[Bug sanitizer/65655] New: [5 Regression][UBSAN] ICE in speculative_call_info, at cgraph.c:1151

[Bug sanitizer/65655] New: [5 Regression][UBSAN] ICE in speculative_call_info, at cgraph.c:1151

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

            Bug ID: 65655
           Summary: [5 Regression][UBSAN] ICE in speculative_call_info, at
                    cgraph.c:1151
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Keywords: ice-on-invalid-code
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: burnus at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org

Created attachment 35206
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35206&action=edit
testcase.ii

g++ -std=c++11 -fsanitize=undefined -O2 input.ii

fails now with

input.ii:49:1: internal compiler error: in speculative_call_info, at
cgraph.c:1151
 }
 ^
0x92b9ae cgraph_edge::speculative_call_info(cgraph_edge*&, cgraph_edge*&,
ipa_ref*&)
        ../../gcc/cgraph.c:1151
0x92ba8c cgraph_edge::resolve_speculation(tree_node*)
        ../../gcc/cgraph.c:1166
0xb2c5a3 redirect_to_unreachable
        ../../gcc/ipa-inline-analysis.c:773
0xb2c5a3 edge_set_predicate
        ../../gcc/ipa-inline-analysis.c:797
0xb2e161 inline_edge_duplication_hook
        ../../gcc/ipa-inline-analysis.c:1325
0x92c403 symbol_table::call_edge_duplication_hooks(cgraph_edge*, cgraph_edge*)
        ../../gcc/cgraph.c:458
0x92c403 cgraph_edge::make_speculative(cgraph_node*, long, int)
        ../../gcc/cgraph.c:1085

[Bug sanitizer/65655] [5 Regression][UBSAN] ICE in speculative_call_info, at cgraph.c:1151

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-04-01
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |5.0
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed, bisecting.

[Bug ipa/65655] [5 Regression] ICE in speculative_call_info, at cgraph.c:1151

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|ice-on-invalid-code         |ice-on-valid-code
          Component|sanitizer                   |ipa
            Summary|[5 Regression][UBSAN] ICE   |[5 Regression] ICE in
                   |in speculative_call_info,   |speculative_call_info, at
                   |at cgraph.c:1151            |cgraph.c:1151

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
But it ICEs even without -fsanitize=undefined, so likely an IPA issue.  Also I
don't see what's invalid in this testcase, it compiles OK with -O.

[Bug ipa/65655] [5 Regression] ICE in speculative_call_info, at cgraph.c:1151

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r221707 or r221706.

[Bug ipa/65655] [5 Regression] ICE in speculative_call_info, at cgraph.c:1151

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug ipa/65655] [5 Regression] ICE in speculative_call_info, at cgraph.c:1151

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |hubicka at gcc dot gnu.org

--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Mine.

[Bug ipa/65655] [5 Regression] ICE in speculative_call_info, at cgraph.c:1151

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

--- Comment #5 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Hmm it is interesting case, we try to resolve speculation while we are
duplicating it. I am testing the following

Index: ipa-inline-analysis.c
===================================================================
--- ipa-inline-analysis.c       (revision 221845)
+++ ipa-inline-analysis.c       (working copy)
@@ -793,7 +793,11 @@ edge_set_predicate (struct cgraph_edge *
 {
   /* If the edge is determined to be never executed, redirect it
      to BUILTIN_UNREACHABLE to save inliner from inlining into it.  */
-  if (predicate && false_predicate_p (predicate))
+  if (predicate && false_predicate_p (predicate)
+      /* When handling speculative edges, we need to do the redirection
+         just once.  Do it always on the direct edge, so we do not
+        attempt to resolve speculation while duplicating the edge.  */
+      && (!e->speculative || e->callee))
     e = redirect_to_unreachable (e);

   struct inline_edge_summary *es = inline_edge_summary (e);

[Bug ipa/65655] [5 Regression] ICE in speculative_call_info, at cgraph.c:1151

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Author: hubicka
Date: Fri Apr  3 18:19:53 2015
New Revision: 221860

URL: https://gcc.gnu.org/viewcvs?rev=221860&root=gcc&view=rev
Log:

    PR ipa/65655
    * ipa-inline-analysis.c (edge_set_predicate): Do not redirect
    speculative indirect edges to avoid ordering issue.
    * g++.dg/torture/pr65655.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr65655.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ipa-inline-analysis.c
    trunk/gcc/testsuite/ChangeLog

[Bug ipa/65655] [5 Regression] ICE in speculative_call_info, at cgraph.c:1151

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65655

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed.