From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-445198-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 21157 invoked by alias); 2 Mar 2014 02:14:10 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Received: (qmail 21023 invoked by uid 48); 2 Mar 2014 02:14:00 -0000
From: "hubicka at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/60306] [4.9 Regression] Incorrect devirtualization "pure virtual method called"
Date: Sun, 02 Mar 2014 02:14:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: hubicka at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Priority: P1
X-Bugzilla-Assigned-To: hubicka at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-60306-4-dXqLjBuT5R@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-60306-4@http.gcc.gnu.org/bugzilla/>
References: <bug-60306-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-03/txt/msg00067.txt.bz2

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60306

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
OK, this is what I am testing for mainline now:
Index: ipa-prop.c
===================================================================
--- ipa-prop.c  (revision 208247)
+++ ipa-prop.c  (working copy)
@@ -572,7 +572,12 @@ static bool
 stmt_may_be_vtbl_ptr_store (gimple stmt)
 {
   if (is_gimple_call (stmt))
-    return false;
+    {
+      return ((gimple_call_lhs (stmt)
+              && AGGREGATE_TYPE_P (TREE_TYPE (gimple_call_lhs (stmt))))
+             || (gimple_call_fndecl (stmt)
+                 && DECL_CXX_CONSTRUCTOR_P (gimple_call_fndecl (stmt))));
+    }
   else if (gimple_clobber_p (stmt))
     return false;
   else if (is_gimple_assign (stmt))

This will make us to punt on about every ctor sequence except case where
everything got early inlined.  I hope to get some firefox numbers - I don't
expecct it to be that bad. ipa-devirt made us less dependent on type change
detection and type change detection was never too strong anyway.

other option I did not mention is to simply revert:

2013-12-14   Jan Hubicka  <jh@suse.cz>

        PR middle-end/58477
        * ipa-prop.c (stmt_may_be_vtbl_ptr_store): Skip clobbers.

this change made the bug to trigger: by punting on all clobbers one can not mix
construction and destruction within the loop for automatic vars.

I spent some time playing with this and I think those are only ones that
matters. It seems that most of checks for dynamic type change for function
parameters are not that useful based on Jason's comment that once you get a
non-pod built you can not in-place new it to something else. Because we don't
track heap allocated objects the type is given by the type of decl the instance
lives in.

Reverting that patch seems however rather symptomatic fix.  This code is on my
TODO to rework and integrate into ipa-devirt for next stage1 anyway.