[Bug ipa/60327] New: [4.9 Regression] xalanbmk and dealII ICE in ipa-inline-analysis.c:3555

[Bug ipa/60327] New: [4.9 Regression] xalanbmk and dealII ICE in ipa-inline-analysis.c:3555

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60327

            Bug ID: 60327
           Summary: [4.9 Regression] xalanbmk and dealII ICE in
                    ipa-inline-analysis.c:3555
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rguenth at gcc dot gnu.org

Both xalanbmk and dealII ICE when built with -Ofast -funroll-loops -fpeel-loops
-march=native -flto -fwhole-program -flto-partition=none (AMD Fam10) like

lto1: internal compiler error: Segmentation fault
0x7ea3bf crash_signal
        /gcc/spec/sb-barbella.arch.suse.de-ai-64/gcc/gcc/toplev.c:337
0x68d839 inline_update_overall_summary(cgraph_node*)
       
/gcc/spec/sb-barbella.arch.suse.de-ai-64/gcc/gcc/ipa-inline-analysis.c:3555     
0x6a7843 walk_polymorphic_call_targets
        /gcc/spec/sb-barbella.arch.suse.de-ai-64/gcc/gcc/ipa.c:229
0x6a7843 symtab_remove_unreachable_nodes(bool, _IO_FILE*)
        /gcc/spec/sb-barbella.arch.suse.de-ai-64/gcc/gcc/ipa.c:400
0x744edb execute_todo
        /gcc/spec/sb-barbella.arch.suse.de-ai-64/gcc/gcc/passes.c:1896
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
lto-wrapper:
/gcc/spec/sb-barbella.arch.suse.de-ai-64/x86_64/install-hack/bin/g++ returned 1
exit status
/usr/bin/ld: fatal error: lto-wrapper failed
collect2: error: ld returned 1 exit status
specmake: *** [dealII] Error 1

[Bug ipa/60327] [4.9 Regression] xalanbmk and dealII ICE in ipa-inline-analysis.c:3555

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60327

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |lto
                 CC|                            |hubicka at gcc dot gnu.org
   Target Milestone|---                         |4.9.0

[Bug ipa/60327] [4.9 Regression] xalanbmk and dealII ICE in ipa-inline-analysis.c:3555

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60327

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
The dealII ICE is

Program received signal SIGSEGV, Segmentation fault.
0x00000000005c9ef7 in vec<inline_summary, va_gc, vl_embed>::operator[] (
    this=0x0, ix=7796) at /space/rguenther/src/svn/trunk/gcc/vec.h:735
735       gcc_checking_assert (ix < m_vecpfx.m_num);
(gdb) up
#1  0x0000000000878d54 in inline_summary (node=0x7ffff13cbe18)
    at /space/rguenther/src/svn/trunk/gcc/ipa-inline.h:245
245       return &(*inline_summary_vec)[node->uid];
(gdb) p inline_summary_vec
$2 = (vec<inline_summary, va_gc, vl_embed> *) 0x0
(gdb) p debug_cgraph_node (node)
_ZN8FEValuesILi3EE6reinitERK12TriaIteratorILi3E15DoFCellAccessorILi3EEE/100039
(reinit) @0x7ffff13cbe18
  Type: function definition analyzed
  Visibility: prevailing_def_ironly
  Aux: @0x7ffff1656e18  References: 
  Referring: 
  Read from file: fe_values.o
  Availability: local
  First run: 0
  Function flags: local
  Called by: _ZN23DerivativeApproxim....
  Calls: _ZN7MappingILi3EE16InternalDataBase16clear_first_cellEv/68568 (1.00
per call) (can throw external) 
  Has 3 outgoing edges for indirect calls.

