[Bug c++/11695] New: Memory corruption with -O1 and complex ET code
derrick at cco dot caltech dot edu
gcc-bugzilla@gcc.gnu.org
Mon Jul 28 18:03:00 GMT 2003
PLEASE REPLY TO gcc-bugzilla@gcc.gnu.org ONLY, *NOT* gcc-bugs@gcc.gnu.org.
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=11695
Summary: Memory corruption with -O1 and complex ET code
Product: gcc
Version: 3.2.3
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: c++
AssignedTo: unassigned at gcc dot gnu dot org
ReportedBy: derrick at cco dot caltech dot edu
CC: gcc-bugs at gcc dot gnu dot org
GCC host triplet: i686-pc-linux-gnu
I think I found a bug in the optimizer. When I compile with -O1, my code crashes with a seg fault.
Without optimization it works fine. I began to add lots of debugging code, since it seemed to be a
memory corruption bug. When I add enough instrumentation, the code stops crashing, apparently
because the optimizer is no longer able to inline a certain function. Of course, it could still be my
bug, or a bug in Blitz++, but I'm pretty sure it's the compiler.
The problem also happens with gcc-3.3.1-20030720 (the code does not compile with 3.3), but it
took additional instrumentation code to remove the crash (with a different function that goes from
inline to non-inline). The output from the instrumentation indicates that the code is munging
memory either in an if statement or in a member function call. (I was not able to add enough
instrumentation code to the 3.2.3 version to determine if the crash was due to a similar problem.)
I am attaching the .ii files that compile (along with a few other files) into the crashing executable,
one for 3.2.3 and one for 3.3.1. At the end of this message are patches that, when applied to the
appropriate .ii file, produce the files that do not cause the crash. Both patches add a single line of
code that calls an external dummy function; adding this additional line of code prevents g++ from
inlining the function (at least as far as I can tell from nm), and untriggers my bug.
I hope you can track this down without the actual executable as that would require several more
files, libraries, and a copy of Mathematica! I am including output from the death throes of the
programs in case it helps track down the bug.
Derrick
**********************************************************
Here is what the 3.2.3 program, running under gdb, outputs just before it dies. As you can see, the
crash occurs a little beyond the point where I add the dummy function
/newman/user2/derrick/gnu/gcc-3.2.3/include/c++/3.2.3/blitz/array-impl.h 956
/newman/user2/derrick/gnu/gcc-3.2.3/include/c++/3.2.3/blitz/listinit.h: 101
/newman/user2/derrick/gnu/gcc-3.2.3/include/c++/3.2.3/blitz/array/ops.cc: 84
/newman/user2/derrick/gnu/gcc-3.2.3/include/c++/3.2.3/blitz/array/eval.cc: 182
/newman/user2/derrick/gnu/gcc-3.2.3/include/c++/3.2.3/blitz/array/ops.cc: 87
/newman/user2/derrick/gnu/gcc-3.2.3/include/c++/3.2.3/blitz/listinit.h: 106
Program received signal SIGSEGV, Segmentation fault.
blitz::MemoryBlockReference<boost::numeric::interval<long double,
boost::numeric::interval_lib::policies<boost::numeric::interval_lib::rounded_math<long double>,
boost::numeric::interval_lib::checking_strict<long double> > > >::blockRemoveReference()
(this=0xbfffe210) at /newman/user2/derrick/gnu/gcc-3.2.3/include/c++/3.2.3/blitz/
memblock.h:218
218 int refcount = --references_;
(gdb)
*****************************************************************
And some possibly helpful output from gdb:
(gdb) print *this
$5 = {data_ = 0x0, block_ = 0x0,
static nullBlock_ = {<MemoryBlock<boost::numeric::interval<long double,
boost::numeric::interval_lib::policies<boost::numeric::interval_lib::rounded_math<long double>,
boost::numeric::interval_lib::checking_strict<long double> > > >> = {_vptr.MemoryBlock =
0x80ef448, data_ = 0x0, dataBlockAddress_ = 0x0, references_ = 2, length_ = 0}, <No data
fields>}}
Somehow the fields of *this have been overwritten with zeroes.
*******************************************************************
Here is the same from the program I ran under 3.3.1 (not exactly the same program, I've added
additional debugging output). I have added some comments set off with asterisks. It appears that
somewhere in the "call" to initialize() memory is getting munged....
