[Bug lto/64043] New: [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[Bug lto/64043] New: [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

            Bug ID: 64043
           Summary: [5 Regression] ICE (segfault) with LTO: in
                    tree_check/tree.h:2758
                    get_binfo_at_offset/tree.c:11914
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: lto
          Assignee: unassigned at gcc dot gnu.org
          Reporter: burnus at gcc dot gnu.org

Created attachment 34087
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34087&action=edit
Test case (unpack, run "make")

Using GCC 5.0.0 20141121, the attached program fails with the following ICE.

To reproduce: Unpack and hit "make". It will compile one.ii and two.ii and
gcc-ar them to libonetwo.ii; it compiles three.ii - and then LTOs them
together.

(Requires an LD with plugin capabilities; I've put the git version of binutils
into the path.)

The failure is:

0xa36e4f crash_signal
        ../../gcc/toplev.c:359
0xc97211 tree_check(tree_node*, char const*, int, char const*, tree_code)
        ../../gcc/tree.h:2758
0xc97211 get_binfo_at_offset(tree_node*, long, tree_node*)
        ../../gcc/tree.c:11914
0x884cf4 possible_polymorphic_call_targets(tree_node*, long,
ipa_polymorphic_call_context, bool*, void**, bool)
        ../../gcc/ipa-devirt.c:2404
0x7ef9d7 possible_polymorphic_call_targets(tree_node*, gimple_statement_base*,
bool*, void**)
        ../../gcc/ipa-utils.h:126
0x7edcd0 gimple_fold_call
        ../../gcc/gimple-fold.c:2667
0x7edcd0 fold_stmt_1
        ../../gcc/gimple-fold.c:3246
0xb55323 execute
        ../../gcc/tree-ssa-forwprop.c:2228

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at redhat dot com

--- Comment #3 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
OK, the problem is that the unit is compiled without -O2 and -fdevirtualize is
not properly marked as Optimization (have separate patch for this).

However it seems that for units that are not optimized with -fdevirtualize we
can just drop OBJ_TYPE_REF and save some of IL memory?

Jason, does this have chance to interfere with devirtualization required by C++
language that happens at -fno-devirtualize too?

Honza

Index: cp/class.c
===================================================================
--- cp/class.c  (revision 218249)
+++ cp/class.c  (working copy)
@@ -736,7 +736,8 @@ build_vfn_ref (tree instance_ptr, tree i
                   cp_build_addr_expr (aref, tf_warning_or_error));

   /* Remember this as a method reference, for later devirtualization.  */
-  aref = build3 (OBJ_TYPE_REF, TREE_TYPE (aref), aref, instance_ptr, idx);
+  if (flag_devirtualize)
+    aref = build3 (OBJ_TYPE_REF, TREE_TYPE (aref), aref, instance_ptr, idx);

   return aref;
 }
Index: testsuite/g++.dg/lto/pr64043_0.C
===================================================================
--- testsuite/g++.dg/lto/pr64043_0.C    (revision 0)
+++ testsuite/g++.dg/lto/pr64043_0.C    (revision 0)
@@ -0,0 +1,14 @@
+// { dg-lto-do link }
+// { dg-lto-options { { -flto -std=c++11 } } }
+// { dg-extra-ld-options "-r -nostdlib -O2" }
+class Validator
+{
+public:
+  virtual ~Validator ();
+};
+class FooWriter
+{
+  Validator *validator;
+  ~FooWriter ();
+};
+FooWriter::~FooWriter () { delete validator; }

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Actually my tree has flag_devirtualize marked as Optimization, as a separate
problem I need to figure out how it happens to be true.

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at gcc dot gnu.org

--- Comment #5 from Jason Merrill <jason at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #3)
> Jason, does this have chance to interfere with devirtualization required by
> C++ language that happens at -fno-devirtualize too?

No, non-virtual calls to virtual functions never make it to build_vfn_ref.

