Discussion:
[Bug tree-optimization/62032] New: FAIL: vsnprintf-chk.c execution, -O2 -flto -fno-use-linker-plugin -flto-partition=none
(too old to reply)
amker.cheng at gmail dot com
2014-08-06 08:35:29 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

Bug ID: 62032
Summary: FAIL: vsnprintf-chk.c execution, -O2 -flto
-fno-use-linker-plugin -flto-partition=none
Product: gcc
Version: 4.10.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: amker.cheng at gmail dot com

Created attachment 33256
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33256&action=edit
tarball of dump files

Hi,
I monitored below failures on both aarch64-none-elf and arm-none-eabi.
FAIL: gcc.c-torture/execute/builtins/vsnprintf-chk.c execution, -O2 -flto
-fno-use-linker-plugin -flto-partition=none
FAIL: gcc.c-torture/execute/builtins/vsnprintf-chk.c execution, -O2 -flto
-fuse-linker-plugin -fno-fat-lto-objects

It's first introduced by r213585, but I am not sure if it's revealed by the
change. The corresponding (good&bogus) dump files are attached.

arm-none-eabi is configured like:
../gcc/configure --build=x86_64-linux-gnu --host=x86_64-linux-gnu
--target=arm-none-eabi --prefix=.../trunk-orig/target/ --disable-decimal-float
--disable-libffi --disable-libgomp --disable-libmudflap --disable-libquadmath
--disable-libssp --disable-libstdcxx-pch --disable-nls --disable-shared
--disable-threads --disable-tls --with-gnu-as --with-gnu-ld --with-newlib
--with-headers=yes --with-sysroot=.../trunk-orig/target/arm-none-eabi
--with-host-libstdcxx=... --with-mode=thumb --with-arch=armv7-m
--disable-multilib --enable-lto --enable-languages=c,c++,lto

Thanks.
amker.cheng at gmail dot com
2014-08-06 08:40:54 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

--- Comment #1 from bin.cheng <amker.cheng at gmail dot com> ---
Only fail with lto options.
ktkachov at gcc dot gnu.org
2014-08-06 08:50:51 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

ktkachov at gcc dot gnu.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |NEW
Known to work| |4.9.1
Keywords| |lto
Last reconfirmed| |2014-08-06
CC| |ktkachov at gcc dot gnu.org
Ever confirmed|0 |1
Target Milestone|--- |4.10.0
Known to fail| |4.10.0

--- Comment #2 from ktkachov at gcc dot gnu.org ---
confirmed, I've noticed this as well.
This seems to appear with LTO
amker.cheng at gmail dot com
2014-08-07 07:43:58 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

--- Comment #3 from bin.cheng <amker.cheng at gmail dot com> ---
I did some investigation and think it's a latent bug of lto which reveaded by
r213585.

Before the revision, pass_fold_builtins::execute calls gimple_fold_builtins
directly to fold __builtin___vsnprintf_chk (_26, _25, 0, 4294967295, "%d - %c",
ap);. It works fine by simplifying the builtin into __builtin_vsnprintf (_26,
_25, "%d - %c", ap);.

After the revision, it calls to
fold_stmt->gimple_fold_call->gimple_fold_builtin to do the job. But before
that, it calls gimple_call_builtin_p to verify that it IS a valid builtin call,
which in turn calls gimple_builtin_call_types_compatible_p to check that types
between parameter and argument match each other. Well, the check fails on the
last parameter/argument, as dumped below:

TREE_TYPE of ARGUMENT:
<record_type 0x7fc34cc9fc78 va_list SI
size <integer_cst 0x7fc34ce71dc8 type <integer_type 0x7fc34ce7c0a8
bitsizetype> constant 32>
unit size <integer_cst 0x7fc34ce71de0 type <integer_type 0x7fc34ce7c000
sizetype> constant 4>
align 32 symtab 0 alias set -1 canonical type 0x7fc34ce899d8
fields <field_decl 0x7fc34ce87130 __ap
type <pointer_type 0x7fc34ce84000 type <void_type 0x7fc34ce7cf18 void>
public unsigned SI size <integer_cst 0x7fc34ce71dc8 32> unit size
<integer_cst 0x7fc34ce71de0 4>
align 32 symtab 0 alias set 3 canonical type 0x7fc34ce84000
pointer_to_this <pointer_type 0x7fc34ce8a348>>
unsigned SI file <built-in> line 0 col 0 size <integer_cst
0x7fc34ce71dc8 32> unit size <integer_cst 0x7fc34ce71de0 4>
align 32 offset_align 64
offset <integer_cst 0x7fc34ce71df8 constant 0>
bit offset <integer_cst 0x7fc34ce71e58 constant 0> context <record_type
0x7fc34ce899d8 __va_list>> context <translation_unit_decl 0x7fc34df310f0
D.4035>
pointer_to_this <pointer_type 0x7fc34ccaa2a0> chain <type_decl
0x7fc34ce87da8 __va_list>>

