[Bug c++/50946] New: ICE on armhf with webkitgtk+

[Bug c++/50946] New: ICE on armhf with webkitgtk+

[konstantinos.margaritis at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

             Bug #: 50946
           Summary: ICE on armhf with webkitgtk+
    Classification: Unclassified
           Product: gcc
           Version: 4.6.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: konstantinos.margaritis@linaro.org


Created attachment 25677
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25677
minimal testcase produced using delta tool from
Source/WebCore/bindings/js/SerializedScriptValue.cpp in webkitgtk+

webkitgtk+_1.4.2-2 fails to build from source on Debian armhf due to a gcc ICE:

http://buildd.debian-ports.org/status/fetch.php?pkg=webkitgtk%2B&arch=armhf&ver=1.4.2-2&stamp=1311782209

Compiler originally used was g++ 4.6.1-10 but the same ICE appears with 4.6.2-3
(current Debian/unstable):

...
  CXX    Source/WebCore/bindings/js/libWebCore_la-SerializedScriptValue.lo
In file included from ../Source/JavaScriptCore/wtf/PassRefPtr.h:25:0,
                 from ../Source/JavaScriptCore/wtf/RefPtr.h:28,
                 from ../Source/JavaScriptCore/wtf/HashFunctions.h:24,
                 from ../Source/JavaScriptCore/wtf/HashTraits.h:24,
                 from ../Source/JavaScriptCore/runtime/JSValue.h:31,
                 from
../Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h:29,
                 from ../Source/JavaScriptCore/runtime/JSGlobalData.h:32,
                 from ../Source/JavaScriptCore/interpreter/CallFrame.h:26,
                 from ../Source/JavaScriptCore/runtime/ArgList.h:25,
                 from ../Source/JavaScriptCore/runtime/JSObject.h:26,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/wtf/NullPtr.h:48:1: warning: identifier
'nullptr' will become a keyword in C++0x [-Wc++0x-compat]
In file included from ../Source/JavaScriptCore/runtime/JSObject.h:31:0,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/runtime/JSCell.h: In member function 'void*
JSC::MarkedBlock::allocate()':
../Source/JavaScriptCore/runtime/JSCell.h:380:78: warning: cast from
'char (*)[8]' to 'JSC::JSCell*' increases required alignment of target
type [-Wcast-align]
In file included from ../Source/JavaScriptCore/collector/handles/Handle.h:29:0,
                 from
../Source/JavaScriptCore/collector/handles/HandleHeap.h:30,
                 from ../Source/JavaScriptCore/runtime/Heap.h:25,
                 from ../Source/JavaScriptCore/runtime/JSGlobalData.h:33,
                 from ../Source/JavaScriptCore/interpreter/CallFrame.h:26,
                 from ../Source/JavaScriptCore/runtime/ArgList.h:25,
                 from ../Source/JavaScriptCore/runtime/JSObject.h:26,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::JSGlobalObject]':
../Source/JavaScriptCore/runtime/ScopeChain.h:76:86:   instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::JSGlobalObject*' increases required
alignment of target type [-Wcast-align]
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::ObjectPrototype]':
../Source/JavaScriptCore/runtime/JSGlobalObject.h:185:81:
instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::ObjectPrototype*' increases required
alignment of target type [-Wcast-align]
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::StringPrototype]':
../Source/JavaScriptCore/runtime/JSGlobalObject.h:189:81:
instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::StringPrototype*' increases required
alignment of target type [-Wcast-align]
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::NumberPrototype]':
../Source/JavaScriptCore/runtime/JSGlobalObject.h:190:81:
instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::NumberPrototype*' increases required
alignment of target type [-Wcast-align]
In file included from
../Source/JavaScriptCore/collector/handles/HandleHeap.h:30:0,
                 from ../Source/JavaScriptCore/runtime/Heap.h:25,
                 from ../Source/JavaScriptCore/runtime/JSGlobalData.h:33,
                 from ../Source/JavaScriptCore/interpreter/CallFrame.h:26,
                 from ../Source/JavaScriptCore/runtime/ArgList.h:25,
                 from ../Source/JavaScriptCore/runtime/JSObject.h:26,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/collector/handles/Handle.h: In static member
function 'static T* JSC::HandleTypes<T>::getFromSlot(JSC::HandleSlot)
[with T = WebCore::DOMObject, JSC::HandleTypes<T>::ExternalType =
WebCore::DOMObject*, JSC::HandleSlot = JSC::JSValue*]':
../Source/JavaScriptCore/runtime/WeakGCPtr.h:59:74:   instantiated
from 'JSC::WeakGCPtr<T>::ExternalType JSC::WeakGCPtr<T>::get() const
[with T = WebCore::DOMObject, JSC::WeakGCPtr<T>::ExternalType =
WebCore::DOMObject*]'
../Source/WebCore/bindings/js/ScriptWrappable.h:47:30:   instantiated from here
../Source/JavaScriptCore/collector/handles/Handle.h:94:130: warning:
cast from 'JSC::JSCell*' to
'JSC::HandleTypes<WebCore::DOMObject>::ExternalType {aka
WebCore::DOMObject*}' increases required alignment of target type
[-Wcast-align]
../Source/WebCore/bindings/js/SerializedScriptValue.cpp: In member
function 'void WebCore::CloneSerializer::write(double)':
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:499:5:
internal compiler error: in simplify_gen_subreg_concatn, at
lower-subreg.c:489
Please submit a full bug report,
with preprocessed source if appropriate.
See <file:///usr/share/doc/gcc-4.6/README.Bugs> for instructions.