(gdb) bt
#0  0x00000000005c9ef7 in vec<inline_summary, va_gc, vl_embed>::operator[] (
    this=0x0, ix=7796) at /space/rguenther/src/svn/trunk/gcc/vec.h:735
#1  0x0000000000878d54 in inline_summary (node=0x7ffff13cbe18)
    at /space/rguenther/src/svn/trunk/gcc/ipa-inline.h:245
#2  0x000000000087b0e6 in inline_update_overall_summary (node=0x7ffff13cbe18)
    at /space/rguenther/src/svn/trunk/gcc/ipa-inline-analysis.c:3549
#3  0x00000000008a58ae in walk_polymorphic_call_targets (
    reachable_call_targets=0x24134e0, edge=0x7ffff13dd9c0, 
    first=0x7fffffffded8, reachable=0x1be3c10, before_inlining_p=true)
    at /space/rguenther/src/svn/trunk/gcc/ipa.c:229
#4  0x00000000008a6e9e in symtab_remove_unreachable_nodes (
    before_inlining_p=true, file=0x0)
    at /space/rguenther/src/svn/trunk/gcc/ipa.c:400
#5  0x0000000000996c30 in execute_todo (flags=384)
    at /space/rguenther/src/svn/trunk/gcc/passes.c:1896

(gdb) l
224                          target->name (), target->order);
225               edge = cgraph_make_edge_direct (edge, target);
226               if (!inline_summary_vec && edge->call_stmt)
227                 cgraph_redirect_edge_call_stmt_to_callee (edge);
228               else
229                 inline_update_overall_summary (node);
230             }
231         }
232     }
233
(gdb) p inline_summary_vec
$5 = (vec<inline_summary, va_gc, vl_embed> *) 0x0
(gdb) p edge->call_stmt
$6 = (gimple) 0x0

not sure if the combo is not supposed to happen, but r202380 changed this
like

Index: ipa.c
===================================================================
--- ipa.c       (revision 202379)
+++ ipa.c       (revision 202380)
@@ -220,9 +220,9 @@ walk_polymorphic_call_targets (pointer_s
                     edge->caller->symbol.order,
                     cgraph_node_name (target), target->symbol.order);
          edge = cgraph_make_edge_direct (edge, target);
-         if (cgraph_state != CGRAPH_STATE_IPA_SSA)
+         if (!inline_summary_vec && edge->call_stmt)
            cgraph_redirect_edge_call_stmt_to_callee (edge);
-         else if (inline_summary_vec)
+         else
            inline_update_overall_summary (node);
        }
     }

changing it like

Index: gcc/ipa.c
===================================================================
--- gcc/ipa.c   (revision 208124)
+++ gcc/ipa.c   (working copy)
@@ -223,10 +223,10 @@ walk_polymorphic_call_targets (pointer_s
                     edge->caller->order,
                     target->name (), target->order);
          edge = cgraph_make_edge_direct (edge, target);
-         if (!inline_summary_vec && edge->call_stmt)
-           cgraph_redirect_edge_call_stmt_to_callee (edge);
-         else
+         if (inline_summary_vec)
            inline_update_overall_summary (node);
+         else if (edge->call_stmt)
+           cgraph_redirect_edge_call_stmt_to_callee (edge);
        }
     }
 }

fixes the ICE but I'm not sure if that still effectively has the fix
which was

2013-09-08  Jan Hubicka  <jh@suse.cz>

       * ipa.c (walk_polymorphic_call_targets): Fix redirection before IPA
       summary generation.

[Bug ipa/60327] [4.9 Regression] xalanbmk and dealII ICE in ipa-inline-analysis.c:3555

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60327

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Wed Feb 26 08:39:48 2014
New Revision: 208167

URL: http://gcc.gnu.org/viewcvs?rev=208167&root=gcc&view=rev
Log:
2014-02-26  Richard Biener  <rguenther@suse.de>

    PR ipa/60327
    * ipa.c (walk_polymorphic_call_targets): Properly guard
    call to inline_update_overall_summary.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ipa.c

[Bug ipa/60327] [4.9 Regression] xalanbmk and dealII ICE in ipa-inline-analysis.c:3555

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60327

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.