[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Last reconfirmed|                            |2015-1-20
                 CC|                            |marxin at gcc dot gnu.org
>From gcc-bugs-return-474008-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Jan 20 10:17:04 2015
Return-Path: <gcc-bugs-return-474008-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 978 invoked by alias); 20 Jan 2015 10:17:03 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 923 invoked by uid 48); 20 Jan 2015 10:16:58 -0000
From: "marxin at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/64686] New: [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking
Date: Tue, 20 Jan 2015 10:17:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: marxin at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: hubicka at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc
Message-ID: <bug-64686-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-01/txt/msg02002.txt.bz2
Content-length: 4854

https://gcc.gnu.org/bugzilla/show_bug.cgi?idd686

            Bug ID: 64686
           Summary: [5 Regression] ICE: in edge_badness, at
                    ipa-inline.c:912 during Firefox LTO build with enabled
                    checking
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: hubicka at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: markus at trippelsdorf dot net

gcc -v:
gcc version 5.0.0 20150120 (experimental) (GCC)

BT:
lto1: internal compiler error: in edge_badness, at ipa-inline.c:912
0xe48e21 edge_badness
    ../../gcc/ipa-inline.c:912
0xe4ce25 update_edge_key
    ../../gcc/ipa-inline.c:1038
0xe4ce25 inline_small_functions
    ../../gcc/ipa-inline.c:1608
0xe4ec95 ipa_inline
    ../../gcc/ipa-inline.c:2179
0xe4ec95 execute
    ../../gcc/ipa-inline.c:2551

GDB:
912        gcc_checking_assert (edge_time <= callee_info->time);
(gdb) p edge_time
$1 = 2068
(gdb) p callee_info->time
$2 = 2032
# It's a recursive function
(gdb) p edge->caller == edge->callee
$9 = true


(gdb) call callee->dump(stderr)
_ZN23nsScriptSecurityManager26AddSitesToFileURIWhitelistERK9nsCString/3808049
(AddSitesToFileURIWhitelist) @0x7fff97344498
  Type: function definition analyzed
  Visibility: prevailing_def_ironly
  References: _ZN12nsCharTraitsIcE12sEmptyBufferE/58819
(read)_ZN23nsScriptSecurityManager10sIOServiceE/3807900
(read)_ZN23nsScriptSecurityManager10sIOServiceE/3807900
(read)_ZN17nsIConsoleService11COMTypeInfoIS_vE4kIIDE/88287 (addr)
  Referring:
  Read from file:
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/toolkit/library/../../caps/Unified_cpp_caps0.o
  Availability: local
  First run: 0
  Function flags: local
  Called by: _ZN23nsScriptSecurityManager25ScriptSecurityPrefChangedEv/3808048
(5.05 per call)
_ZN23nsScriptSecurityManager26AddSitesToFileURIWhitelistERK9nsCString/3808049
(1.01 per call)
_ZN23nsScriptSecurityManager26AddSitesToFileURIWhitelistERK9nsCString/3808049
(1.01 per call)
  Calls: _Z8SkipPastI12IsWhitespaceEjRK9nsCStringj/3809750 (10.11 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (9.10 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (9.10 per call)
_ZN18nsAString_internal8FinalizeEv/58869 (0.64 per call)
_ZN18nsAString_internal8FinalizeEv/58869 (0.64 per call)
_ZN18nsAString_internal8FinalizeEv/58869 (0.64 per call)
_ZN18nsAString_internal6AssignERK16nsSubstringTuple/58883 (0.64 per call)
_Z18AppendASCIItoUTF16RK19nsACString_internalR18nsAString_internal/58501 (0.64
per call)
_ZN13nsCOMPtr_base25assign_from_gs_contractidE24nsGetServiceByContractIDRK4nsID/295933
(0.91 per call)
_ZN13nsTArray_ImplI8nsCOMPtrI6nsIURIE27nsTArrayInfallibleAllocatorE13AppendElementIRS2_EEPS2_OT_/3809758
(8.19 per call) __builtin_expect/17283 (9.10 per call)
_Z9NS_NewURIPP6nsIURIRK19nsACString_internalPKcS0_P12nsIIOService/181475 (9.10
per call) _ZN13nsCOMPtr_base16begin_assignmentEv/295936 (9.10 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (1.01 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (1.01 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (1.01 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (1.01 per call)
_ZN23nsScriptSecurityManager26AddSitesToFileURIWhitelistERK9nsCString/3808049
(1.01 per call) _ZN19nsACString_internal6AssignERK17nsCSubstringTuple/58939
(1.01 per call) _ZN19nsACString_internal8FinalizeEv/58925 (1.01 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (1.01 per call)
_ZN23nsScriptSecurityManager26AddSitesToFileURIWhitelistERK9nsCString/3808049
(1.01 per call) _ZN19nsACString_internal6AssignERK17nsCSubstringTuple/58939
(1.01 per call) __builtin_expect/17283 (10.11 per call)
_ZN19nsACString_internal8FinalizeEv/58925 (10.11 per call)
_ZN19nsACString_internal6AssignERKS_/58937 (10.11 per call)
_ZN21nsDependentCSubstring6RebindERK19nsACString_internaljj/58008 (10.11 per
call) _Z9SkipUntilI12IsWhitespaceEjRK9nsCStringj/3809751 (10.11 per call)
_Z8SkipPastI12IsWhitespaceEjRK9nsCStringj/3809750 (1.00 per call)
   Polymorphic indirect call of type struct nsISupports token:2(6.35 per call)
    Outer type (dynamic):struct nsISupports (or a derived type) (maybe in
construction) offset 0
   Polymorphic indirect call of type struct nsISupports token:2(0.64 per call)
    Outer type (dynamic):struct nsISupports (or a derived type) (maybe in
construction) offset 0
   Polymorphic indirect call of type struct nsIConsoleService token:4(0.64 per
call)
    Outer type (dynamic):struct nsIConsoleService (or a derived type) (maybe in
construction) offset 0
   Polymorphic indirect call of type struct nsIIOService token:18(10.11 per
call)
    Outer type (dynamic):struct nsIIOService (or a derived type) (maybe in
construction) offset 0

