[Bug c++/64139] New: ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[Bug c++/64139] New: ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

            Bug ID: 64139
           Summary: ice in possible_polymorphic_call_targets, at
                    ipa-devirt.c:2410
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com

Created attachment 34155
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34155&action=edit
gzipped C++ source code

I just tried to compile the attached C++ code with the latest trunk
dated 20141130 on a Fedora Linux x86_64 box.

The compiler said

/home/dcb/rpmbuild/BUILD/spatialindex-src-1.8.1/src/mvrtree/MVRTree.cc:1360:1:
i
nternal compiler error: in possible_polymorphic_call_targets, at
ipa-devirt.c:24
10
 }
 ^
0xa47df4 possible_polymorphic_call_targets(tree_node*, long,
ipa_polymorphic_cal
l_context, bool*, void**, bool)
    ../../src/trunk/gcc/ipa-devirt.c:2410
0x17e4127 ipa_get_indirect_edge_target_1(cgraph_edge*, vec<tree_node*, va_heap, 
vl_ptr>, vec<ipa_polymorphic_call_context, va_heap, vl_ptr>,
vec<ipa_agg_jump_fu
nction*, va_heap, vl_ptr>, ipa_agg_replacement_value*, bool*)
    ../../src/trunk/gcc/ipa-cp.c:1872
0xa5ebbd estimate_edge_devirt_benefit(cgraph_edge*, int*, int*, vec<tree_node*, 
va_heap, vl_ptr>, vec<ipa_polymorphic_call_context, va_heap, vl_ptr>,
vec<ipa_ag
g_jump_function*, va_heap, vl_ptr>)
    ../../src/trunk/gcc/ipa-inline-analysis.c:2999
0xa5ebbd estimate_edge_size_and_time(cgraph_edge*, int*, int*, int*, int,
vec<tr
ee_node*, va_heap, vl_ptr>, vec<ipa_polymorphic_call_context, va_heap, vl_ptr>, 
vec<ipa_agg_jump_function*, va_heap, vl_ptr>, int*)
    ../../src/trunk/gcc/ipa-inline-analysis.c:3040
0xa5c7c4 estimate_calls_size_and_time(cgraph_node*, int*, int*, int*, int*,
unsi
gned int, vec<tree_node*, va_heap, vl_ptr>, vec<ipa_polymorphic_call_context,
va
_heap, vl_ptr>, vec<ipa_agg_jump_function*, va_heap, vl_ptr>)
    ../../src/trunk/gcc/ipa-inline-analysis.c:3099
0xa5ab25 estimate_node_size_and_time(cgraph_node*, unsigned int,
vec<tree_node*,
 va_heap, vl_ptr>, vec<ipa_polymorphic_call_context, va_heap, vl_ptr>,
vec<ipa_a
gg_jump_function*, va_heap, vl_ptr>, int*, int*, int*, int*,
vec<inline_param_su
mmary, va_heap, vl_ptr>)

Flag -O2 required.

[Bug ipa/64139] [5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-12-01
                 CC|                            |mjambor at suse dot cz
          Component|c++                         |ipa
   Target Milestone|---                         |5.0
            Summary|ice in                      |[5 Regression] ice in
                   |possible_polymorphic_call_t |possible_polymorphic_call_t
                   |argets, at                  |argets, at
                   |ipa-devirt.c:2410           |ipa-devirt.c:2410
     Ever confirmed|0                           |1

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
It was caused by r217587.

[Bug ipa/64139] [5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|mjambor at suse dot cz             |hubicka at gcc dot gnu.org,
                   |                            |jamborm at gcc dot gnu.org

--- Comment #2 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Honza, does this assert in possible_polymorphic_call_targets:

  gcc_assert (odr_violation_reported);

make sense even when called from ipa-cp?  (And thus possibly with
illegal polymorphic contexts for some call contexts which is OK as
long as their use is guarded at run-time.)

[Bug ipa/64139] [5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
And by the way, neither ipa-cp nor ipa-prop invents anything funny
here.  It feeds ipa-devirt exactly the same context that it created in
ipa_compute_jump_functions_for_edge (i.e. that the constructor created
for the call argument).

[Bug ipa/64139] [5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Well, that assert is there because I was mostly curious if it is possible to
construct valid C++ program doing so. I will figure out if the context passed
seems legit and probably just remove the assert.