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #6 from Tobias Burnus <burnus at gcc dot gnu.org> ---
*** Bug 64285 has been marked as a duplicate of this bug. ***

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #7 from Tobias Burnus <burnus at gcc dot gnu.org> ---
Now fails with the following backtrace. The location of the failure might have
changed due to the patch at
https://gcc.gnu.org/ml/gcc-patches/2014-12/msg01076.html ; in any case,
currently the failure is:


foo.ii: In member function ‘__base_dtor ’:
foo.ii:11:1: internal compiler error: Segmentation fault
 FooWriter::~FooWriter () { delete validator; }
 ^
0xa1f99f crash_signal
        ../../gcc/toplev.c:358
0x873daf tree_check(tree_node*, char const*, int, char const*, tree_code)
        ../../gcc/tree.h:2778
0x873daf ipa_polymorphic_call_context::get_dynamic_type(tree_node*, tree_node*,
tree_node*, gimple_statement_base*)
0xb9787e eliminate_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/tree-ssa-pre.c:4334
>From gcc-bugs-return-470427-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Dec 12 15:47:36 2014
Return-Path: <gcc-bugs-return-470427-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 12407 invoked by alias); 12 Dec 2014 15:47:36 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 12363 invoked by uid 55); 12 Dec 2014 15:47:32 -0000
From: "rsandifo at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/64182] [5 Regression] wide-int rounding division is broken
Date: Fri, 12 Dec 2014 15:47:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rsandifo at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Priority: P1
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-64182-4-M4QqIw8oX6@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-64182-4@http.gcc.gnu.org/bugzilla/>
References: <bug-64182-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-12/txt/msg01434.txt.bz2
Content-length: 1157

https://gcc.gnu.org/bugzilla/show_bug.cgi?idd182

--- Comment #9 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Author: rsandifo
Date: Fri Dec 12 15:46:57 2014
New Revision: 218678

URL: https://gcc.gnu.org/viewcvs?rev!8678&root=gcc&view=rev
Log:
gcc/
    PR middle-end/64182
    * wide-int.h (wi::div_round, wi::mod_round): Fix rounding of tied
    cases.
    * double-int.c (div_and_round_double): Fix handling of unsigned
    cases.  Use same rounding approach as wide-int.h.

gcc/testsuite/
2014-xx-xx  Richard Sandiford  <richard.sandiford@arm.com>
        Joseph Myers  <joseph@codesourcery.com>

    PR middle-end/64182
    * gcc.dg/plugin/wide-int-test-1.c,
    gcc.dg/plugin/wide-int_plugin.c: New test.
    * gcc.dg/plugin/plugin.exp: Register it.
    * gnat.dg/round_div.adb: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/plugin/wide-int-test-1.c
    trunk/gcc/testsuite/gcc.dg/plugin/wide-int_plugin.c
    trunk/gcc/testsuite/gnat.dg/round_div.adb
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/double-int.c
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gcc.dg/plugin/plugin.exp
    trunk/gcc/wide-int.h

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #8 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
The following patch should help.  Still need to work out why flag_devirtualize
is set at final link - it should not
Index: tree.c
===================================================================
--- tree.c      (revision 218658)
+++ tree.c      (working copy)
@@ -11870,6 +11870,11 @@
   if (TREE_CODE (target) == FUNCTION_TYPE)
     return false;
   gcc_checking_assert (TREE_CODE (target) == METHOD_TYPE);
+  /* If we do not have BINFO associated, it means that type was built
+     without devirtualization enabled.  Do not consider this a virtual
+     call.  */
+  if (!TYPE_BINFO (obj_type_ref_class (target)))
+    return false;
   return true;
 }

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Mon Dec 15 03:41:41 2014
New Revision: 218727

URL: https://gcc.gnu.org/viewcvs?rev=218727&root=gcc&view=rev
Log:

    PR lto/64043
    * tree.c (virtual_method_call_p): Return false when OTR type has
    no BINFO.
    * g++.dg/lto/pr64043_0.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/lto/pr64043_0.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree.c

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #10 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Mon Dec 15 22:35:20 2014
New Revision: 218767

URL: https://gcc.gnu.org/viewcvs?rev=218767&root=gcc&view=rev
Log:

    PR lto/64043
    * gcc.dg/lto/20110201-1_0.c: New testcase.

    * tree-streamer.c (preload_common_nodes): Skip preloading
    of main_identifier_node, pid_type and optimization/option nodes.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gcc.dg/lto/20110201-1_0.c
    trunk/gcc/tree-streamer.c

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #11 from Andreas Schwab <schwab@linux-m68k.org> ---
This breaks ada:

$ gcc/gnatmake --GCC=gcc/xgcc --GNATBIND=gcc/gnatbind --GNATLINK=gcc/gnatlink
-cargs -Bgcc/ -largs '--GCC=gcc/xgcc -Bgcc'  -margs
--RTS=ia64-suse-linux/./libada -f ../gcc/testsuite/gnat.dg/lto8.adb -gnatws
-flto -lm -o ./lto8.exe
gcc/xgcc -c -I../gcc/testsuite/gnat.dg/ -Bgcc/ --RTS=ia64-suse-linux/./libada
-gnatws -flto -lm -I- ../gcc/testsuite/gnat.dg/lto8.adb
gcc/xgcc -c -I../gcc/testsuite/gnat.dg/ -Bgcc/ --RTS=ia64-suse-linux/./libada
-gnatws -flto -lm -I- ../gcc/testsuite/gnat.dg/lto8_pkg.adb
gcc/gnatbind --RTS=ia64-suse-linux/./libada -x lto8.ali
gcc/gnatlink lto8.ali --GCC=gcc/xgcc -Bgcc -flto -o ./lto8.exe
../gcc/testsuite/gnat.dg/lto8_pkg.ads: In function ‘lto8_pkg___elabs’:
../gcc/testsuite/gnat.dg/lto8_pkg.ads:4:1: internal compiler error: in
expand_gimple_stmt_1, at cfgexpand.c:3420
 package Lto8_Pkg is
 ^
0x400000000026d36f expand_gimple_stmt_1
        ../../gcc/cfgexpand.c:3420
0x400000000026e52f expand_gimple_stmt
        ../../gcc/cfgexpand.c:3447
0x400000000027014f expand_gimple_basic_block
        ../../gcc/cfgexpand.c:5280
0x400000000027453f execute
        ../../gcc/cfgexpand.c:5889
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
lto-wrapper: fatal error: /usr/local/gcc/test/Build/gcc/xgcc returned 1 exit
status
>From gcc-bugs-return-470853-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Dec 16 11:25:10 2014
Return-Path: <gcc-bugs-return-470853-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 30117 invoked by alias); 16 Dec 2014 11:25:10 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 30098 invoked by uid 48); 16 Dec 2014 11:25:05 -0000
From: "belagod at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/64328] New: addr_equal-1.c fails execution.
Date: Tue, 16 Dec 2014 11:25:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: belagod at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter
Message-ID: <bug-64328-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-12/txt/msg01860.txt.bz2
Content-length: 996

https://gcc.gnu.org/bugzilla/show_bug.cgi?idd328

            Bug ID: 64328
           Summary: addr_equal-1.c fails execution.
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: belagod at gcc dot gnu.org

FAIL: gcc.dg/addr_equal-1.c execution test

$ aarch64-none-elf-gcc
/work/dev/arm/src/gcc/gcc/testsuite/gcc.dg/addr_equal-1.c -O2 -lm -mcmodel=tiny
-fPIC -o foo.exe

fails on AArch64. This test was introduced by this patch:

https://gcc.gnu.org/ml/gcc-patches/2014-12/msg00613.html

The specific test that's failing is

  if (!__builtin_constant_p (&def_var0 == &def_var1))
    abort();

where def_var0 and def_var1 are globals declared in the same translation unit.
When compiled with fPIC, how much can we know about their addresses at
compile-time for the above test to pass? Is this test valid?

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[dominiq at lps dot ens.fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #12 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
> This breaks ada: ...

It is now pr64340.

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[izamyatin at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

Igor Zamyatin <izamyatin at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |izamyatin at gmail dot com

--- Comment #13 from Igor Zamyatin <izamyatin at gmail dot com> ---
I also see performance degradation for several spec2006 tests after this commit
(mostly on FP tests).
Eg. on Haswell 433.milc shows ~-7-8% if compiled with "-O3 -flto -funroll-loops
-march=core-avx2"

Not investigated this so far though

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #14 from Jan Hubicka <hubicka at ucw dot cz> ---
Hi,
do you use same flags at compile time and link time?
I did not see anything unusual at our testers, but perhaps some of the
optimization flags are streamed wrong?

Honza

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[izamyatin at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #15 from Igor Zamyatin <izamyatin at gmail dot com> ---
Just checked: everywhere "-Ofast -flto -funroll-loops -static -m64  
-march=core-avx2" used (not -O3 as I mentioned before)

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[izamyatin at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #16 from Igor Zamyatin <izamyatin at gmail dot com> ---
Hi, Honza!

I still see that performance degradations for spec2006 tests. Could you please
check those on your side?

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

--- Comment #17 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Unforutnately it is a bit difficult without Haswell machine. Would be possible
to profile it and post the difference in internal loops?
Possibly the target option node is not streamed fully and some flags are
getting lost, though I do not see how that can happen...

[Bug lto/64043] [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64043

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #18 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Igor,
I believe the perofmrance issue is fixed and the Ada issue is separate PR. I
think we can close this PR. If performance issue remain, please just open PR
for that.
The original problem is fixed now.