Thanks,
Martin

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #1 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Mine.

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

--- Comment #2 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
In what configuration do you build FIrefox? This does not reproduce for me with
-O3 build.

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

--- Comment #3 from David Binderman <dcb314 at hotmail dot com> ---
Created attachment 34603
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34603&action=edit
C++ source code

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to David Binderman from comment #3)
> Created attachment 34603 [details]
> C++ source code

The attached code does the following with trunk dated 20150128 with
flag -O3


$ ../results/bin/gcc -c -O3 bug184.cc
compiler/BinaryExpr.cpp:195:1: internal compiler error: in edge_badness, at
ipa-inline.c:1018
0x11f5b97 edge_badness(cgraph_edge*, bool)
    ../../src/trunk/gcc/ipa-inline.c:1018
0x11f462d update_edge_key(fibonacci_heap<sreal, cgraph_edge>*, cgraph_edge*)
    ../../src/trunk/gcc/ipa-inline.c:1144
0x11f1555 inline_small_functions()
    ../../src/trunk/gcc/ipa-inline.c:1724
0x11f1555 ipa_inline()
    ../../src/trunk/gcc/ipa-inline.c:2298
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$

../../src/trunk/gcc/ipa-inline.c:1018 is

  gcc_checking_assert (edge_time <= callee_info->time);

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |trippels at gcc dot gnu.org

--- Comment #5 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
markus@x4 tmp % cat bug184.cc
class A
{
protected:
  A *m_fn2 (int) const;
public:
  virtual A *m_fn1 (int *) const = 0;
};
class B : A
{
  B (A *, int, A *);
  A *m_fn1 (int *) const;
};
A *
B::m_fn1 (int *) const
{
  new B (m_fn2 (0)->m_fn1 (0), 0, m_fn2 (0)->m_fn1 (0));
}

markus@x4 tmp % g++ -c -O3 bug184.cc
bug184.cc:17:1: internal compiler error: in edge_badness, at ipa-inline.c:1014
 }
 ^
0x128f4d7 edge_badness
        ../../gcc/gcc/ipa-inline.c:1014
0x1290855 update_edge_key
        ../../gcc/gcc/ipa-inline.c:1140
0x1290855 inline_small_functions
        ../../gcc/gcc/ipa-inline.c:1720
0x129305a ipa_inline
        ../../gcc/gcc/ipa-inline.c:2291
0x129305a execute
        ../../gcc/gcc/ipa-inline.c:2663
Please submit a full bug report,

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Hmm, seems to be some kind of out-of-sync issues when dealing with speculative
calls...

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

--- Comment #7 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
It is an ordering issue. We are adding edges to heap and resolving speculations
at once that means that we have temporarily wrong summaries. I am testing the
following that should not affect codegen in any important way except for random
changes of functions with the same priority.

Index: ipa-inline.c
===================================================================
--- ipa-inline.c        (revision 220417)
+++ ipa-inline.c        (working copy)
@@ -1702,6 +1702,7 @@ inline_small_functions (void)
     {
       bool update = false;
       struct cgraph_edge *next;
+      bool has_speculative = false;

       if (dump_file)
        fprintf (dump_file, "Enqueueing calls in %s/%i.\n",
@@ -1719,12 +1720,17 @@ inline_small_functions (void)
              gcc_assert (!edge->aux);
              update_edge_key (&edge_heap, edge);
            }
-         if (edge->speculative && !speculation_useful_p (edge, edge->aux !=
NULL))
+         if (edge->speculative)
+           has_speculative = true;
+       }
+      if (has_speculative)
+       for (edge = node->callees; edge; edge = next)
+         if (edge->speculative && !speculation_useful_p (edge,
+                                                         edge->aux != NULL))
            {
              edge->resolve_speculation ();
              update = true;
            }
-       }
       if (update)
        {
          struct cgraph_node *where = node->global.inlined_to

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

--- Comment #8 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Thu Feb  5 00:16:11 2015
New Revision: 220429

URL: https://gcc.gnu.org/viewcvs?rev=220429&root=gcc&view=rev
Log:
    PR ipa/64686
    * ipa-inline.c (inline_small_functions): Fix ordering issue between
    speculation resolution and key updates.
    * g++.dg/torture/pr64686.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr64686.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ipa-inline.c
    trunk/gcc/testsuite/ChangeLog

[Bug ipa/64686] [5 Regression] ICE: in edge_badness, at ipa-inline.c:912 during Firefox LTO build with enabled checking

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64686

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed.