[Bug c++/65284] [5 Regression] ICE (segfault) on arm-linux-gnueabihf

["aldyh at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65284

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|2015-03-03 00:00:00         |2015-03-04
                 CC|                            |aldyh at gcc dot gnu.org
           Assignee|unassigned at gcc dot gnu.org      |aldyh at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Confirmed with --enable-checking=release and a cross build:

$ ./cc1plus a.ii -quiet -std=c++11 -I./ -O2
a.ii: In member function ‘Maybe<ParsedSchema> ParsedSchema::findNested()
const’:
a.ii:45:21: internal compiler error: Segmentation fault
 Maybe<ParsedSchema> ParsedSchema::findNested() const {


I'll take a look.
>From gcc-bugs-return-479355-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Wed Mar 04 16:37:47 2015
Return-Path: <gcc-bugs-return-479355-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 14266 invoked by alias); 4 Mar 2015 16:37:47 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 14190 invoked by uid 48); 4 Mar 2015 16:37:43 -0000
From: "jamborm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build
Date: Wed, 04 Mar 2015 16:37:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jamborm at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P1
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-65298-4-XClnPw2kHX@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-65298-4@http.gcc.gnu.org/bugzilla/>
References: <bug-65298-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-03/txt/msg00499.txt.bz2
Content-length: 2712

https://gcc.gnu.org/bugzilla/show_bug.cgi?ide298

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
(In reply to Markus Trippelsdorf from comment #3)
> ix=1 and m_vecpfx.m_num=1 in this case.
> Let me know what other debugging info may be useful to you.

Well, it might be difficult debugging this without reproducing it,
but...

It would be nice to know, at ipa-cp.c:937, what is the
IPA_NODE_REF(parms_info->ipcp_orig_node), especially the lengths of
the descriptors and lattices vectors.  IPA_NODE_REF currently
translates to ipa_node_params_sum->get(parms_info->ipcp_orig_node) so
it should be easily printable in gdb.

Also, at ipa-inline-analysis.c:950, it is important to know where
parms_info came from, i.e. whether it was obtained as IPA_NODE_REF
(e->caller->global.inlined_to) or only IPA_NODE_REF (e->caller).

You might also try running with the following patch which should
hopefully find out where we create the first wrong jump function
(assuming that is the problem):

diff --git a/gcc/ipa-prop.c b/gcc/ipa-prop.c
index cfd9c16..7116c0f 100644
--- a/gcc/ipa-prop.c
+++ b/gcc/ipa-prop.c
@@ -2570,6 +2570,12 @@ update_jump_functions_after_inlining (struct cgraph_edge
*cs,
                    enum tree_code operation;
                    operation = ipa_get_jf_pass_through_operation (src);

+                   struct ipa_node_params *new_root_info;
+                   new_root_info = IPA_NODE_REF (cs->caller->global.inlined_to
+                                                 ?
cs->caller->global.inlined_to
+                                                 : cs->caller);
+                   gcc_assert (formal_id < ipa_get_param_count
(new_root_info));
+
                    if (operation == NOP_EXPR)
                      {
                        bool agg_p;
@@ -4570,6 +4576,8 @@ ipa_read_jump_function (struct lto_input_block *ib,
       if (operation == NOP_EXPR)
        {
          int formal_id =  streamer_read_uhwi (ib);
+         gcc_assert (formal_id
+                     < ipa_get_param_count (IPA_NODE_REF (cs->caller)));
          struct bitpack_d bp = streamer_read_bitpack (ib);
          bool agg_preserved = bp_unpack_value (&bp, 1);
          ipa_set_jf_simple_pass_through (jump_func, formal_id, agg_preserved);
@@ -4578,6 +4586,8 @@ ipa_read_jump_function (struct lto_input_block *ib,
        {
          tree operand = stream_read_tree (ib, data_in);
          int formal_id =  streamer_read_uhwi (ib);
+         gcc_assert (formal_id
+                     < ipa_get_param_count (IPA_NODE_REF (cs->caller)));
          ipa_set_jf_arith_pass_through (jump_func, formal_id, operand,
                                         operation);
        }