[Bug c++/41354] New: g++: Inlining constructors puts wrong vtable in objects

[Bug c++/41354] New: g++: Inlining constructors puts wrong vtable in objects

[erik at arbat dot com]

The GCC in Ubuntu Karmic for ARM uses the vtable of the superclass when
inlining the constructors of several subclasses in the same function.  This
happens only when using -fno-strict-aliasing.  This can cause the program to
fail with a "pure virtual called" error.  The V8 JavaScript engine is one
program that is vulnerable to this bug.

Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.4.1-3ubuntu3'
--with-bugurl=file:///usr/share/doc/gcc-4.4/README.Bugs
--enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared
--enable-multiarch --enable-linker-build-id --with-system-zlib
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--with-gxx-include-dir=/usr/include/c++/4.4 --program-suffix=-4.4 --enable-nls
--enable-clocale=gnu --enable-libstdcxx-debug --enable-mpfr --enable-objc-gc
--disable-sjlj-exceptions --with-arch=armv6 --with-tune=cortex-a8
--with-float=softfp --with-fpu=vfp --disable-werror --enable-checking=release
--build=arm-linux-gnueabi --host=arm-linux-gnueabi --target=arm-linux-gnueabi
Thread model: posix
gcc version 4.4.1 (Ubuntu 4.4.1-3ubuntu3)


-- 
           Summary: g++: Inlining constructors puts wrong vtable in objects
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: erik at arbat dot com
 GCC build triplet: arm-linux-gnueabi
  GCC host triplet: arm-linux-gnueabi
GCC target triplet: arm-linux-gnueabi


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug c++/41354] g++: Inlining constructors puts wrong vtable in objects

[erik at arbat dot com]

------- Comment #1 from erik at arbat dot com  2009-09-14 09:00 -------
Created an attachment (id=18581)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=18581&action=view)
Test case.

The following file illustrates the bug.  Compiling with
g++ -O1 -fno-strict-aliasing -c codegen.cc
to see the bug.  Compile with
g++ -O1 -fno-strict-aliasing -fno-tree-sink -c codegen.cc
to make the bug go away.  If you disassemble the two versions you can see that
in the buggy version both instances get the same vtable.  In the correct
version the constant pool is one word larger, as the two instances have two
different vtables.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug middle-end/41354] g++: Inlining constructors puts wrong vtable in objects

[mikpe at it dot uu dot se]

------- Comment #2 from mikpe at it dot uu dot se  2009-09-14 15:01 -------
Incomplete test case, compiling w/o -c results in linkage errors:

codegen.cc:(.text+0x1a): undefined reference to `CodeStub::get_code()'
codegen.cc:(.text+0x30): undefined reference to `CodeStub::get_code()'
codegen.cc:(.text+0x4c): undefined reference to `printf(char const*, int, int)'

Please post a self-contained test case that can be linked and executed to
reproduce the "pure virtual called" error.

(Manually inspecting the output of objdump -d is a very inefficient way of
checking for the presence or absence of a bug.)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug middle-end/41354] g++: Inlining constructors puts wrong vtable in objects

[erik at arbat dot com]

------- Comment #3 from erik at arbat dot com  2009-09-15 13:22 -------
Created an attachment (id=18584)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=18584&action=view)
Self-contained program demonstrating the issue.

Correct behaviour is to do nothing.
Incorrect behaviour is to crash with a pure virtual called error.


-- 

erik at arbat dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #18581|0                           |1
        is obsolete|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug middle-end/41354] g++: Inlining constructors puts wrong vtable in objects

[mikpe at it dot uu dot se]

------- Comment #4 from mikpe at it dot uu dot se  2009-09-17 13:23 -------
Confirmed with gcc-4.4.1 and gcc-4.3.4 on armv5tel-unknown-linux-gnueabi.
I've not been able to trigger it with gcc-4.4.1 on i686-linux, powerpc-linux,
or sparc64-solaris, so it looks ARM-specific.

I'll check if there's a fix upstream, or failing that, if I can identify the
commit that introduced the bug.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug middle-end/41354] g++: Inlining constructors puts wrong vtable in objects

[mikpe at it dot uu dot se]

------- Comment #5 from mikpe at it dot uu dot se  2009-09-17 16:18 -------
Appears fixed in gcc-4.5-20090910, but not in gcc-4.4-20090915. I'll start a
binary search to see what fixed it (I have a suspicion already).


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug middle-end/41354] g++: Inlining constructors puts wrong vtable in objects

[pinskia at gcc dot gnu dot org]

------- Comment #6 from pinskia at gcc dot gnu dot org  2009-09-18 03:43 -------
Does -fno-tree-sink fix the issue?  If so this is duplicate of bug 39604.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug middle-end/41354] g++: Inlining constructors puts wrong vtable in objects

[ramana at gcc dot gnu dot org]

------- Comment #7 from ramana at gcc dot gnu dot org  2009-09-18 07:19 -------
(In reply to comment #6)
> Does -fno-tree-sink fix the issue?  If so this is duplicate of bug 39604.
> 

Comment #1 indicates that -fno-tree-sink fixes the issue. 

*** This bug has been marked as a duplicate of 39604 ***


-- 

ramana at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |DUPLICATE


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354

[Bug middle-end/41354] g++: Inlining constructors puts wrong vtable in objects

[mikpe at it dot uu dot se]

------- Comment #8 from mikpe at it dot uu dot se  2009-09-18 11:14 -------
The binary search identified revision 145494, the alias-improvements merge, as
the point where this test case stopped breaking.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41354