Opened 4 years ago

Closed 4 years ago

#10538 closed bug (fixed)

Simpilifier produces empty case in core, segfaults at runtime.

Reported by: sopvop Owned by: bgamari
Priority: highest Milestone: 7.10.2
Component: Compiler Version: 7.10.2-rc1
Keywords: Cc:
Operating System: Unknown/Multiple Architecture: Unknown/Multiple
Type of failure: Runtime crash Test Case:
Blocked By: Blocking:
Related Tickets: Differential Rev(s):
Wiki Page:


In attachment is a cabal project which builds program producing segfault. Bug is affected by inlining, so test had to be split into modules. Otherwise bug did not occur, and NOINLINE pragmas didn't seem to help.

Can probably be simplified much more, right now it requires some basic packages.

Inspecting the core I've found that code for r in main ends with empty case, but should end with match on Either constructors with show.

It fails on 7.10.1 and 7.10.2-rc1. Works on 7.8.3.

It seems to be affected by inlining. For example inlining validateJson from Validator/Aeson.hs helps.

Is also seems to be affected by specializing functions in Main.hs to Indentity monad.

For convenience I've also put test case to will init sandbox, install deps, build executable and run it.

Attachments (2)

failidalidator- (2.5 KB) - added by sopvop 4 years ago.
Cabal project with test
Main.hs (1.5 KB) - added by int-e 4 years ago.

Download all attachments as: .zip

Change History (9)

Changed 4 years ago by sopvop

Cabal project with test

comment:1 Changed 4 years ago by bgamari

Milestone: 7.10.2
Owner: set to bgamari
Priority: normalhigh
Type of failure: None/UnknownRuntime crash

Oh dear. This does look like quite a bad regression. Indeed I can reproduce it here. I'll dig in a bit tonight.

I'm going to milestone this for 7.10.2 as it's a crash in pure code which worked in 7.8.

Changed 4 years ago by int-e

Attachment: Main.hs added

comment:2 Changed 4 years ago by int-e

Sorry, I meant to add a description to that file: It reproduces the same bug with a bit less code and a single file (note the strategically placed NOINLINE). Interestingly, the Applicative constraint on reqField is essential.

I've looked a bit at the resulting traces, but I'm not sure what to look for. Here are two excerpts that I found interesting: looks like an inlining step going horribly wrong, and shows how the odd duplicated a1_X9lA is introduced.

comment:3 Changed 4 years ago by simonpj

Ah! I have nailed this. Patch coming.

comment:4 Changed 4 years ago by bgamari

This is very good news as the Rackspace machine that I was using to bisect this just inexplicably vanished, along with my bisection state. Thanks Simon!

comment:5 Changed 4 years ago by Simon Peyton Jones <simonpj@…>

In 023a0ba938b69bbb89cb2ce48a07459b07783391/ghc:

Care with impossible-cons in combineIdenticalAlts

This was a nasty, long-standing bug exposed in Trac #10538.
Symptoms were that we had an empty case
   case (x :: Either a) of {}
Core Lint correctly picked this bogus code up.

Here is what happened

* In SimplUtils.prepareAlts, we call

* We had    case x of { Left _ -> e1; Right _ -> e1 }

* filterAlts did nothing, but correctly retuned imposs_deflt_cons
  saying that 'x' cannot be {Left, Right} in the DEFAULT branch,
  if any (there isn't one.)

* combineIdentialAlts correctly combines the identical alts, to give
     case x of { DEFAULT -> e1 }

* BUT combineIdenticalAlts did no adjust imposs_deft_cons

* Result: when compiling e1 we did so in the belief that 'x'
  could not be {Left,Right}.  Disaster.

Easily fixed.

(It is hard to trigger; I can't construct a simple test case.)

comment:6 Changed 4 years ago by simonpj

Priority: highhighest
Status: newmerge

Let's merge this to 7.10.2 if possible. It is a hard error.


comment:7 Changed 4 years ago by thoughtpolice

Resolution: fixed
Status: mergeclosed

Merged to ghc-7.10.

Note: See TracTickets for help on using tickets.