TREE_TYPE of PARAMETER of function BUILT_IN_VSNPRINTF_CHK:
<reference_type 0x7fc34ce89c78
type <record_type 0x7fc34ce899d8 __va_list SI
size <integer_cst 0x7fc34ce71dc8 constant 32>
unit size <integer_cst 0x7fc34ce71de0 constant 4>
align 32 symtab 0 alias set 7 canonical type 0x7fc34ce899d8
fields <field_decl 0x7fc34ce87130 __ap type <pointer_type
0x7fc34ce84000>
unsigned SI file <built-in> line 0 col 0 size <integer_cst
0x7fc34ce71dc8 32> unit size <integer_cst 0x7fc34ce71de0 4>
align 32 offset_align 64
offset <integer_cst 0x7fc34ce71df8 constant 0>
bit offset <integer_cst 0x7fc34ce71e58 constant 0> context
<record_type 0x7fc34ce899d8 __va_list>>
pointer_to_this <pointer_type 0x7fc34ccc4888> reference_to_this
<reference_type 0x7fc34ccaa0a8> chain <type_decl 0x7fc34ce87098 __va_list>>
unsigned SI size <integer_cst 0x7fc34ce71dc8 32> unit size <integer_cst
0x7fc34ce71de0 4>
align 32 symtab 0 alias set -1 canonical type 0x7fc34ce89c78>


The root cause lies in gcc/lto/lto-lang.c:lto_init, there is below code
snippet:

if (TREE_CODE (va_list_type_node) == ARRAY_TYPE)
{
tree x = build_pointer_type (TREE_TYPE (va_list_type_node));
lto_define_builtins (x, x);
}
else
{
lto_define_builtins (va_list_type_node,
build_reference_type (va_list_type_node));
}

While prototype of lto_define_builtins is like below.
static void
lto_define_builtins (tree va_list_ref_type_node ATTRIBUTE_UNUSED,
tree va_list_arg_type_node ATTRIBUTE_UNUSED);

Apparently, the arguments passed to lto_define_builtins are mis-matched. In
fact, I think it should be consistent with function calls to c_define_builtins
in c front-end.

I think above analysis also explains why it happens only with lto.

I will send a patch fixing this soon.

Thanks,
bin
rguenther at suse dot de
2014-08-07 07:59:05 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