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array-impl.h 956
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/listinit.h: 103
<A>this = 0xbfffe3a0, array = 0xbfffe3c0, array.data = 0x404cd008 **** note the value of
array.data_ here
Unique:/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/ops.cc:
65
this = 0xbfffe3c0, data 0 ****** suddenly, after only an inlined function call and an if, the value
to data_
has changed to 0
Dump of
Array<N5boost7numeric8intervalIeNS0_12interval_lib8policiesINS2_12rounded_mathIeEENS2_15ch
ecking_strictIeEEEEEE, 1>:
ordering_ = 1 [ 0 ]
ascendingFlag_ = 1 [ 0 ]
base_ = 1 [ 0 ]
length_ = 1 [ -2147483648 ]
stride_ = 1 [ 257 ]
zeroOffset_ = 0
numElements() = -2147483648
isStorageContiguous() = 0
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/ops.cc: 84
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 182
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 209
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 246
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 269
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 288
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 290
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 292
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 295
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 300
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 302
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 305
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 319
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 323
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 331
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 333
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 336
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 386
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/eval.cc: 435
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/ops.cc: 87
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/ops.cc: 69
this = 0xbfffe3c0, data 0
Dump of
Array<N5boost7numeric8intervalIeNS0_12interval_lib8policiesINS2_12rounded_mathIeEENS2_15ch
ecking_strictIeEEEEEE, 1>:
ordering_ = 1 [ 0 ]
ascendingFlag_ = 1 [ 0 ]
base_ = 1 [ 0 ]
length_ = 1 [ -2147483648 ]
stride_ = 1 [ 257 ]
zeroOffset_ = 0
numElements() = -2147483648
isStorageContiguous() = 0
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/listinit.h: 109
Program received signal SIGSEGV, Segmentation fault.
KBEigenvalueEquation<KonarBhatt3DEquation<blitz::_bz_Expr<blitz::_bz_BinExprOp<blitz::_bz_Ex
prConstant<double>,
blitz::_bz_Expr<blitz::_bz_BinExprOp<blitz::_bz_Expr<blitz::_bz_BinExprOp<blitz::_bz_Expr<blitz:
:_bz_BinExprOp<blitz::_bz_ExprConstant<double>,
blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >, blitz::_bz_Multiply<double, double> > >,
blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >, blitz::_bz_Multiply<double, double> > >,
blitz::_bz_Expr<blitz::_bz_UnaryClassExprOp2<blitz::_bz_Expr<blitz::_bz_ExprIdentity<double>
>, NSStruct> >, blitz::_bz_Multiply<double, double> > >, blitz::_bz_Divide<double, double> > >,
blitz::_bz_Expr<blitz::_bz_BinaryClassExprOp2<blitz::_bz_UnaryClassExprOp2<blitz::_bz_Expr<bli
tz::_bz_ExprIdentity<double> >, NSStruct>,
blitz::_bz_Expr<blitz::_bz_Expr<blitz::_bz_BinExprOp<blitz::_bz_Expr<blitz::_bz_BinExprOp<blitz:
:_bz_ExprConstant<double>, blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >,
blitz::_bz_Multiply<double, double> > >, blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >,
blitz::_bz_Multiply<double, double> > ><blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >,
ClassFunc<double> > >, NSConductivityBase> > > >::Solve(blitz::Array<long double, 1>,
blitz::_bz_Expr<blitz::_bz_BinaryClassExprOp2<blitz::_bz_UnaryClassExprOp2<blitz::_bz_Expr<bli
tz::_bz_ExprIdentity<double> >, NSStruct>,
blitz::_bz_Expr<blitz::_bz_Expr<blitz::_bz_BinExprOp<blitz::_bz_Expr<blitz::_bz_BinExprOp<blitz:
:_bz_ExprConstant<double>, blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >,
blitz::_bz_Multiply<double, double> > >, blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >,
blitz::_bz_Multiply<double, double> > ><blitz::_bz_Expr<blitz::_bz_ExprIdentity<double> >,
ClassFunc<double> > >, NSConductivityBase> ><double, 1>) (this=0xbfffeae0, ic=
{<MemoryBlockReference<long double>> = {data_ = 0x8114e00, block_ = 0x8114de8, static
nullBlock_ = {<MemoryBlock<long double>> = {_vptr.MemoryBlock = 0x80f8358, data_ = 0x0,
dataBlockAddress_ = 0x0, references_ = 9, length_ = 0}, <No data fields>}},
<ETBase<blitz::Array<long double, 1> >> = {<No data fields>}, storage_ = {ordering_ = {data_ =
{0}}, ascendingFlag_ = {data_ = {true}}, base_ = {data_ = {0}}}, length_ = {data_ = {257}}, stride_ =
