[Bug ipa/64378] New: [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[Bug ipa/64378] New: [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

            Bug ID: 64378
           Summary: [5 Regression] ICE: in inline_call, at
                    ipa-inline-transform.c:347 with -O3 -fno-ipa-cp
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz

Created attachment 34313
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34313&action=edit
reduced testcase (from g++.dg/ipa/pr61540.C)

Compiler output:
$ gcc -O3 -fno-ipa-cp testcase.C 
testcase.C:22:1: internal compiler error: in inline_call, at
ipa-inline-transform.c:347
 }
 ^
0x1879ad0 inline_call(cgraph_edge*, bool, vec<cgraph_edge*, va_heap, vl_ptr>*,
int*, bool, bool*)
        /mnt/svn/gcc-trunk/gcc/ipa-inline-transform.c:347
0x1874bde recursive_inlining
        /mnt/svn/gcc-trunk/gcc/ipa-inline.c:1404
0x1874bde inline_small_functions
        /mnt/svn/gcc-trunk/gcc/ipa-inline.c:1771
0x1874bde ipa_inline
        /mnt/svn/gcc-trunk/gcc/ipa-inline.c:2189
0x1874bde execute
        /mnt/svn/gcc-trunk/gcc/ipa-inline.c:2562
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

Tested revisions:
r219003 - ICE
4_9 r218177 - OK

[Bug ipa/64378] [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[dominiq at lps dot ens.fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-12-22
     Ever confirmed|0                           |1

--- Comment #1 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
r218722 - ICE

Note the ICE disappears if gcc is configure with --enable-checking=release.

[Bug ipa/64378] [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |5.0

[Bug ipa/64378] [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-checking
           Priority|P3                          |P1
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

#ifdef ENABLE_CHECKING
  /* Verify that estimated growth match real growth.  Allow off-by-one
     error due to INLINE_SIZE_SCALE roudoff errors.  */
  gcc_assert (!update_overall_summary || !overall_size || new_edges_found
              || abs (estimated_growth - (new_size - old_size)) <= 1
              || speculation_removed
              /* FIXME: a hack.  Edges with false predicate are accounted
                 wrong, we should remove them from callgraph.  */
              || predicated);
#endif

triggers again...

(gdb) p estimated_growth
$1 = 5
(gdb) p new_size
$2 = 20
(gdb) p old_size
$3 = 13

off-by-two.

[Bug ipa/64378] [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

--- Comment #3 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
The bug is that ipa-cp disagrees about ipa-prop whether the call is speculative
or not. I am testing:

Index: ipa-prop.c
===================================================================
--- ipa-prop.c  (revision 219700)
+++ ipa-prop.c  (working copy)
@@ -2985,7 +2985,7 @@ try_make_edge_direct_virtual_call (struc
                  || !possible_polymorphic_call_target_p
                       (ie, cgraph_node::get (t)))
                {
-                 /* Do not speculate builtin_unreachable, it is stpid!  */
+                 /* Do not speculate builtin_unreachable, it is stupid!  */
                  if (!ie->indirect_info->vptr_changed)
                    target = ipa_impossible_devirt_target (ie, target);
                }
@@ -3013,6 +3013,7 @@ try_make_edge_direct_virtual_call (struc
      ctx, &final);
   if (final && targets.length () <= 1)
     {
+      speculative = false;
       if (targets.length () == 1)
        target = targets[0]->decl;
       else
Index: ipa-cp.c
===================================================================
--- ipa-cp.c    (revision 219700)
+++ ipa-cp.c    (working copy)
@@ -1975,8 +1975,13 @@ ipa_get_indirect_edge_target_1 (struct c
        }
     }
   else if (t)
-    context = ipa_polymorphic_call_context (t, ie->indirect_info->otr_type,
-                                           anc_offset);
+    {
+      context = ipa_polymorphic_call_context (t, ie->indirect_info->otr_type,
+                                             anc_offset);
+      if (ie->indirect_info->vptr_changed)
+       context.possible_dynamic_type_change (ie->in_polymorphic_cdtor,
+                                             ie->indirect_info->otr_type);
+    }
   else
     return NULL_TREE;

[Bug ipa/64378] [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |hubicka at gcc dot gnu.org

--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
mine.

[Bug ipa/64378] [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

--- Comment #5 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Sun Jan 18 17:31:35 2015
New Revision: 219822

URL: https://gcc.gnu.org/viewcvs?rev=219822&root=gcc&view=rev
Log:

    PR ipa/64378
    * ipa-prop.c (try_make_edge_direct_virtual_call): Clear speculative
    flag correctly.
    * ipa-cp.c (ipa_get_indirect_edge_target_1): Handle speculation.
    * g++.dg/torture/pr64378.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr64378.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ipa-cp.c
    trunk/gcc/ipa-prop.c
    trunk/gcc/testsuite/ChangeLog

[Bug ipa/64378] [5 Regression] ICE: in inline_call, at ipa-inline-transform.c:347 with -O3 -fno-ipa-cp

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64378

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed.