace:

foo
Analyzing compilation unit
Performing interprocedural optimizations
 <*free_lang_data> <visibility> <early_local_cleanups> <*free_inline_summary> <whole-program> <profile_estimate> <devirt> <cp> <inline> <pure-const> <static-var>Assembling functions:
 foo*** glibc detected *** rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1: double free or corruption (!prev): 0x000000001b5cffd0 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3d9167247f]
/lib64/libc.so.6(cfree+0x4b)[0x3d916728db]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z14free_data_refs3vecIP14data_reference7va_heap6vl_ptrE+0x3f)[0xd2cb3f]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z21destroy_loop_vec_infoP14_loop_vec_infob+0x3e)[0xb05b4e]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z17vect_analyze_loopP4loop+0xf1)[0xb0f591]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z15vectorize_loopsv+0x84a)[0xb263ea]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z16execute_one_passP8opt_pass+0x3a9)[0x89d1f9]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z17execute_pass_listP8opt_pass+0x16)[0x89d3f6]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z17execute_pass_listP8opt_pass+0x28)[0x89d408]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z17execute_pass_listP8opt_pass+0x28)[0x89d408]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1[0x63af19]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z7compilev+0x7b1)[0x63ce21]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z25finalize_compilation_unitv+0x5a)[0x63e41a]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z27c_write_global_declarationsv+0x193)[0x4f92c3]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1[0x94009d]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_Z11toplev_mainiPPc+0xac6)[0x941246]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x3d9161d994]
rhe5x86_64/aarch64-none-linux-gnu/obj/gcc4/gcc/cc1(_ZNSt8ios_base4InitD1Ev+0x51)[0x4e58c9]

besttry.i: In function 'foo':
besttry.i:11:10: internal compiler error: Aborted
      int foo (int *p)
          ^
0x93f9d5 crash_signal
        /src/gcc/gcc/toplev.c:335
0xd2cb3e free_data_refs(vec<data_reference*, va_heap, vl_ptr>)
        /src/gcc/gcc/tree-data-ref.c:4799
0xb05b4d destroy_loop_vec_info(_loop_vec_info*, bool)
        /src/gcc/gcc/tree-vect-loop.c:982
0xb0f590 vect_analyze_loop(loop*)
        /src/gcc/gcc/tree-vect-loop.c:1810
0xb263e9 vectorize_loops()
        /src/gcc/gcc/tree-vectorizer.c:355
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

My configure is:

/src/gcc/configure --target=aarch64-none-linux-gnu --prefix=/opt/aarch64 --with-sysroot=/opt/aarch64/aarch64-none-linux-gnu/libc --with-build-sysroot=/workdir/rhe5x86_64/aarch64-none-linux-gnu/install//opt/aarch64/aarch64-none-linux-gnu/libc --enable-shared --disable-libssp --disable-libmudflap --with-plugin-ld=aarch64-none-linux-gnu-ld --enable-languages=c,c++,fortran --with-gmp=/workdir/rhe5x86_64/aarch64-none-linux-gnu/host-tools --with-mpfr=/workdir/rhe5x86_64/aarch64-none-linux-gnu/host-tools --with-mpc=/workdir/rhe5x86_64/aarch64-none-linux-gnu/host-tools --with-isl=/workdir/rhe5x86_64/aarch64-none-linux-gnu/host-tools --with-cloog=/workdir/rhe5x86_64/aarch64-none-linux-gnu/host-tools 

Some valgrind-ing that might help:

 foo
Analyzing compilation unit
Performing interprocedural optimizations
 <*free_lang_data> <visibility> <early_local_cleanups> <*free_inline_summary> <whole-program> <profile_estimate> <devirt> <cp> <inline> <pure-const> <static-var>Assembling functions:
 foo==10709== Invalid read of size 8
==10709==    at 0xB24F18: vect_destroy_datarefs(_loop_vec_info*, _bb_vec_info*) (tree-vectorizer.c:299)
==10709==    by 0xB05B4D: destroy_loop_vec_info(_loop_vec_info*, bool) (tree-vect-loop.c:982)
==10709==    by 0xB0F590: vect_analyze_loop(loop*) (tree-vect-loop.c:1810)
==10709==    by 0xB263E9: vectorize_loops() (tree-vectorizer.c:355)
==10709==    by 0x89D1F8: execute_one_pass(opt_pass*) (passes.c:2208)
==10709==    by 0x89D3F5: execute_pass_list(opt_pass*) (passes.c:2260)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x63AF18: expand_function(cgraph_node*) (cgraphunit.c:1750)
==10709==    by 0x63CE20: compile() (cgraphunit.c:1855)
==10709==    by 0x63E419: finalize_compilation_unit() (cgraphunit.c:2269)
==10709==    by 0x4F92C2: c_write_global_declarations() (c-decl.c:10192)
==10709==  Address 0x54ecb00 is 16 bytes inside a block of size 112 free'd
==10709==    at 0x4A05D21: free (vg_replace_malloc.c:325)
==10709==    by 0xD4D7F7: vect_analyze_data_refs(_loop_vec_info*, _bb_vec_info*, int*) (tree-vect-data-refs.c:3389)
==10709==    by 0xB0E063: vect_analyze_loop_2(_loop_vec_info*) (tree-vect-loop.c:1627)
==10709==    by 0xB0F57B: vect_analyze_loop(loop*) (tree-vect-loop.c:1803)
==10709==    by 0xB263E9: vectorize_loops() (tree-vectorizer.c:355)
==10709==    by 0x89D1F8: execute_one_pass(opt_pass*) (passes.c:2208)
==10709==    by 0x89D3F5: execute_pass_list(opt_pass*) (passes.c:2260)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x63AF18: expand_function(cgraph_node*) (cgraphunit.c:1750)
==10709==    by 0x63CE20: compile() (cgraphunit.c:1855)
==10709==    by 0x63E419: finalize_compilation_unit() (cgraphunit.c:2269)
==10709== 
==10709== Invalid read of size 8
==10709==    at 0xD2CAD4: free_data_ref(data_reference*) (vec.h:1519)
==10709==    by 0xD2CB3E: free_data_refs(vec<data_reference*, va_heap, vl_ptr>) (tree-data-ref.c:4799)
==10709==    by 0xB05B4D: destroy_loop_vec_info(_loop_vec_info*, bool) (tree-vect-loop.c:982)
==10709==    by 0xB0F590: vect_analyze_loop(loop*) (tree-vect-loop.c:1810)
==10709==    by 0xB263E9: vectorize_loops() (tree-vectorizer.c:355)
==10709==    by 0x89D1F8: execute_one_pass(opt_pass*) (passes.c:2208)
==10709==    by 0x89D3F5: execute_pass_list(opt_pass*) (passes.c:2260)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x63AF18: expand_function(cgraph_node*) (cgraphunit.c:1750)
==10709==    by 0x63CE20: compile() (cgraphunit.c:1855)
==10709==    by 0x63E419: finalize_compilation_unit() (cgraphunit.c:2269)
==10709==  Address 0x54ecb40 is 80 bytes inside a block of size 112 free'd
==10709==    at 0x4A05D21: free (vg_replace_malloc.c:325)
==10709==    by 0xD4D7F7: vect_analyze_data_refs(_loop_vec_info*, _bb_vec_info*, int*) (tree-vect-data-refs.c:3389)
==10709==    by 0xB0E063: vect_analyze_loop_2(_loop_vec_info*) (tree-vect-loop.c:1627)
==10709==    by 0xB0F57B: vect_analyze_loop(loop*) (tree-vect-loop.c:1803)
==10709==    by 0xB263E9: vectorize_loops() (tree-vectorizer.c:355)
==10709==    by 0x89D1F8: execute_one_pass(opt_pass*) (passes.c:2208)
==10709==    by 0x89D3F5: execute_pass_list(opt_pass*) (passes.c:2260)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x63AF18: expand_function(cgraph_node*) (cgraphunit.c:1750)
==10709==    by 0x63CE20: compile() (cgraphunit.c:1855)
==10709==    by 0x63E419: finalize_compilation_unit() (cgraphunit.c:2269)
==10709== 
==10709== Invalid free() / delete / delete[]
==10709==    at 0x4A05D21: free (vg_replace_malloc.c:325)
==10709==    by 0xD2CB3E: free_data_refs(vec<data_reference*, va_heap, vl_ptr>) (tree-data-ref.c:4799)
==10709==    by 0xB05B4D: destroy_loop_vec_info(_loop_vec_info*, bool) (tree-vect-loop.c:982)
==10709==    by 0xB0F590: vect_analyze_loop(loop*) (tree-vect-loop.c:1810)
==10709==    by 0xB263E9: vectorize_loops() (tree-vectorizer.c:355)
==10709==    by 0x89D1F8: execute_one_pass(opt_pass*) (passes.c:2208)
==10709==    by 0x89D3F5: execute_pass_list(opt_pass*) (passes.c:2260)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x63AF18: expand_function(cgraph_node*) (cgraphunit.c:1750)
==10709==    by 0x63CE20: compile() (cgraphunit.c:1855)
==10709==    by 0x63E419: finalize_compilation_unit() (cgraphunit.c:2269)
==10709==  Address 0x54ecaf0 is 0 bytes inside a block of size 112 free'd
==10709==    at 0x4A05D21: free (vg_replace_malloc.c:325)
==10709==    by 0xD4D7F7: vect_analyze_data_refs(_loop_vec_info*, _bb_vec_info*, int*) (tree-vect-data-refs.c:3389)
==10709==    by 0xB0E063: vect_analyze_loop_2(_loop_vec_info*) (tree-vect-loop.c:1627)
==10709==    by 0xB0F57B: vect_analyze_loop(loop*) (tree-vect-loop.c:1803)
==10709==    by 0xB263E9: vectorize_loops() (tree-vectorizer.c:355)
==10709==    by 0x89D1F8: execute_one_pass(opt_pass*) (passes.c:2208)
==10709==    by 0x89D3F5: execute_pass_list(opt_pass*) (passes.c:2260)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x89D407: execute_pass_list(opt_pass*) (passes.c:2261)
==10709==    by 0x63AF18: expand_function(cgraph_node*) (cgraphunit.c:1750)
==10709==    by 0x63CE20: compile() (cgraphunit.c:1855)
==10709==    by 0x63E419: finalize_compilation_unit() (cgraphunit.c:2269)


I'm in the process of isolating the patch that triggerred this.
Comment 1 Tejas Belagod 2015-01-13 11:03:10 UTC
I cannot reproduce this ICE on trunk or 4.9, so closing as resolved.