[Bug ipa/60306] [4.9 Regression] Incorrect devirtualization "pure virtual method called"

["hubicka at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60306

--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
OK, I am re-considering my decision to not assign this to Martin.
The problem is the following.  We have call:

  struct Box x;
...
  x = edges_connecting_to_node (1); [return slot optimization]
...
  _19 = OBJ_TYPE_REF(_18;(const struct Object)&x.D.8084->0) (&x.D.8084);

The dynamic type of x at that point is Box. We however get it wrong as Object.
This is what come from detect_type_change.

The reason is that detect_type_change actually ignores
  x = edges_connecting_to_node (1); [return slot optimization]
which it should not, since it gives it an useful information that x is fully
constructed when the return value happens.

But it considers other statement:
  MEM[(struct new_allocator *)&x + 8B] ={v} {CLOBBER};
  MEM[(struct allocator *)&x + 8B] ={v} {CLOBBER};
  MEM[(struct _Vector_impl *)&x + 8B] ={v} {CLOBBER};
  MEM[(struct _Vector_base *)&x + 8B] ={v} {CLOBBER};
  MEM[(struct vector *)&x + 8B] ={v} {CLOBBER};
  MEM[(struct Object *)&x]._vptr.Object = &MEM[(void *)&_ZTV6Object + 16B];
  MEM[(struct Object *)&x] ={v} {CLOBBER};
  x ={v} {CLOBBER};

which is end of the loop the whole thing is contained in.  The dead store to
._vptr.Object come from inlined destructor and it makes detect_type_change to
believe that the dynamic type is Object.  That is true if you manage to ignore
the initialization.

Now I wonder how to fix this; simple fix is to make detect_type_change to
notice the call and constructors, that is useful by itself.
But I believe there is deeper problem, we need to prove that on _all_ paths to
the statement the dynamic type was changed in known way, not that on all paths
where we can understand the dynamic change the type changed same way.

Can alias oracle walker tell us when it runs into default def?