[Bug ipa/114274] New: ICE: tree check: expected block, have ggc_freed in inlining_chain_to_json, at optinfo-emit-json.cc:284 with -fsave-optimization-record

[Bug ipa/114274] New: ICE: tree check: expected block, have ggc_freed in inlining_chain_to_json, at optinfo-emit-json.cc:284 with -fsave-optimization-record

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114274

            Bug ID: 114274
           Summary: ICE: tree check: expected block, have ggc_freed in
                    inlining_chain_to_json, at optinfo-emit-json.cc:284
                    with -fsave-optimization-record
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 57649
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57649&action=edit
partially reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc --param=max-jump-thread-duplication-stmts=0
-fprofile-generate -O2 -fsave-optimization-record aco_ir.cpp.ii -wrapper
valgrind,-q
aco_ir.cpp.ii:50:66: warning: 'alloc_size' attribute ignored on a function
returning 'void' [-Wattributes]
   50 |               void malloc ()  __attribute__ ((__alloc_size__ (1))) ;
      |                                                                  ^
...
aco_ir.cpp.ii: At global scope:
aco_ir.cpp.ii:1257:49: warning: 'always_inline' function might not be inlinable
unless also declared 'inline' [-Wattributes]
 1257 |             __attribute__((always_inline)) bool get_cmp_info(aco_opcode
op, CmpInfo* info) {
      |                                                 ^~~~~~~~~~~~
==30423== Invalid read of size 2
==30423==    at 0x16AB1A0: tree_check (tree.h:3611)
==30423==    by 0x16AB1A0:
optrecord_json_writer::inlining_chain_to_json(unsigned int)
(optinfo-emit-json.cc:284)
==30423==    by 0x16ABF4A: optrecord_json_writer::optinfo_to_json(optinfo
const*) (optinfo-emit-json.cc:419)
==30423==    by 0x16ABF98: optrecord_json_writer::add_record(optinfo const*)
(optinfo-emit-json.cc:141)
==30423==    by 0x1318F06: emit_optinfo (dumpfile.cc:1223)
==30423==    by 0x1318F06: end_any_optinfo (dumpfile.cc:1209)
==30423==    by 0x1318F06: dump_loc (dumpfile.cc:601)
==30423==    by 0x1318F06: dump_printf_loc_va (dumpfile.cc:1028)
==30423==    by 0x1318F06: dump_printf_loc(dump_metadata_t const&,
dump_user_location_t const&, char const*, ...) (dumpfile.cc:1359)
==30423==    by 0x2B483D4: ipa_icf::sem_item_optimizer::merge_classes(unsigned
int, unsigned int) (ipa-icf.cc:3423)
==30423==    by 0x2B501F4: ipa_icf::sem_item_optimizer::execute()
(ipa-icf.cc:2484)
==30423==    by 0x2B53726: ipa_icf_driver (ipa-icf.cc:3612)
==30423==    by 0x2B53726: ipa_icf::pass_ipa_icf::execute(function*)
(ipa-icf.cc:3659)
==30423==    by 0x16DBC27: execute_one_pass(opt_pass*) (passes.cc:2646)
==30423==    by 0x16DCF96: execute_ipa_pass_list(opt_pass*) (passes.cc:3095)
==30423==    by 0x12D7DB0: ipa_passes (cgraphunit.cc:2272)
==30423==    by 0x12D7DB0: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2335)
==30423==    by 0x12DAB57: compile (cgraphunit.cc:2315)
==30423==    by 0x12DAB57: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2587)
==30423==    by 0x181C671: compile_file() (toplev.cc:476)
==30423==  Address 0x5d5bde0 is in a rw- anonymous segment
==30423== 
==30423== Invalid read of size 2
==30423==    at 0x96F1A7: tree_check_failed(tree_node const*, char const*, int,
char const*, ...) (tree.cc:8955)
==30423==    by 0x8BF5B1: tree_check (tree.h:3612)
==30423==    by 0x8BF5B1:
optrecord_json_writer::inlining_chain_to_json(unsigned int) [clone .cold]
(optinfo-emit-json.cc:284)
==30423==    by 0x16ABF4A: optrecord_json_writer::optinfo_to_json(optinfo
const*) (optinfo-emit-json.cc:419)
==30423==    by 0x16ABF98: optrecord_json_writer::add_record(optinfo const*)
(optinfo-emit-json.cc:141)
==30423==    by 0x1318F06: emit_optinfo (dumpfile.cc:1223)
==30423==    by 0x1318F06: end_any_optinfo (dumpfile.cc:1209)
==30423==    by 0x1318F06: dump_loc (dumpfile.cc:601)
==30423==    by 0x1318F06: dump_printf_loc_va (dumpfile.cc:1028)
==30423==    by 0x1318F06: dump_printf_loc(dump_metadata_t const&,
dump_user_location_t const&, char const*, ...) (dumpfile.cc:1359)
==30423==    by 0x2B483D4: ipa_icf::sem_item_optimizer::merge_classes(unsigned
int, unsigned int) (ipa-icf.cc:3423)
==30423==    by 0x2B501F4: ipa_icf::sem_item_optimizer::execute()
(ipa-icf.cc:2484)
==30423==    by 0x2B53726: ipa_icf_driver (ipa-icf.cc:3612)
==30423==    by 0x2B53726: ipa_icf::pass_ipa_icf::execute(function*)
(ipa-icf.cc:3659)
==30423==    by 0x16DBC27: execute_one_pass(opt_pass*) (passes.cc:2646)
==30423==    by 0x16DCF96: execute_ipa_pass_list(opt_pass*) (passes.cc:3095)
==30423==    by 0x12D7DB0: ipa_passes (cgraphunit.cc:2272)
==30423==    by 0x12D7DB0: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2335)
==30423==    by 0x12DAB57: compile (cgraphunit.cc:2315)
==30423==    by 0x12DAB57: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2587)
==30423==  Address 0x5d5bde0 is in a rw- anonymous segment
==30423== 
during IPA pass: icf
aco_ir.cpp.ii:1335:13: internal compiler error: tree check: expected block,
have ggc_freed in inlining_chain_to_json, at optinfo-emit-json.cc:284
 1335 |             }
      |             ^
0x96f1eb tree_check_failed(tree_node const*, char const*, int, char const*,
...)
        /repo/gcc-trunk/gcc/tree.cc:8955
0x8bf5b1 tree_check(tree_node*, char const*, int, char const*, tree_code)
        /repo/gcc-trunk/gcc/tree.h:3612
0x8bf5b1 optrecord_json_writer::inlining_chain_to_json(unsigned int)
        /repo/gcc-trunk/gcc/optinfo-emit-json.cc:284
0x16abf4a optrecord_json_writer::optinfo_to_json(optinfo const*)
        /repo/gcc-trunk/gcc/optinfo-emit-json.cc:419
0x16abf98 optrecord_json_writer::add_record(optinfo const*)
        /repo/gcc-trunk/gcc/optinfo-emit-json.cc:141
0x1318f06 dump_context::emit_optinfo(optinfo const*)
        /repo/gcc-trunk/gcc/dumpfile.cc:1223
0x1318f06 dump_context::end_any_optinfo()
        /repo/gcc-trunk/gcc/dumpfile.cc:1209
0x1318f06 dump_context::dump_loc(dump_metadata_t const&, dump_user_location_t
const&)
        /repo/gcc-trunk/gcc/dumpfile.cc:601
0x1318f06 dump_context::dump_printf_loc_va(dump_metadata_t const&,
dump_user_location_t const&, char const*, __va_list_tag (*) [1])
        /repo/gcc-trunk/gcc/dumpfile.cc:1028
0x1318f06 dump_printf_loc(dump_metadata_t const&, dump_user_location_t const&,
char const*, ...)
        /repo/gcc-trunk/gcc/dumpfile.cc:1359
0x2b483d4 ipa_icf::sem_item_optimizer::merge_classes(unsigned int, unsigned
int)
        /repo/gcc-trunk/gcc/ipa-icf.cc:3423
0x2b501f4 ipa_icf::sem_item_optimizer::execute()
        /repo/gcc-trunk/gcc/ipa-icf.cc:2484
0x2b53726 ipa_icf_driver
        /repo/gcc-trunk/gcc/ipa-icf.cc:3612
0x2b53726 ipa_icf::pass_ipa_icf::execute(function*)
        /repo/gcc-trunk/gcc/ipa-icf.cc:3659
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


