[Bug ipa/60727] New: ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[Bug ipa/60727] New: ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60727

            Bug ID: 60727
           Summary: ICE in ipcp_verify_propagated_values, at ipa-cp.c:892
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rguenth at gcc dot gnu.org
                CC: jamborm at gcc dot gnu.org

Created attachment 32511
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32511&action=edit
testcase

Compiling libqt4 with -flto and r208807 yields

> g++-4.9 JSCell.ii -flto -O2 -fvisibility=hidden -shared -nostdlib
lto1: internal compiler error: in ipcp_verify_propagated_values, at
ipa-cp.c:892
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://bugs.opensuse.org/> for instructions.
lto-wrapper: g++-4.9 returned 1 exit status
/usr/lib64/gcc/x86_64-suse-linux/4.9/../../../../x86_64-suse-linux/bin/ld:
lto-wrapper failed
collect2: error: ld returned 1 exit status

[Bug ipa/60727] ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60727

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
eventually this is already fixed (cannot reproduce in my development tree - but
that has a load of patches, including LTO ones).

[Bug ipa/60727] ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60727

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Can be reproduced with http://gcc.gnu.org/ml/gcc-patches/2014-03/msg01237.html
ontop of r208807 and the following reduced testcase:

typedef long unsigned int size_t;
class JSCell;
class JSObject;
class X;
class JSValue {
public:
    JSValue(JSCell* ptr);
};
class MarkStack{ };
class I { };
class JSCell {
    friend class JSObject;
    virtual JSObject* toObject() const;
    bool fastGetOwnX(const I& propertyName, X&);
    virtual bool getOwnX(const I& propertyName, X&);
};
class X {
public:
    typedef JSValue (*GetValueFunc)(const I&, const X&);
    void setValueSlot(JSValue, JSValue*, size_t) { m_getValue = 0; }
    GetValueFunc m_getValue;
};
class JSObject : public JSCell {
    friend class JSCell;
    virtual void markChildren(MarkStack&);
    bool getX(const I& propertyName, X&);
    virtual bool getOwnX(const I& propertyName, X&);
    bool inlineGetOwnX(const I& propertyName, X&);
};
inline __attribute__((__always_inline__)) bool
JSObject::inlineGetOwnX(const I& propertyName, X& slot)
{
    slot.setValueSlot(this, 0, 0);
}
inline __attribute__((__always_inline__)) bool
JSObject::getOwnX(const I& propertyName, X& slot)
{
    return inlineGetOwnX(propertyName, slot);
}
inline __attribute__((__always_inline__)) bool
JSCell::fastGetOwnX(const I& propertyName, X& slot)
{
    return getOwnX(propertyName, slot);
}
inline __attribute__((__always_inline__)) bool
JSObject::getX(const I& propertyName, X& slot)
{
    this->fastGetOwnX(propertyName, slot);
}
bool JSCell::getOwnX(const I& identifier, X& slot)
{
    JSObject* object = toObject();
    object->getX(identifier, slot);
}

I suppose that patch either pulls the bodies from IPA-CP at some bogus
time or ends up with cgraph nodes confusing IPA-CP.  Needs -flto only
because the patch changes the -flto path only (as opposed to Honzas proposed
change in that thread that doesn't fix the issue).  Somehow the patch
doesn't trigger the same issue on trunk though.

[Bug ipa/60727] ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60727

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
What happens is that we do not remove an unreachable cgraph_node.  We
don't do it because the node has used_from_other_partition set which I
assume is always bogus at the beginning of WPA (moreover, the node is
also local).  I'll have a look why exactly that happens.

[Bug ipa/60727] ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60727

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
OK, the bit is actually calculated when streaming the node out (ugh)
in the following way:

  bp_pack_value (&bp, tag == LTO_symtab_analyzed_node
         && symtab_get_symbol_partitioning_class (node) == SYMBOL_PARTITION
         && (reachable_from_other_partition_p (node, encoder)
             || referenced_from_other_partition_p (&node->ref_list,
                               encoder)), 1);

and with the patch, reachable_from_other_partition_p returns true
because it goes over all callers and if it does not find one in the
encoder it assumes it is in another partition.  The one caller is an
always_inline function that is not streamed after being squashed.

Honza told me on IRC that he would come up with a different patch to
fix the FORTIFY_SOURCE issue so I guess we don't need to fix this.
Otherwise we'd need to aff !flag_wpa or some such thing to the
condition.

[Bug ipa/60727] ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[jamborm at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60727

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |WONTFIX

--- Comment #5 from Martin Jambor <jamborm at gcc dot gnu.org> ---
The patch causing this did not get committed, the bug it was intended
to fix was fixed a by a different patch, which also adds asserts to
guard against this problem:

http://gcc.gnu.org/ml/gcc-patches/2014-04/msg00179.html