[Bug ipa/65298] New: [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[Bug ipa/65298] New: [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

            Bug ID: 65298
           Summary: [5 Regression] lto1: ICE: in operator[], at vec.h:736
                    during LTO/PGO Firefox build
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org

On x86_64 I get during final libxul lto WPA phase (-fprofile-use):

lto1: internal compiler error: in operator[], at vec.h:736
0xffc277 vec<tree_node*, va_heap, vl_embed>::operator[](unsigned int)
        ../../gcc/gcc/vec.h:736
0xffd678 vec<tree_node*, va_heap, vl_embed>::operator[](unsigned int)
        ../../gcc/gcc/vec.h:1184
0xffd678 vec<tree_node*, va_heap, vl_ptr>::operator[](unsigned int)
        ../../gcc/gcc/vec.h:1202
0xffd678 ipa_value_from_jfunc(ipa_node_params*, ipa_jump_func*)
        ../../gcc/gcc/ipa-cp.c:937
0x87b5ae evaluate_properties_for_edge
        ../../gcc/gcc/ipa-inline-analysis.c:950
0x87bd9b do_estimate_edge_time(cgraph_edge*)
        ../../gcc/gcc/ipa-inline-analysis.c:3747
0x100e03e estimate_edge_time
        ../../gcc/gcc/ipa-inline.h:313
0x100e03e can_inline_edge_p
        ../../gcc/gcc/ipa-inline.c:503
0x100e498 speculation_useful_p(cgraph_edge*, bool)
        ../../gcc/gcc/ipa-inline.c:1592
0x101b34e clone_inlined_nodes(cgraph_edge*, bool, bool, int*, int)
        ../../gcc/gcc/ipa-inline-transform.c:256
0x101b7fe inline_call(cgraph_edge*, bool, vec<cgraph_edge*, va_heap, vl_ptr>*,
int*, bool, bool*)
        ../../gcc/gcc/ipa-inline-transform.c:345
0x10140ed inline_small_functions
        ../../gcc/gcc/ipa-inline.c:1932
0x1014dba ipa_inline
        ../../gcc/gcc/ipa-inline.c:2320
0x1014dba execute
        ../../gcc/gcc/ipa-inline.c:2726
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
lto-wrapper: fatal error: /var/tmp/gcc_test/usr/local/bin/g++ returned 1 exit
status

CXXFLAGS="-march=native -fno-semantic-interposition -flto=4
-fdevirtualize-at-ltrans -fprofile-use -fprofile-correction -ffunction-sections
-fdata-sections"

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Target Milestone|---                         |5.0

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
amdfam10

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

--- Comment #3 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
ix=1 and m_vecpfx.m_num=1 in this case.
Let me know what other debugging info may be useful to you.

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

--- Comment #4 from Jan Hubicka <hubicka at ucw dot cz> ---
> ix=1 and m_vecpfx.m_num=1 in this case.
> Let me know what other debugging info may be useful to you.

This is primarily Martin Jambor's area, so he may beat me.  I will try to take
a look tonight and see if I can reproduce it locally.
Do you know if the function in question has two arguments?

Honza

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

--- Comment #5 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(gdb) p *jfunc                                                                  
$10 = {
  agg = {
    items = 0x0, 
    by_ref = false
  }, 
  alignment = {
    known = false, 
    align = 0, 
    misalign = 0
  }, 
  type = IPA_JF_PASS_THROUGH, 
  value = {
    constant = {
      value = <tree 0x0>, 
      rdesc = 0x7900000001
    }, 
    pass_through = {
      operand = <tree 0x0>, 
      formal_id = 1, 
      operation = NOP_EXPR, 
      agg_preserved = 0
    }, 
    ancestor = {
      offset = 0, 
      formal_id = 1, 
      agg_preserved = 1
    }
  }
}
(gdb) up
(gdb) p *parms_info
$11 = {
  descriptors = {
    m_vec = 0x112a32b0 = {{
        decl = <tree 0x0>, 
        controlled_uses = -1, 
        move_cost = 1, 
        used = 1
      }}
  }, 
  lattices = 0x0, 
  ipcp_orig_node = <cgraph_node* 0x7fff91d77620 "endSlice">, 
  known_csts = {
    m_vec = 0x112a3310 = {0x0}
  }, 
  known_contexts = {
    m_vec = 0x112a3330 = {{
        offset = 200064, 
        speculative_offset = 0, 
        outer_type = <record_type 0x7fffa4038a80 GCRuntime>, 
        speculative_outer_type = <tree 0x0>, 
        maybe_in_construction = 0, 
        maybe_derived_type = 1, 
        speculative_maybe_derived_type = 0, 
        invalid = 0, 
        dynamic = 1
      }}
  }, 
  analysis_done = 1, 
  node_enqueued = 0, 
  do_clone_for_all_contexts = 0, 
  is_all_contexts_clone = 1, 
  node_dead = 0
}

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

--- Comment #7 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Could you attach the patch, please. It doesn't apply when I copy&paste.

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Created attachment 34951
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34951&action=edit
Patch testing pass-through jump function indices

Here is the same patch as an attachment.

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

--- Comment #9 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to Martin Jambor from comment #8)
> Created attachment 34951 [details]
> Patch testing pass-through jump function indices
> 
> Here is the same patch as an attachment.

Thanks. But I cannot reproduce the issue with todays gcc 
and your patch applied. Unfortunately I have deleted the old 
Firefox build directory...

[Bug ipa/65298] [5 Regression] lto1: ICE: in operator[], at vec.h:736 during LTO/PGO Firefox build

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65298

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
I am not able to reproduce the ICE either, so lets close this until better
reproducer is found.