[Bug tree-optimization/52037] New: [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[Bug tree-optimization/52037] New: [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

             Bug #: 52037
           Summary: [4.7 regression] ICE in update_ssa, at
                    tree-into-ssa.c:3362 while linking LTO libxul
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: markus@trippelsdorf.de


ICE happens during final libxul link in a Firefox LTO build.

 % g++ @testcase -flto=4 -O3
In file included from :2560:0:
/var/tmp/mozilla-central/content/base/src/nsAttrValue.cpp: In member function
‘Equals’:
/var/tmp/mozilla-central/content/base/src/nsAttrValue.cpp:689:1: internal
compiler error: in update_ssa, at tree-into-ssa.c:3362
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

I managed to reduce it from 2770 input files to 17 (but no further) with delta.

 % cat testcase
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/nsUnicharUtils.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../netwerk/dns/nsIDNService.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../netwerk/streamconv/converters/nsMultiMixedConv.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/mozSanitizingSerializer.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsAttrValue.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsContentUtils.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsDocument.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsDocumentEncoder.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsDocumentFragment.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsGenConImageContent.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsGenericElement.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsHTMLContentSerializer.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../content/base/src/nsImageLoadingContent.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../xpcom/build/nsCOMPtr.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../xpcom/string/src/nsReadableUtils.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../xpcom/string/src/nsSubstring.o
/var/tmp/mozilla-central/moz-build-dir/toolkit/library/../../xpcom/string/src/nsStringComparator.o

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #2 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-01-29 11:32:59 UTC ---
I've uploaded the slim-lto files here:
http://trippelsdorf.de/testcase.tar.bz2
To reproduce just run:
 % g++ @testcase -flto=4 -O3

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #1 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-01-29 11:14:19 UTC ---
-flto-partition=none is fine and every optimization level !=-O3, too.

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #3 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-01-29 13:17:12 UTC ---
-O2 -finline-functions -fipa-cp-clone -flto=4
or
-O1 -findirect-inlining -fipa-cp -finline-small-functions -finline-functions
-fipa-cp-clone -flto=4
also fails.

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #4 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-01-29 13:56:10 UTC ---
Created attachment 26500
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26500
lto testcase

 % /usr/libexec/gcc/x86_64-pc-linux-gnu/4.7.0/lto1 -quiet -O1 -fltrans test.o
In file included from :2205:0:
/var/tmp/mozilla-central/content/base/src/nsAttrValue.cpp: In member function
‘Equals’:
/var/tmp/mozilla-central/content/base/src/nsAttrValue.cpp:689:1: internal
compiler error: in update_ssa, at tree-into-ssa.c:3362
Please submit a full bug report,
with preprocessed source if appropriate.

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #5 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-01-29 18:25:14 UTC ---
Started with:

a844747e95c56ae5a8a46158b9839fbeb3678a34 is the first bad commit
commit a844747e95c56ae5a8a46158b9839fbeb3678a34
Author: hubicka <hubicka@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Sat Jan 7 23:35:08 2012 +0000

        PR tree-optimization/51680
        * ipa-inline.c (want_inline_small_function_p): Be more lax on functions
        whose inlining reduce unit size.


    git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@182983
138bc75d-0d04-0410-961f-82ee72b054a4

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #6 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-01-29 19:41:40 UTC ---
Actually, I've used a slightly different testcase (a random shuffle of the
contents of the @testcase input file) for the bisection and unfortunately the
original testcase still fails even with rev182983 reverted. But maybe the
commit
points in the right direction?

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2012-01-30
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |
   Target Milestone|---                         |4.7.0
     Ever Confirmed|0                           |1

--- Comment #7 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-01-30 09:28:51 UTC ---
I will have a look.

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #8 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-01-30 12:12:31 UTC ---
Both TODO_update_ssa and TODO_update_ssa_only_virtuals are set.  The assert
happens after IPA inline-transform.  Probably happens because

  if (!(todo & TODO_update_ssa_any))
    /* Redirecting edges might lead to a need for vops to be recomputed.  */
    todo |= TODO_update_ssa_only_virtuals;

  cfun->always_inline_functions_inlined = true;
  cfun->after_inlining = true;
  return todo | execute_fixup_cfg ();

does not account for the fact execute_fixup_cfg might return TODO_update_ssa
which is really not necessary:

          if (decl)
            {
              int flags = gimple_call_flags (stmt);
              if (flags & (ECF_CONST | ECF_PURE | ECF_LOOPING_CONST_OR_PURE))
                {
                  if (gimple_purge_dead_abnormal_call_edges (bb))
                    todo |= TODO_cleanup_cfg;

                  if (gimple_in_ssa_p (cfun))
                    {
                      todo |= TODO_update_ssa | TODO_cleanup_cfg;
                      update_stmt (stmt);
                    }

only virtuals may need updating here.

Less dangerous (considering other callers) might be to simply adjust
the code in inline-transform.

"Obvious" patch for this:

Index: gcc/ipa-inline-transform.c
===================================================================
--- gcc/ipa-inline-transform.c  (revision 183695)
+++ gcc/ipa-inline-transform.c  (working copy)
@@ -369,11 +369,13 @@ inline_transform (struct cgraph_node *no
     todo = optimize_inline_calls (current_function_decl);
   timevar_pop (TV_INTEGRATION);

+  cfun->always_inline_functions_inlined = true;
+  cfun->after_inlining = true;
+  todo |= execute_fixup_cfg ();
+
   if (!(todo & TODO_update_ssa_any))
     /* Redirecting edges might lead to a need for vops to be recomputed.  */
     todo |= TODO_update_ssa_only_virtuals;

-  cfun->always_inline_functions_inlined = true;
-  cfun->after_inlining = true;
-  return todo | execute_fixup_cfg ();
+  return todo;
 }

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[hubicka at ucw dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #9 from Jan Hubicka <hubicka at ucw dot cz> 2012-01-30 13:28:08 UTC ---
> only virtuals may need updating here.
> 
> Less dangerous (considering other callers) might be to simply adjust
> the code in inline-transform.
> 
> "Obvious" patch for this:
> 

Hmm, seems to make sense to me.  Thanks for looking into this!
Honza

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #10 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-01-30 13:42:09 UTC ---
Fixed.

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #11 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-01-30 14:20:15 UTC ---
(In reply to comment #9)
> > only virtuals may need updating here.
> > 
> > Less dangerous (considering other callers) might be to simply adjust
> > the code in inline-transform.
> > 
> > "Obvious" patch for this:
> > 
> 
> Hmm, seems to make sense to me.  Thanks for looking into this!
> Honza

Honza,

BTW I've been using the following patch since August last year:

diff --git a/gcc/ipa-inline-transform.c b/gcc/ipa-inline-transform.c
index 75b8e9d..530fca3 100644
--- a/gcc/ipa-inline-transform.c
+++ b/gcc/ipa-inline-transform.c
@@ -123,6 +123,7 @@ can_remove_node_now_p (struct cgraph_node *node, struct
cgraph_edge *e)
     if ((next->callers && next->callers != e)
        || !can_remove_node_now_p_1 (next))
       return false;
+  gcc_unreachable ();
   return true;
 }

And it never triggered since then...

[Bug tree-optimization/52037] [4.7 regression] ICE in update_ssa, at tree-into-ssa.c:3362 while linking LTO libxul

[hubicka at ucw dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52037

--- Comment #12 from Jan Hubicka <hubicka at ucw dot cz> 2012-01-31 13:34:13 UTC ---
> BTW I've been using the following patch since August last year:
> 
> diff --git a/gcc/ipa-inline-transform.c b/gcc/ipa-inline-transform.c
> index 75b8e9d..530fca3 100644
> --- a/gcc/ipa-inline-transform.c
> +++ b/gcc/ipa-inline-transform.c
> @@ -123,6 +123,7 @@ can_remove_node_now_p (struct cgraph_node *node, struct
> cgraph_edge *e)
>      if ((next->callers && next->callers != e)
>         || !can_remove_node_now_p_1 (next))
>        return false;
> +  gcc_unreachable ();
>    return true;
>  }
> 
> And it never triggered since then...

I suppose it is because same_condat_group is used for virutal constructors with
thunks and we are so bad at devirutalzing still... (i.e. somthing like 11 calls
at Mozilla if I remember right) At least I do not see obvoius thinko in that
code.

Honza