GCC 10 is crashing with an internal compiler error when compiling Mesa

[Leonardo Müller]

When trying to compile Mesa git (6493d29f2117d63d7949fc3888c2c5d901eaeb95) with GCC 10 (gcc version 10.0.1 20200411 (experimental) [master revision bb87d5cc77d:75961caccb7:f883c46b4877f637e0fa5025b4d6b5c9040ec566] (Ubuntu 10-20200411-0ubuntu1)
), an internal compiler error is happening:

ninja: Entering directory `build'
[2/5] Compiling C object 'src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o'.
FAILED: src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o
gcc-10 -Isrc/gallium/drivers/softpipe/48c2f4b@@softpipe@sta -Isrc/gallium/drivers/softpipe -I../src/gallium/drivers/softpipe -Isrc/gallium/auxiliary -I../src/gallium/auxiliary -I../src/gallium/include -Iinclude -I../include -Isrc -I../src -fvisibility=hidden -fdiagnostics-color=always -DNDEBUG -pipe -D_FILE_OFFSET_BITS=64 -Wall -Winvalid-pch -std=c99 -O3 -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS '-DPACKAGE_VERSION="20.2.0-devel"' '-DPACKAGE_BUGREPORT="https://gitlab.freedesktop.org/mesa/mesa/-/issues"' -DUSE_ELF_TLS -DENABLE_ST_OMX_BELLAGIO=0 -DENABLE_ST_OMX_TIZONIA=0 -DHAVE_X11_PLATFORM -DGLX_INDIRECT_RENDERING -DGLX_DIRECT_RENDERING -DGLX_USE_DRM -DHAVE_DRM_PLATFORM -DENABLE_SHADER_CACHE -DHAVE___BUILTIN_BSWAP32 -DHAVE___BUILTIN_BSWAP64 -DHAVE___BUILTIN_CLZ -DHAVE___BUILTIN_CLZLL -DHAVE___BUILTIN_CTZ -DHAVE___BUILTIN_EXPECT -DHAVE___BUILTIN_FFS -DHAVE___BUILTIN_FFSLL -DHAVE___BUILTIN_POPCOUNT -DHAVE___BUILTIN_POPCOUNTLL -DHAVE___BUILTIN_UNREACHABLE -DHAVE_FUNC_ATTRIBUTE_CONST -DHAVE_FUNC_ATTRIBUTE_FLATTEN -DHAVE_FUNC_ATTRIBUTE_MALLOC -DHAVE_FUNC_ATTRIBUTE_PURE -DHAVE_FUNC_ATTRIBUTE_UNUSED -DHAVE_FUNC_ATTRIBUTE_WARN_UNUSED_RESULT -DHAVE_FUNC_ATTRIBUTE_WEAK -DHAVE_FUNC_ATTRIBUTE_FORMAT -DHAVE_FUNC_ATTRIBUTE_PACKED -DHAVE_FUNC_ATTRIBUTE_RETURNS_NONNULL -DHAVE_FUNC_ATTRIBUTE_ALIAS -DHAVE_FUNC_ATTRIBUTE_NORETURN -DHAVE_FUNC_ATTRIBUTE_VISIBILITY -DHAVE_UINT128 -D_GNU_SOURCE -DUSE_SSE41 -DUSE_GCC_ATOMIC_BUILTINS -DUSE_X86_64_ASM -DMAJOR_IN_SYSMACROS -DHAVE_LINUX_FUTEX_H -DHAVE_ENDIAN_H -DHAVE_DLFCN_H -DHAVE_EXECINFO_H -DHAVE_SYS_SHM_H -DHAVE_CET_H -DHAVE_STRTOF -DHAVE_MKOSTEMP -DHAVE_TIMESPEC_GET -DHAVE_MEMFD_CREATE -DHAVE_RANDOM_R -DHAVE_FLOCK -DHAVE_STRTOK_R -DHAVE_GETRANDOM -DHAVE_PROGRAM_INVOCATION_NAME -DHAVE_POSIX_MEMALIGN -DHAVE_DIRENT_D_TYPE -DHAVE_STRTOD_L -DHAVE_DLADDR -DHAVE_DL_ITERATE_PHDR -DHAVE_ZLIB -DHAVE_PTHREAD -DHAVE_PTHREAD_SETAFFINITY -DHAVE_LIBDRM -DHAVE_LIBUNWIND -DHAVE_DRI3 -DHAVE_DRI3_MODIFIERS -DHAVE_LIBSENSORS=1 -Werror=implicit-function-declaration -Werror=missing-prototypes -Werror=return-type -Werror=empty-body -Werror=incompatible-pointer-types -Werror=int-conversion -Wimplicit-fallthrough -Wno-missing-field-initializers -Wno-format-truncation -fno-math-errno -fno-trapping-math -fno-common -Werror=format -Wformat-security -fPIC -Werror=pointer-arith -Werror=vla -MD -MQ 'src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o' -MF 'src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o.d' -o 'src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o' -c ../src/gallium/drivers/softpipe/sp_tex_sample.c
during IPA pass: fnsummary
../src/gallium/drivers/softpipe/sp_tex_sample.c: In function ‘sample_compare’:
../src/gallium/drivers/softpipe/sp_tex_sample.c:3862:1: internal compiler error: Segmentation fault
 3862 | }
      | ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <file:///usr/share/doc/gcc-10/README.Bugs> for instructions.
ninja: build stopped: subcommand failed.

The bug was recently fixed on GCC 10 and is present on Ubuntu's GCC 10. The GCC bug report is: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96130

[Manuel-lauss-q (manuel-lauss-q)]

Created attachment 48847
preprocessed unreduced testcase

The testcase, extracted from current mesa, segfaults with -O1 or higher:

# gcc -O1 -c sp_tex_sample.i
during IPA pass: fnsummary
../mesa-9999/src/gallium/drivers/softpipe/sp_tex_sample.c: In function 'sample_compare':
../mesa-9999/src/gallium/drivers/softpipe/sp_tex_sample.c:3862:1: internal compiler error: Segmentation fault
 3862 | }
      | ^
Please submit a full bug report,
with preprocessed source if appropriate.

# gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-pc-linux-gnu/10.1.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /tmp-ram/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/configure --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr --bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/10.1.0 --includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/10.1.0/include --datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.1.0 --mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.1.0/man --infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.1.0/info --with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/10.1.0/include/g++-v10 --with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/10.1.0/python --enable-languages=c,c++ --enable-obsolete --enable-secureplt --disable-werror --with-system-zlib --disable-nls --enable-checking=release --with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo 10.1.0-r1 p2' --disable-esp --enable-libstdcxx-time --with-build-config=bootstrap-lto --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --enable-multilib --with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all --enable-libgomp --disable-libmudflap --disable-libssp --disable-libada --disable-systemtap --disable-vtable-verify --disable-libvtv --without-zstd --disable-libquadmath --enable-lto --with-isl --disable-isl-version-check --disable-libsanitizer --disable-default-pie --disable-default-ssp
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 10.1.0 (Gentoo 10.1.0-r1 p2)

[Marxin-m (marxin-m)]

Confirmed, working on that..

[Marxin-m (marxin-m)]

Reduced test-case:

$ cat pr96130.c
enum {
  PIPE_FUNC_NEVER,
  PIPE_FUNC_LESS,
  PIPE_FUNC_EQUAL,
  PIPE_FUNC_LEQUAL,
  PIPE_FUNC_GREATER,
  PIPE_FUNC_NOTEQUAL,
  PIPE_FUNC_GEQUAL,
  PIPE_FUNC_ALWAYS
} sample_compare_k_0;

int sample_compare_rgba;
struct pipe_sampler_state {
  unsigned compare_func : 3;
};

void
sample_compare(struct pipe_sampler_state *sp_samp) {
  switch (sp_samp->compare_func) {
  case PIPE_FUNC_LESS:
  case PIPE_FUNC_LEQUAL:
  case PIPE_FUNC_GREATER:
  case PIPE_FUNC_GEQUAL:
  case PIPE_FUNC_EQUAL:
  case PIPE_FUNC_NOTEQUAL:
    sample_compare_k_0 != sample_compare_rgba;
  case PIPE_FUNC_ALWAYS:
  case PIPE_FUNC_NEVER:
    break;
  default:
    for (;;)
      ;
  }
}

fails here:

$ gcc pr96130.c -c -O1
during IPA pass: fnsummary
pr96130.c: In function ‘sample_compare’:
pr96130.c:34:1: internal compiler error: Segmentation fault
   34 | }
      | ^
0xdc22ef crash_signal
 /home/marxin/Programming/gcc/gcc/toplev.c:328
0x7ffff78d752f ???
 /usr/src/debug/glibc-2.31-6.1.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0xb938f9 analyze_function_body
 /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:2769
0xb944e3 compute_fn_summary(cgraph_node*, bool)
 /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:2974
0xb94990 inline_analyze_function(cgraph_node*)
 /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:4078
0xb94b73 ipa_fn_summary_generate
 /home/marxin/Programming/gcc/gcc/ipa-fnsummary.c:4121
0xcea35b execute_ipa_summary_passes(ipa_opt_pass_d*)
 /home/marxin/Programming/gcc/gcc/passes.c:2191
0x966a97 ipa_passes
 /home/marxin/Programming/gcc/gcc/cgraphunit.c:2646
0x966a97 symbol_table::compile()
 /home/marxin/Programming/gcc/gcc/cgraphunit.c:2756
0x96885c symbol_table::compile()
 /home/marxin/Programming/gcc/gcc/cgraphunit.c:2736
0x96885c symbol_table::finalize_compilation_unit()
 /home/marxin/Programming/gcc/gcc/cgraphunit.c:3003
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

started with

[Marxin-m (marxin-m)]

Started with r10-3199-g351e7c3b5fbd45bd, leaving to Feng.