I used the delta package to produce a minimal testcase for the ICE
which I attach.
You can reproduce the ICE with g++ -O2 -fpermissive -Wfatal-errors -w
webkit_testcase-min.i.

The bug has also been reported to the Debian BTS:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641849

Thanks

Konstantinos

[Bug target/50946] ICE on armhf with webkitgtk+

[rearnsha at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

Richard Earnshaw <rearnsha at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2011-11-01
     Ever Confirmed|0                           |1

--- Comment #1 from Richard Earnshaw <rearnsha at gcc dot gnu.org> 2011-11-01 20:56:25 UTC ---
arm-linux-gnueabihf isn't a configuration supported by FSF GCC; if this is
vendor distribution you need to contact your vendor.  Alternatively you need to
show how to produce this on the FSF sources.

[Bug target/50946] ICE on armhf with webkitgtk+

[konstantinos.margaritis at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

--- Comment #2 from Konstantinos Margaritis <konstantinos.margaritis at linaro dot org> 2011-11-01 21:15:29 UTC ---
This is the actual cmd line used:

g++ -O2 -mfpu=vfpv3 -mfloat-abi=hard -march=armv7-a -mthumb -fpermissive -w -c
webkit_testcase-min.i 

The Debian armhf package is based on SVN 20111028 (r180603) from the
gcc-4_6-branch.

[Bug target/50946] ICE on armhf with webkitgtk+

[mgretton at sourceware dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

Matthew Gretton-Dann <mgretton at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mgretton at sourceware dot
                   |                            |org

--- Comment #3 from Matthew Gretton-Dann <mgretton at sourceware dot org> 2012-01-18 13:57:12 UTC ---
I can reproduce this for GCC 4.6.2 (rev 183061) with an bare-metal target
(arm-none-eabi):c

arm-none-eabi-g++ -O2 -mfpu=vfpv3 -mfloat-abi=hard -march=armv7-a -mthumb
-fpermissive -w -c webkit_testcase-min.i 

Current trunk does not ICE on the test case.

[Bug target/50946] ICE on armhf with webkitgtk+

[mikpe at it dot uu.se]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

Mikael Pettersson <mikpe at it dot uu.se> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mikpe at it dot uu.se

--- Comment #4 from Mikael Pettersson <mikpe at it dot uu.se> 2012-02-19 17:29:00 UTC ---
The ICE stopped on trunk with Richard Sandiford's "Tighten ARM's
CANNOT_CHANGE_MODE_CLASS" patch in r171520:
http://gcc.gnu.org/ml/gcc-patches/2011-03/msg01631.html
http://gcc.gnu.org/ml/gcc-cvs/2011-03/msg00945.html

The patch was described only as improving code quality, not as fixing any
specific bugs, so it's possible the underlying bug is still latent on trunk.

[Bug target/50946] ICE on armhf with webkitgtk+

[doko at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

Matthias Klose <doko at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW
                 CC|                            |doko at gcc dot gnu.org
      Known to work|                            |4.5.3
      Known to fail|                            |4.6.3, 4.7.0

--- Comment #5 from Matthias Klose <doko at gcc dot gnu.org> 2012-02-28 20:07:20 UTC ---
works with 4.5 branch and trunk, still ftbfs with 4.6.

[Bug target/50946] [4.6 Regression] ICE on armhf with webkitgtk+

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.6.4

[Bug target/50946] [4.6 Regression] ICE on armhf with webkitgtk+

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50946

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|4.6.4                       |4.7.0

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-12 16:18:05 UTC ---
The 4.6 branch has been closed, fixed in GCC 4.7.0.