[Bug ipa/64139] [5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug ipa/64139] [4.9/5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |trippels at gcc dot gnu.org
            Summary|[5 Regression] ice in       |[4.9/5 Regression] ice in
                   |possible_polymorphic_call_t |possible_polymorphic_call_t
                   |argets, at                  |argets, at
                   |ipa-devirt.c:2410           |ipa-devirt.c:2410
      Known to fail|                            |4.9.1, 5.0

--- Comment #5 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
reduced test case:

class IObject {
public:
  virtual ~IObject();
};
class A {
  virtual int m_fn1();
};
class B {
public:
  virtual int m_fn2(B) const;
};
class D : IObject, public virtual B {};
class G : public D, A {
public:
  G(A);
};
class F : B {
  friend class C;
};
class C {
  void m_fn3(const IObject &, int &);
  void m_fn4(const B &, int &);
};
A a;
void C::m_fn3(const IObject &, int &p2) {
  G r(a);
  m_fn4(r, p2);
}
void C::m_fn4(const B &p1, int &) {
  F b;
  p1.m_fn2(b);
}

Also ICEs with gcc-4.9:

trippels@gcc20 ~ % g++ -c -O2 bug178.cc
bug178.cc: In member function ‘void C::m_fn3(const IObject&, int&)’:
bug178.cc:32:1: internal compiler error: in possible_polymorphic_call_targets,
at ipa-devirt.c:1557
>From gcc-bugs-return-470389-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Dec 12 11:13:50 2014
Return-Path: <gcc-bugs-return-470389-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 11831 invoked by alias); 12 Dec 2014 11:13:49 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 11795 invoked by uid 48); 12 Dec 2014 11:13:45 -0000
From: "burnus at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug lto/64285] New: [5 Regression] During LTO: ICE segfault in ipa_polymorphic_call_context::get_dynamic_type
Date: Fri, 12 Dec 2014 11:13:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: lto
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: ice-on-valid-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: burnus at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status keywords bug_severity priority component assigned_to reporter cc
Message-ID: <bug-64285-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-12/txt/msg01396.txt.bz2
Content-length: 1545

https://gcc.gnu.org/bugzilla/show_bug.cgi?idd285

            Bug ID: 64285
           Summary: [5 Regression] During LTO: ICE segfault in
                    ipa_polymorphic_call_context::get_dynamic_type
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: lto
          Assignee: unassigned at gcc dot gnu.org
          Reporter: burnus at gcc dot gnu.org
                CC: hubicka at gcc dot gnu.org

I tried compiling the program again which gave the ICE of PR64043, motivated by
the patch https://gcc.gnu.org/ml/gcc-patches/2014-12/msg01076.html which looks
vaguely related.

In any case, it now (r218661) fails with:

gcc-trunk/include/c++/5.0.0/bits/unique_ptr.h:70:0: internal compiler error:
Segmentation fault
       operator()(_Tp* __ptr) const
 ^
0xa2576f crash_signal
        ../../gcc/toplev.c:358
0x878d2f tree_check(tree_node*, char const*, int, char const*, tree_code)
        ../../gcc/tree.h:2778
0x878d2f ipa_polymorphic_call_context::get_dynamic_type(tree_node*, tree_node*,
tree_node*, gimple_statement_base*)
        ../../gcc/ipa-polymorphic-call.c:1594
0xb9f23e eliminate_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/tree-ssa-pre.c:4334
0xfde647 dom_walker::walk(basic_block_def*)
        ../../gcc/domwalk.c:188
0xba0da0 eliminate
        ../../gcc/tree-ssa-pre.c:4491
0xba0ff5 execute
        ../../gcc/tree-ssa-pre.c:4910


Testcase reduction under way

[Bug ipa/64139] [4.9/5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |hubicka at gcc dot gnu.org

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Mine.

[Bug ipa/64139] [4.9/5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends on|                            |60871

--- Comment #7 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Here get_binfo_at_offset gives up looking for base of G of type B at offset
128.
It identifies the base field correctly but then it gets lost looking up the
binfo by looking into A instead of G bases.

This is because in memory layout of G there is A in between G's data and G's
virtual base.

I suppose the binfo lookup may really need to be turned into a recursive
function when virtual bases are involved.  This seems to be the same issue as
PR60871.

[Bug ipa/64139] [4.9/5 Regression] ice in possible_polymorphic_call_targets, at ipa-devirt.c:2410

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64139

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #8 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed by fix for PR60871

*** This bug has been marked as a duplicate of bug 60871 ***