[Bug c++/58477] New: ice in cgraph_speculative_call_info

[Bug c++/58477] New: ice in cgraph_speculative_call_info

[dcb314 at hotmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

            Bug ID: 58477
           Summary: ice in cgraph_speculative_call_info
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com

Created attachment 30868
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30868&action=edit
gzipped C++ source code

I just tried to compile package oxygen-gtk2-1.4.0 with gcc 4.9 trunk
dated 20130917. It said

/home/dcb/rpmbuild/BUILD/oxygen-gtk2-1.4.0/src/oxygencolorutils.cpp:148:67:
inte
rnal compiler error: Segmentation fault
             m_backgroundTopColorCache.insert( color.toInt(), out );
                                                                   ^
0xb0413f crash_signal
    ../../src/trunk/gcc/toplev.c:335
0x7e8f14 cgraph_speculative_call_info(cgraph_edge*, cgraph_edge*&,
cgraph_edge*&
, ipa_ref*&)
    ../../src/trunk/gcc/cgraph.c:1125
0x7e9ffe cgraph_redirect_edge_call_stmt_to_callee(cgraph_edge*)
    ../../src/trunk/gcc/cgraph.c:1308
0xb5b14e redirect_all_calls(copy_body_data*, basic_block_def*)
    ../../src/trunk/gcc/tree-inline.c:2326
0xb6162f copy_cfg_body
    ../../src/trunk/gcc/tree-inline.c:2458
0xb6162f copy_body
    ../../src/trunk/gcc/tree-inline.c:2625
0xb66983 expand_call_inline
    ../../src/trunk/gcc/tree-inline.c:4234
0xb66983 gimple_expand_calls_inline
    ../../src/trunk/gcc/tree-inline.c:4341
0xb66983 optimize_inline_calls(tree_node*)
    ../../src/trunk/gcc/tree-inline.c:4496
0xf8758b inline_transform(cgraph_node*)
    ../../src/trunk/gcc/ipa-inline-transform.c:436
0xa58139 execute_one_ipa_transform_pass
    ../../src/trunk/gcc/passes.c:2039
0xa58139 execute_all_ipa_transforms()
    ../../src/trunk/gcc/passes.c:2079
0x7f1990 expand_function
    ../../src/trunk/gcc/cgraphunit.c:1743
0x7f39d6 expand_all_functions
    ../../src/trunk/gcc/cgraphunit.c:1855
0x7f39d6 compile()
    ../../src/trunk/gcc/cgraphunit.c:2192
0x7f3fb9 finalize_compilation_unit()
    ../../src/trunk/gcc/cgraphunit.c:2269
0x5ff47d cp_write_global_declarations()
    ../../src/trunk/gcc/cp/decl2.c:4360
Please submit a full bug report,
with preprocessed source if appropriate.

Preprocessed source code attached. Flag -O3 required.

[Bug c++/58477] ice in cgraph_speculative_call_info

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markus at trippelsdorf dot de

--- Comment #1 from Markus Trippelsdorf <markus at trippelsdorf dot de> ---
markus@x4 tmp % cat test.ii
struct A {
  void operator==(const A &);
};
class B {
public:
  A m_fn1();
  A m_fn2();
};
template <typename T, typename M> class C {
public:
  T Key;
  const M &m_fn2(const T &);
  virtual void m_fn1() {}
  B _map;
};

C<int, int> b;
template <typename T, typename M> const M &C<T, M>::m_fn2(const T &) {
  A a = _map.m_fn2();
  a == _map.m_fn1();
  m_fn1();
}

void fn1() { b.m_fn2(0); }

markus@x4 tmp % g++ -O2 test.ii
test.ii: In function ‘void fn1()’:
test.ii:24:24: internal compiler error: Segmentation fault
>From gcc-bugs-return-430202-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Sep 19 18:24:45 2013
Return-Path: <gcc-bugs-return-430202-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 31222 invoked by alias); 19 Sep 2013 18:24:45 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 31154 invoked by uid 48); 19 Sep 2013 18:24:42 -0000
From: "oleg at smolsky dot net" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/58465] TSan deadlock in a single-threaded program
Date: Thu, 19 Sep 2013 18:24:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: sanitizer
X-Bugzilla-Version: 4.8.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: major
X-Bugzilla-Who: oleg at smolsky dot net
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-58465-4-J0SFWWZ7s8@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-58465-4@http.gcc.gnu.org/bugzilla/>
References: <bug-58465-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-09/txt/msg01442.txt.bz2
Content-length: 233

http://gcc.gnu.org/bugzilla/show_bug.cgi?idX465

--- Comment #4 from Oleg Smolsky <oleg at smolsky dot net> ---
Also, I've just extracted the regex call into a tiny test app and there is no
deadlock... so, it is a bit puzzling...

[Bug c++/58477] ice in cgraph_speculative_call_info

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at ucw dot cz

--- Comment #2 from Paolo Carlini <paolo.carlini at oracle dot com> ---
CC-ing Honza.

[Bug c++/58477] ice in cgraph_speculative_call_info

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2013-09-19
                 CC|                            |hubicka at gcc dot gnu.org
           Assignee|unassigned at gcc dot gnu.org      |hubicka at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #3 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
mine.

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.0
            Summary|ice in                      |[4.9 Regression] ice in
                   |cgraph_speculative_call_inf |cgraph_speculative_call_inf
                   |o                           |o

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[dcb314 at hotmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Jan Hubicka from comment #3)
> mine.

Still broken in trunk dated 20131016.

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

--- Comment #5 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
I am testing
Index: ../gcc/cgraphclones.c
===================================================================
--- ../gcc/cgraphclones.c       (revision 205737)
+++ ../gcc/cgraphclones.c       (working copy)
@@ -123,7 +123,10 @@ cgraph_clone_edge (struct cgraph_edge *e
     {
       tree decl;

-      if (call_stmt && (decl = gimple_call_fndecl (call_stmt)))
+      if (call_stmt && (decl = gimple_call_fndecl (call_stmt))
+         /* When the call is speculative, we need to resolve it 
+            via cgraph_resolve_speculation and not here.  */
+         && !e->speculative)
        {
          struct cgraph_node *callee = cgraph_get_node (decl);
          gcc_checking_assert (callee);

The problem is that cgraph_clone_edge is too eager to turn the edge into a
direct edge because inliner managed to do the same resolution.
This fixes the ICE but we however ought to do this optimization at IPA level.

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Sat Dec 14 18:28:22 2013
New Revision: 205991

URL: http://gcc.gnu.org/viewcvs?rev=205991&root=gcc&view=rev
Log:
    PR middle-end/58477
    * cgraphclones.c (cgraph_clone_edge): Do not resolve speculative edges.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/cgraphclones.c

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

--- Comment #7 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Sat Dec 14 22:08:48 2013
New Revision: 205993

URL: http://gcc.gnu.org/viewcvs?rev=205993&root=gcc&view=rev
Log:
    PR middle-end/58477
    * ipa-prop.c (stmt_may_be_vtbl_ptr_store): Skip clobbers.
    * g++.dg/ipa/devirt-19.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/ipa/devirt-19.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ipa-prop.c
    trunk/gcc/testsuite/ChangeLog

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed, I also verified that we do not miss the devirtualization in the original
source (not only in the reduced testcase).

[Bug c++/58477] [4.9 Regression] ice in cgraph_speculative_call_info

[hubicka at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58477

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Sun Mar  2 20:51:48 2014
New Revision: 208261

URL: http://gcc.gnu.org/viewcvs?rev=208261&root=gcc&view=rev
Log:

    PR ipa/60306

    Revert:
    2013-12-14   Jan Hubicka  <jh@suse.cz>
        PR middle-end/58477
        * ipa-prop.c (stmt_may_be_vtbl_ptr_store): Skip clobbers.

    * testsuite/g++.dg/ipa/devirt-29.C: New testcase

Added:
    trunk/gcc/testsuite/g++.dg/ipa/devirt-29.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ipa-prop.c
    trunk/gcc/testsuite/ChangeLog