I cannot reduce the testcase any more by cvise, as it fails to validate the
initial input.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-9346-20240306205443-g74e8cc28eda-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --enable-libsanitizer
--disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-9346-20240306205443-g74e8cc28eda-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240306 (experimental) (GCC)

[Bug ipa/114274] ICE: tree check: expected block, have ggc_freed in inlining_chain_to_json, at optinfo-emit-json.cc:284 with -fsave-optimization-record

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114274

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |GC

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Most likely will reduce more if you use `--param=ggc-min-expand=1
--param=ggc-min-heapsize=1` since this looks like a GC issue.

[Bug ipa/114274] ICE: tree check: expected block, have ggc_freed in inlining_chain_to_json, at optinfo-emit-json.cc:284 with -fsave-optimization-record

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114274

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 57650
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57650&action=edit
reduced testcase

Flags used for building:
```
--param=max-jump-thread-duplication-stmts=0 -fprofile-generate -O2
-fsave-optimization-record -w --param=ggc-min-expand=1
--param=ggc-min-heapsize=1 -Wfatal-errors 
```

[Bug ipa/114274] ICE: tree check: expected block, have ggc_freed in inlining_chain_to_json, at optinfo-emit-json.cc:284 with -fsave-optimization-record

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114274

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2024-03-07

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. I have not checked why there is a GC issue though.

[Bug ipa/114274] ICE: tree check: expected block, have ggc_freed in inlining_chain_to_json, at optinfo-emit-json.cc:284 with -fsave-optimization-record

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114274

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
                 CC|                            |law at gcc dot gnu.org