--- Comment #4 from rguenther at suse dot de <rguenther at suse dot de> ---
Post by amker.cheng at gmail dot com
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032
--- Comment #3 from bin.cheng <amker.cheng at gmail dot com> ---
I did some investigation and think it's a latent bug of lto which reveaded by
r213585.
Before the revision, pass_fold_builtins::execute calls gimple_fold_builtins
directly to fold __builtin___vsnprintf_chk (_26, _25, 0, 4294967295, "%d - %c",
ap);. It works fine by simplifying the builtin into __builtin_vsnprintf (_26,
_25, "%d - %c", ap);.
After the revision, it calls to
fold_stmt->gimple_fold_call->gimple_fold_builtin to do the job. But before
that, it calls gimple_call_builtin_p to verify that it IS a valid builtin call,
which in turn calls gimple_builtin_call_types_compatible_p to check that types
between parameter and argument match each other. Well, the check fails on the
<record_type 0x7fc34cc9fc78 va_list SI
size <integer_cst 0x7fc34ce71dc8 type <integer_type 0x7fc34ce7c0a8
bitsizetype> constant 32>
unit size <integer_cst 0x7fc34ce71de0 type <integer_type 0x7fc34ce7c000
sizetype> constant 4>
align 32 symtab 0 alias set -1 canonical type 0x7fc34ce899d8
fields <field_decl 0x7fc34ce87130 __ap
type <pointer_type 0x7fc34ce84000 type <void_type 0x7fc34ce7cf18 void>
public unsigned SI size <integer_cst 0x7fc34ce71dc8 32> unit size
<integer_cst 0x7fc34ce71de0 4>
align 32 symtab 0 alias set 3 canonical type 0x7fc34ce84000
pointer_to_this <pointer_type 0x7fc34ce8a348>>
unsigned SI file <built-in> line 0 col 0 size <integer_cst
0x7fc34ce71dc8 32> unit size <integer_cst 0x7fc34ce71de0 4>
align 32 offset_align 64
offset <integer_cst 0x7fc34ce71df8 constant 0>
bit offset <integer_cst 0x7fc34ce71e58 constant 0> context <record_type
0x7fc34ce899d8 __va_list>> context <translation_unit_decl 0x7fc34df310f0
D.4035>
pointer_to_this <pointer_type 0x7fc34ccaa2a0> chain <type_decl
0x7fc34ce87da8 __va_list>>
<reference_type 0x7fc34ce89c78
type <record_type 0x7fc34ce899d8 __va_list SI
size <integer_cst 0x7fc34ce71dc8 constant 32>
unit size <integer_cst 0x7fc34ce71de0 constant 4>
align 32 symtab 0 alias set 7 canonical type 0x7fc34ce899d8
fields <field_decl 0x7fc34ce87130 __ap type <pointer_type
0x7fc34ce84000>
unsigned SI file <built-in> line 0 col 0 size <integer_cst
0x7fc34ce71dc8 32> unit size <integer_cst 0x7fc34ce71de0 4>
align 32 offset_align 64
offset <integer_cst 0x7fc34ce71df8 constant 0>
bit offset <integer_cst 0x7fc34ce71e58 constant 0> context
<record_type 0x7fc34ce899d8 __va_list>>
pointer_to_this <pointer_type 0x7fc34ccc4888> reference_to_this
<reference_type 0x7fc34ccaa0a8> chain <type_decl 0x7fc34ce87098 __va_list>>
unsigned SI size <integer_cst 0x7fc34ce71dc8 32> unit size <integer_cst
0x7fc34ce71de0 4>
align 32 symtab 0 alias set -1 canonical type 0x7fc34ce89c78>
The root cause lies in gcc/lto/lto-lang.c:lto_init, there is below code
if (TREE_CODE (va_list_type_node) == ARRAY_TYPE)
{
tree x = build_pointer_type (TREE_TYPE (va_list_type_node));
lto_define_builtins (x, x);
}
else
{
lto_define_builtins (va_list_type_node,
build_reference_type (va_list_type_node));
}
While prototype of lto_define_builtins is like below.
static void
lto_define_builtins (tree va_list_ref_type_node ATTRIBUTE_UNUSED,
tree va_list_arg_type_node ATTRIBUTE_UNUSED);
Apparently, the arguments passed to lto_define_builtins are mis-matched. In
fact, I think it should be consistent with function calls to c_define_builtins
in c front-end.
I think above analysis also explains why it happens only with lto.
I will send a patch fixing this soon.
Thanks for the detective work! IMHO this fix is worth backporting
to at least 4.9.

Richard.
amker at gcc dot gnu.org
2014-08-08 10:21:44 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

--- Comment #5 from amker at gcc dot gnu.org ---
Author: amker
Date: Fri Aug 8 10:21:12 2014
New Revision: 213755

URL: https://gcc.gnu.org/viewcvs?rev=213755&root=gcc&view=rev
Log:

PR lto/62032
* lto/lto-lang.c (lto_init): Switch mis-matched arguments.


Modified:
trunk/gcc/lto/ChangeLog
trunk/gcc/lto/lto-lang.c
amker at gcc dot gnu.org
2014-08-15 05:50:29 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

--- Comment #6 from amker at gcc dot gnu.org ---
Author: amker
Date: Fri Aug 15 05:49:56 2014
New Revision: 214000

URL: https://gcc.gnu.org/viewcvs?rev=214000&root=gcc&view=rev
Log:

Backport from mainline
2014-08-08 Bin Cheng <***@arm.com>

PR lto/62032
* lto-lang.c (lto_init): Switch mis-matched arguments.


Modified:
branches/gcc-4_9-branch/gcc/lto/ChangeLog
branches/gcc-4_9-branch/gcc/lto/lto-lang.c
amker at gcc dot gnu.org
2014-08-15 10:35:26 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

amker at gcc dot gnu.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Known to work|4.9.1 |
Known to fail|4.10.0 |

--- Comment #7 from amker at gcc dot gnu.org ---
Should be fixed now.
amker at gcc dot gnu.org
2014-08-20 02:41:13 UTC
Permalink
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62032

amker at gcc dot gnu.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED

--- Comment #8 from amker at gcc dot gnu.org ---
Closing.

Loading...