[Bug middle-end/51929] New: ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone --param ipa-cp-eval-threshold=0 --param max-inline-insns-single=1

[Bug middle-end/51929] New: ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone --param ipa-cp-eval-threshold=0 --param max-inline-insns-single=1

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

             Bug #: 51929
           Summary: ICE: verify_cgraph_node failed with -O2
                    -fno-guess-branch-probability -fipa-cp-clone --param
                    ipa-cp-eval-threshold=0 --param
                    max-inline-insns-single=1
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 26401
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26401
reduced testcase

Compiler output:
$ g++ -O2 -fno-guess-branch-probability -fipa-cp-clone --param
ipa-cp-eval-threshold=0 --param max-inline-insns-single=1 testcase.C
testcase.C:35:19: error: edge points to wrong declaration:
 <function_decl 0x7f2b78da9400 _ZN12basic_stringIvED2Ev.constprop.4
    type <function_type 0x7f2b78da4f18
        type <void_type 0x7f2b78c1ebd0 void type_6 VOID
            align 8 symtab 0 alias set -1 canonical type 0x7f2b78c1ebd0
            pointer_to_this <pointer_type 0x7f2b78c1ec78>>
        QI
        size <integer_cst 0x7f2b78c21120 constant 8>
        unit size <integer_cst 0x7f2b78c21140 constant 1>
        align 8 symtab 0 alias set -1 canonical type 0x7f2b78da4f18
        arg-types <tree_list 0x7f2b78c109d8 value <void_type 0x7f2b78c1ebd0
void>>>
    static autoinline decl_5 QI file testcase.C line 8 col 3 align 16 context
<record_type 0x7f2b78d73dc8 basic_string> initial <block 0x7f2b78da66e0>
abstract_origin <function_decl 0x7f2b78d83300 basic_string>
    result <result_decl 0x7f2b78d9a400 D.2358 type <void_type 0x7f2b78c1ebd0
void>
        used ignored VOID file testcase.C line 11 col 3
        align 8 context <function_decl 0x7f2b78da9400
_ZN12basic_stringIvED2Ev.constprop.4> abstract_origin <result_decl
0x7f2b78d84880 D.2292>>
    full-name "basic_string< <template-parameter-1-1> >::~basic_string() [with
<template-parameter-1-1> = void]"
    pending-inline-info 0x7f2b78d85a50 template-info 0x7f2b78d7e9c0
    struct-function 0x7f2b78da3b40>
 Instead of: <function_decl 0x7f2b78d83400 __comp_dtor 
    type <method_type 0x7f2b78d892a0
        type <void_type 0x7f2b78c1ebd0 void type_6 VOID
            align 8 symtab 0 alias set -1 canonical type 0x7f2b78c1ebd0
            pointer_to_this <pointer_type 0x7f2b78c1ec78>>
        QI
        size <integer_cst 0x7f2b78c21120 constant 8>
        unit size <integer_cst 0x7f2b78c21140 constant 1>
        align 8 symtab 0 alias set -1 canonical type 0x7f2b78d892a0 method
basetype <record_type 0x7f2b78d73dc8 basic_string>
        arg-types <tree_list 0x7f2b78d7ffc8 value <pointer_type 0x7f2b78d890a8>
            chain <tree_list 0x7f2b78c109d8 value <void_type 0x7f2b78c1ebd0
void>>>
        pointer_to_this <pointer_type 0x7f2b78d89e70>>
    addressable used public static external autoinline decl_5 QI defer-output
file testcase.C line 8 col 3 align 16 context <record_type 0x7f2b78d73dc8
basic_string> initial <block 0x7f2b78d88640> abstract_origin <function_decl
0x7f2b78d83300 basic_string>
    arguments <parm_decl 0x7f2b78c0e908 this
        type <pointer_type 0x7f2b78d891f8 type <record_type 0x7f2b78d73dc8
basic_string>
            readonly unsigned DI
            size <integer_cst 0x7f2b78c05f60 constant 64>
            unit size <integer_cst 0x7f2b78c05f80 constant 8>
            align 64 symtab 0 alias set -1 canonical type 0x7f2b78d891f8>
        readonly used unsigned DI file testcase.C line 8 col 18 size
<integer_cst 0x7f2b78c05f60 64> unit size <integer_cst 0x7f2b78c05f80 8>
        align 64 context <function_decl 0x7f2b78d83400 __comp_dtor >
abstract_origin <parm_decl 0x7f2b78c0e7f8 this> arg-type <pointer_type
0x7f2b78d891f8>>
    result <result_decl 0x7f2b78d84a00 D.2295 type <void_type 0x7f2b78c1ebd0
void>
        ignored VOID file testcase.C line 11 col 3
        align 8 context <function_decl 0x7f2b78d83400 __comp_dtor >>
    full-name "basic_string< <template-parameter-1-1> >::~basic_string() [with
<template-parameter-1-1> = void]"
    pending-inline-info 0x7f2b78d85b40 template-info 0x7f2b78d7e9c0
    struct-function 0x7f2b78c11960>
basic_stringbuf::basic_stringbuf()/9 @0x7f2b78d8f240 (asm:
_ZN15basic_stringbufC2Ev.constprop.3) (inline copy in (static initializers for
testcase.C)/16) availability:local analyzed reachable body local finalized
  called by: stringstream::stringstream()/3 (1.00 per call) (inlined) (can
throw external) 
  calls: void basic_stringbuf::_M_stringbuf_init()/20 (1.00 per call) (can
throw external) basic_string< <template-parameter-1-1> >::~basic_string() [with
<template-parameter-1-1> = void]/12 (1.00 per call) (can throw external) 
  References:  var:stringstream ss_01 (addr) var:stringstream ss_01 (addr)
fn:<built-in>/19 (addr)
  Refering this function: 
testcase.C:35:19: internal compiler error: verify_cgraph_node failed
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

(gdb) bt
#0  0x00007ffff61e4790 in exit () from /lib64/libc.so.6
#1  0x0000000001350802 in diagnostic_action_after_output (context=0x1b01ea0,
diagnostic=Unhandled dwarf expression opcode 0xfa
) at /mnt/svn/gcc-trunk/gcc/diagnostic.c:243
#2  0x000000000135096e in diagnostic_report_diagnostic (context=0x1b01ea0,
diagnostic=0x7fffffffd3b0) at /mnt/svn/gcc-trunk/gcc/diagnostic.c:552
#3  0x0000000001351620 in internal_error (gmsgid=<optimized out>) at
/mnt/svn/gcc-trunk/gcc/diagnostic.c:845
#4  0x000000000084027c in verify_cgraph_node (node=0x7ffff5c16240) at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:795
#5  0x0000000000840ad8 in verify_cgraph () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:810
#6  verify_cgraph () at /mnt/svn/gcc-trunk/gcc/cgraphunit.c:802
#7  0x000000000084299e in cgraph_materialize_all_clones () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:2607
#8  0x0000000000842b08 in cgraph_optimize () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:2181
#9  0x000000000084374a in cgraph_finalize_compilation_unit () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1327
#10 0x000000000066199b in cp_write_global_declarations () at
/mnt/svn/gcc-trunk/gcc/cp/decl2.c:4051
#11 0x0000000000b8109c in compile_file () at
/mnt/svn/gcc-trunk/gcc/toplev.c:573
#12 do_compile () at /mnt/svn/gcc-trunk/gcc/toplev.c:1938
#13 toplev_main (argc=20, argv=0x7fffffffd778) at
/mnt/svn/gcc-trunk/gcc/toplev.c:2014
#14 0x00007ffff61cc09d in __libc_start_main () from /lib64/libc.so.6
#15 0x0000000000585bb1 in _start ()

Tested revisions:
r183351 - crash
4.6 - invalid parameter 'ipa-cp-eval-threshold'

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

--- Comment #1 from Zdenek Sojka <zsojka at seznam dot cz> 2012-02-05 15:15:07 UTC ---
Created attachment 26575
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26575
autoreduced testcase

Probably the same problem.

$ gcc -O -fno-guess-branch-probability -fipa-cp -fipa-cp-clone
--param=max-inline-insns-single=25 testcase-min4.ii 
testcase-min4.ii:142:1: error: edge points to wrong declaration:
...
  References:  var:std::string str_01 (addr) fn:<built-in>/16 (addr)
  Refering this function: 
testcase-min4.ii:142:1: internal compiler error: verify_cgraph_node failed
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Tested revisions:
r183883 - crash
4.6 r180325 - OK

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org
   Target Milestone|---                         |4.7.0

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-checking
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-02-07
     Ever Confirmed|0                           |1

--- Comment #2 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-02-07 15:40:21 UTC ---
Confirmed.

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-09 16:51:25 UTC ---
The first testcase IMNSHO isn't a regression, because it ICEs since the
ipa-cp-eval-threshold param has been added.  The other testcase is a
regression, started ICEing with the same commit:
http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=176424

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

--- Comment #4 from Zdenek Sojka <zsojka at seznam dot cz> 2012-02-09 16:55:28 UTC ---
Yes, I marked this PR as a regression after adding the second testcase, along
with modifying the summary.
The way it behaves in 4.6 is described in the "Tested revisions" paragraph, but
yes, I should have been more clear, sorry.

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-09 18:43:01 UTC ---
Reduced testcase:

// { dg-do compile }
// { dg-options "-O -fno-guess-branch-probability -fipa-cp -fipa-cp-clone
--param=max-inline-insns-single=25" }

struct A
{
  A (A, unsigned);
  A (const char *);
  ~A () { a1 (a4 ()); }
  void a1 (int);
  unsigned a2 ();
  char *a3 ();
  int a4 ();
};

template <typename T>
struct B
{
  A b;
  B (A x, int y = 1) : b (x.a3 (), x.a2 ()) { if (y & 1) b.a2 (); }
};

extern template struct B <char>;
A a1 ("foo"), a2 ("bar");
B<char> b1 (a1), b2 (a2, 8);

void
foo ()
{
  A a3 ("baz");
  B<char> b3 (a1), b4 (a3);
}

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-10 10:33:33 UTC ---
This is related to same body aliases.  The verification fails because IPA-CP
decides to cgraph_redirect_edge_callee a call_stmt that calls a same_body_alias
of B<char>::B(A, int) (__comp_ctor) to a clone of not that node (i.e. not the
same_body_alias), but of its ->thunk.alias (i.e. the alias with the actual body
of the ctor, __base_ctor).  I don't find anything wrong on that, so I've tried
to adjust just the verification:
-         function.  This ping-pong has to go, eventaully.  */
+         function.  This ping-pong has to go, eventually.  */
       && (node != cgraph_function_or_thunk_node (e->callee, NULL))
-      && !clone_of_p (node, e->callee))
+      && !clone_of_p (node, e->callee)
+      /* If decl is a same body alias of some other decl, allow e->callee to
be
+         a clone of a clone of that other decl too.  */
+      && (!node->same_body_alias
+          || !clone_of_p (cgraph_get_node (node->thunk.alias), e->callee)))

but unfortunately it just cures one of the two error: edge points to wrong
declaration: errors.

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-10 11:27:39 UTC ---
What happens is that cgraph_materialize_clone on the _ZN1BIcEC2E1Ai.constprop.1
clone performs:
2451  if (!node->clone_of->analyzed && !node->clone_of->clones)
2452    {
2453      cgraph_release_function_body (node->clone_of);
2454      cgraph_node_remove_callees (node->clone_of);
2455      ipa_remove_all_references (&node->clone_of->ref_list);
2456    }
2457  node->clone_of = NULL;
where node->clone_of is _ZN1BIcEC2E1Ai, i.e. the __base_ctor and so the
verification fails.
Even before this cgraph_remove_unreachable_nodes marks the _ZN1BIcEC1E1Ai (i.e.
__comp_ctor to which the call_stmts still refer) as unreachable and calls
ipa_remove_all_references on it, which means I don't see a way how we could get
from the _ZN1BIcEC2E1Ai to _ZN1BIcEC1E1Ai node anymore.

Honza?

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |jakub at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-10 11:49:18 UTC ---
Created attachment 26638
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26638
gcc47-pr51929.patch

Actually, it is handled afterwards using the former_clone_of check.
If that one is adjusted too, this compiles fine.  Does this look correct?

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> 2012-02-10 12:31:24 UTC ---
Yes, it looks OK to me.  Thanks!
Perhaps we will eventually need to give up on this sanity check as the
transformations we do to callgraph gets more general...

Honza

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-16 07:27:28 UTC ---
Fixed.

[Bug middle-end/51929] [4.7 Regression] ICE: verify_cgraph_node failed with -O2 -fno-guess-branch-probability -fipa-cp-clone

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51929

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-02-16 07:26:08 UTC ---
Author: jakub
Date: Thu Feb 16 07:25:58 2012
New Revision: 184301

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=184301
Log:
    PR middle-end/51929
    * cgraphunit.c (verify_edge_corresponds_to_fndecl): If node is
    a same_body_alias, also test whether e->callee isn't a former
    or current clone of the decl this is a same body alias of.

    * g++.dg/ipa/pr51929.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/ipa/pr51929.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/cgraphunit.c
    trunk/gcc/testsuite/ChangeLog