From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-499671-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 38544 invoked by alias); 16 Oct 2015 04:45:50 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Received: (qmail 38487 invoked by uid 48); 16 Oct 2015 04:45:45 -0000
From: "hubicka at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/67056] [5/6 regression] Wrong code generated
Date: Fri, 16 Oct 2015 04:45:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 5.2.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: hubicka at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: hubicka at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-67056-4-YDnxbdTy6F@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-67056-4@http.gcc.gnu.org/bugzilla/>
References: <bug-67056-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-10/txt/msg01226.txt.bz2

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67056

--- Comment #14 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
OK, the unreachable is introduced here:
 - Creating a specialized node of bool staticBoolFunc(CompositeClass*)/414 for
all known contexts.
     the new node is <built-in>/977.                                            
     known ctx 0 is     Outer type (dynamic):struct EmptyClass offset -64       
No devirtualization target in <built-in>/977                                    
ipa-prop: Discovered a virtual call to a known target (<built-in>/977 -> void
__builtin_unreachable()/976), for stmt OBJ_TYPE_REF(_15;ptr_2(D)->1)
(ptr_2(D));
/aux/hubicka/trunk-install/include/c++/6.0.0/bits/unique_ptr.h:76:2: note:
converting indirect call in <built-in> to direct call to void
__builtin_unreachable()
No devirtualization target in <built-in>/977                                    
ipa-prop: Discovered a virtual call to a known target (<built-in>/977 -> void
__builtin_unreachable()/976), for stmt OBJ_TYPE_REF(_27;ptr_2(D)->1)
(ptr_2(D));
/aux/hubicka/trunk-install/include/c++/6.0.0/bits/unique_ptr.h:76:2: note:
converting indirect call in <built-in> to direct call to void
__builtin_unreachable()

So ipa-CP thinks that staticBoolFunc is called on EmptyClass instead of
CompositeClass:

Jump functions:                                                                 
  Jump functions of caller  long unsigned int __builtin_object_size(const
void*, int)/967:
  Jump functions of caller  void operator delete(void*, long unsigned int)/964: 
  Jump functions of caller  void* operator new(std::size_t)/963:                
  Jump functions of caller  int main(int, char**)/415:                          
    callsite  int main(int, char**)/415 -> void operator delete(void*, long
unsigned int)/964 :
    callsite  int main(int, char**)/415 -> bool
staticBoolFunc(CompositeClass*)/414 :
       param 0: UNKNOWN                                                         
         Context:     Outer type (dynamic):struct EmptyClass offset -64         
         Unknown alignment                                                      
    callsite  int main(int, char**)/415 -> EmptyClass::EmptyClass()/404 :       
       param 0: UNKNOWN                                                         
         Context:     Outer type (dynamic): (or a derived type) (maybe in
construction) offset 64 Speculative outer type:struct CompositeClass (or a
derived type) at offset 64
         Unknown alignment                                                      

This is indeed wrong. Jump function analysis seems to confuse constructors:

Modification phase of node int main(int, char**)/402
int main(int, char**) (int D.39529, char * * D.39530)
{
  void * _3;
  struct EmptyClass * _7;

  <bb 2>:
  _3 = operator new (16);
  MEM[(struct  &)_3] ={v} {CLOBBER};
  MEM[(struct CompositeClass *)_3]._vptr.CompositeClass = &MEM[(void
*)&_ZTV14CompositeClass + 16B];
  _7 = &MEM[(struct CompositeClass *)_3].object;
  EmptyClass::EmptyClass (_7);

  <bb 3>:
  staticBoolFunc (_3);
  return 0;

<L1>:
  operator delete (_3, 16);
  resx 1

EmptyClass ctor is called, but it should not type the object.

Determining dynamic type for call: staticBoolFunc (_3);
  Starting walk at: staticBoolFunc (_3);
  instance pointer: _3  Outer instance pointer: _3 offset: 0 (bits) vtbl
reference: 
  Checking constructor call: EmptyClass::EmptyClass (_7);
  Recording type: struct EmptyClass at offset -64
  Determined dynamic type.

This is quite a nonsense, because EmptyClass is not even. So there are two
bugs.
First is that we determine useless outer type. This should be just missed
optimization. But we also manage to consider to miss the case in placement_new
checking where we are completely off the structure....