[Marxin-m (marxin-m)]

*** Bug 96150 has been marked as a duplicate of this bug. ***

[Jakub-gcc (jakub-gcc)]

Reduced testcase from the other PR which is shorter:
struct S { unsigned j : 3; };
int k, l, m;

void
foo (struct S x)
{
  while (l != 5)
    switch (x.j)
      {
      case 1:
      case 3:
      case 4:
      case 6:
      case 2:
      case 5:
 l = m;
      case 7:
      case 0:
 k = 0;
      default:
 break;
      }
}

[Jakub-gcc (jakub-gcc)]

My understanding of the problem is that set_switch_stmt_execution_predicate figures out that the default: is unreachable (operand is a bitfield with values 0 to 7 and there are cases for all 8) and notes that into the predicate for the switch -> default: edge's aux, and then compute_bb_predicates iterates, but as the 3 -> 9 predicate always resolves to false, nothing adds bb_9->aux. And later we try to dereference that.
So, either predicates in bb->aux are optional and we should treat a missing predicate as false predicate, or compute_bb_predicate should ensure to fill in bb->aux even for bbs it left NULL at the end.
          if (bb->aux)
            bb_predicate = *(predicate *) bb->aux;
          else
            bb_predicate = false;
in analyze_function_body suggests that perhaps the latter is the case.

[Jakub-gcc (jakub-gcc)]

Created attachment 48858
gcc11-pr96130.patch

So, my fix would be like this (untested except on the testcase so far).

[Jakub-gcc (jakub-gcc)]

*** Bug 96165 has been marked as a duplicate of this bug. ***

[Cvs-commit (cvs-commit)]

The master branch has been updated by Jakub Jelinek <email address hidden>:

https://gcc.gnu.org/g:776e48e0931db69f158f40e5cb8e15463d879a42

commit r11-2066-g776e48e0931db69f158f40e5cb8e15463d879a42
Author: Jakub Jelinek <email address hidden>
Date: Mon Jul 13 18:25:53 2020 +0200

    ipa-fnsummary: Fix ICE with switch predicates [PR96130]

    The following testcase ICEs since r10-3199.
    There is a switch with default label, where the controlling expression has
    range just 0..7 and there are case labels for all those 8 values, but
    nothing has yet optimized away the default.
    Since r10-3199, set_switch_stmt_execution_predicate sets the switch to
    default label's edge's predicate to a false predicate and then
    compute_bb_predicates propagates the predicates through the cfg, but false
    predicates aren't really added. The caller of compute_bb_predicates
    in one place handles NULL bb->aux as false predicate:
          if (fbi.info)
            {
              if (bb->aux)
                bb_predicate = *(predicate *) bb->aux;
              else
                bb_predicate = false;
            }
          else
            bb_predicate = true;
    but then in two further spots that the patch below is changing
    it assumes bb->aux must be non-NULL. Those two spots are guarded by a
    condition that is only true if fbi.info is non-NULL, so I think the right
    fix is to treat NULL aux as false predicate in those spots too.

    2020-07-13 Jakub Jelinek <email address hidden>

            PR ipa/96130
            * ipa-fnsummary.c (analyze_function_body): Treat NULL bb->aux
            as false predicate.

            * gcc.dg/torture/pr96130.c: New test.

[Cvs-commit (cvs-commit)]

The releases/gcc-10 branch has been updated by Jakub Jelinek <email address hidden>:

https://gcc.gnu.org/g:0d03c0ee5213703ec6d9ffa632fa5298d83adaaa

commit r10-8472-g0d03c0ee5213703ec6d9ffa632fa5298d83adaaa
Author: Jakub Jelinek <email address hidden>
Date: Mon Jul 13 18:25:53 2020 +0200

    ipa-fnsummary: Fix ICE with switch predicates [PR96130]

    The following testcase ICEs since r10-3199.
    There is a switch with default label, where the controlling expression has
    range just 0..7 and there are case labels for all those 8 values, but
    nothing has yet optimized away the default.
    Since r10-3199, set_switch_stmt_execution_predicate sets the switch to
    default label's edge's predicate to a false predicate and then
    compute_bb_predicates propagates the predicates through the cfg, but false
    predicates aren't really added. The caller of compute_bb_predicates
    in one place handles NULL bb->aux as false predicate:
          if (fbi.info)
            {
              if (bb->aux)
                bb_predicate = *(predicate *) bb->aux;
              else
                bb_predicate = false;
            }
          else
            bb_predicate = true;
    but then in two further spots that the patch below is changing
    it assumes bb->aux must be non-NULL. Those two spots are guarded by a
    condition that is only true if fbi.info is non-NULL, so I think the right
    fix is to treat NULL aux as false predicate in those spots too.

    2020-07-13 Jakub Jelinek <email address hidden>

            PR ipa/96130
            * ipa-fnsummary.c (analyze_function_body): Treat NULL bb->aux
            as false predicate.

            * gcc.dg/torture/pr96130.c: New test.

    (cherry picked from commit 776e48e0931db69f158f40e5cb8e15463d879a42)

[Jakub-gcc (jakub-gcc)]

Fixed for 10.2 and 11.1.

[Matthias Klose (doko)]

fixed in 10.2.0