{data_ = {1}}, zeroOffset_ = 0}, times=
{<MemoryBlockReference<double>> = {data_ = 0x8118ea0, block_ = 0x8118e88, static
nullBlock_ = {<MemoryBlock<double>> = {_vptr.MemoryBlock = 0x80f83c8, data_ = 0x0,
dataBlockAddress_ = 0x0, references_ = 1, length_ = 0}, <No data fields>}},
<ETBase<blitz::Array<double, 1> >> = {<No data fields>}, storage_ = {ordering_ = {data_ = {0}},
ascendingFlag_ = {data_ = {true}}, base_ = {data_ = {0}}}, length_ = {data_ = {72}}, stride_ = {data_
= {1}}, zeroOffset_ = 0})
at /newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/
memblock.h:218
218 int refcount = --references_;
********************************************************
Here is an excerpt from the output of the "fixed" program at the same point in its execution:
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array-impl.h 956
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/listinit.h: 103
<A>this = 0xbfffe3a0, array = 0xbfffe3c0, array.data = 0x404cd008
Unique:/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/array/ops.cc:
65
this = 0xbfffe3c0, data 0x404cd008
Dump of
Array<N5boost7numeric8intervalIeNS0_12interval_lib8policiesINS2_12rounded_mathIeEENS2_15ch
ecking_strictIeEEEEEE, 1>:
ordering_ = 1 [ 0 ]
ascendingFlag_ = 1 [ 1 ]
base_ = 1 [ 0 ]
length_ = 1 [ 72 ]
stride_ = 1 [ 257 ]
zeroOffset_ = 0
numElements() = 72
isStorageContiguous() = 0
*********************************************************
g++-v:
Reading specs from /newman/user2/derrick/gnu/gcc-3.2.3/lib/gcc-lib/i686-pc-linux-gnu/
3.2.3/specs
Configured with: ../gcc-3.2.3/configure --prefix=/newman/user2/derrick/gnu/gcc-3.2.3
Thread model: posix
gcc version 3.2.3
/newman/user2/derrick/gnu/gcc-3.2.3/lib/gcc-lib/i686-pc-linux-gnu/3.2.3/cc1plus -
fpreprocessed KonarBhattSimEigInt.crashy.ii -quiet -dumpbase KonarBhattSimEigInt.crashy.ii -O1
-version -o /tmp/cc01HVBw.s
GNU CPP version 3.2.3 (cpplib) (i386 Linux/ELF)
GNU C++ version 3.2.3 (i686-pc-linux-gnu)
compiled by GNU C version 3.2.3.
as -V -Qy -o o_files/eg++-latest/3.2.3/O1/KonarBhattSimEigInt.o /tmp/cc01HVBw.s
GNU assembler version 2.11.93.0.2 (i386-redhat-linux) using BFD version 2.11.93.0.2 20020207
*******************************************************
and
Reading specs from /newman/user2/derrick/gnu/gcc-3.3.1-20030720/lib/gcc-lib/i686-pc-
linux-gnu/3.3.1/specs
Configured with: ../gcc-3.3.1-20030720/configure --prefix=/newman/user2/derrick/gnu/gcc-
3.3.1-20030720
Thread model: posix
gcc version 3.3.1 20030720 (prerelease)
/newman/user2/derrick/gnu/gcc-3.3.1-20030720/lib/gcc-lib/i686-pc-linux-gnu/3.3.1/cc1plus
-fpreprocessed KonarBhattSimEigInt-3.3.1.crashy.ii -quiet -dumpbase KonarBhattSimEigInt-
3.3.1.crashy.ii -auxbase-strip o_files/eg++-latest/3.3.1/O1/KonarBhattSimEigInt.o -O1 -version
-o /tmp/cc4ZHhy1.s
GNU C++ version 3.3.1 20030720 (prerelease) (i686-pc-linux-gnu)
compiled by GNU C version 3.3.1 20030720 (prerelease).
GGC heuristics: --param ggc-min-expand=64 --param ggc-min-heapsize=64298
as -V -Qy -o o_files/eg++-latest/3.3.1/O1/KonarBhattSimEigInt.o /tmp/cc4ZHhy1.s
GNU assembler version 2.11.93.0.2 (i386-redhat-linux) using BFD version 2.11.93.0.2 20020207
**************************************************************
Here is the context diff that makes a non-crashing version for gcc-3.2.3
*** KonarBhattSimEigInt.crashy.ii Fri Jul 25 20:04:36 2003
--- KonarBhattSimEigInt.noncrashy.ii Fri Jul 25 19:53:15 2003
***************
*** 49592,49598 ****
!
dummyFunc();
dummyFunc();
return *this;
--- 49592,49598 ----
! dummyFunc();
dummyFunc();
dummyFunc();
return *this;
***************************************************************************
Here is the context diff that makes a non-crashing version for gcc-3.3.1
*** KonarBhattSimEigInt-3.3.1.crashy.ii Sun Jul 27 03:54:09 2003
--- KonarBhattSimEigInt-3.3.1.noncrashy.ii Sun Jul 27 04:25:35 2003
***************
*** 37105,37111 ****
cerr << "/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/
listinit.h" << ": " << 103 << endl;
cerr << "<A>this = " << this << ", " << "array = " << &array_
<< ", array.data = " << array_.dataZero() << endl;
!
if (wipeOnDestruct_)
array_.initialize(value_);
cerr << "/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/
listinit.h" << ": " << 109 << endl;
--- 37105,37111 ----
cerr << "/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/
listinit.h" << ": " << 103 << endl;
cerr << "<A>this = " << this << ", " << "array = " << &array_
<< ", array.data = " << array_.dataZero() << endl;
! dummyFunc();
if (wipeOnDestruct_)
array_.initialize(value_);
cerr << "/newman/user2/derrick/gnu/gcc-3.3.1-20030720/include/c++/3.3.1/blitz/
listinit.h" << ": " << 109 << endl;
More information about the Gcc-bugs
mailing list