[Bug ipa/93318] [10 regression] Firefox LTO+FDO ICEs in speculative_call_info

["luoxhu at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93318

luoxhu at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |luoxhu at gcc dot gnu.org

--- Comment #9 from luoxhu at gcc dot gnu.org ---
I have a testcase ICE at:

external/com_google_protobuf/src/google/protobuf/message_lite.h:515:68:
internal compiler error: Segmentation fault
0xde2816 crash_signal
        ../../gcc/toplev.c:328
0xe82370 copy_bb
        ../../gcc/tree-inline.c:2204
0xe84afa copy_cfg_body
        ../../gcc/tree-inline.c:3022
0xe855ea copy_body
        ../../gcc/tree-inline.c:3270
0xe8945b expand_call_inline
        ../../gcc/tree-inline.c:5061
0xe8a055 gimple_expand_calls_inline
        ../../gcc/tree-inline.c:5251
0xe8a831 optimize_inline_calls(tree_node*)
        ../../gcc/tree-inline.c:5424
0xb976ea inline_transform(cgraph_node*)
        ../../gcc/ipa-inline-transform.c:736
0xd1a147 execute_one_ipa_transform_pass
        ../../gcc/passes.c:2233
0xd1a2a1 execute_all_ipa_transforms(bool)
        ../../gcc/passes.c:2272
0x901809 cgraph_node::expand()
        ../../gcc/cgraphunit.c:2293
0x901e4a expand_all_functions
        ../../gcc/cgraphunit.c:2471
0x9028dd symbol_table::compile()
        ../../gcc/cgraphunit.c:2822
0x834fbc lto_main()
        ../../gcc/lto/lto.c:653


tree-inline.c:2204

2204:    cgraph_edge *indirect = old_edge->speculative_call_indirect_edge ();
2205:    profile_count indir_cnt = indirect->count;

the returned indirect is 0 caused assert on 2205.



(gdb) p old_edge->caller->debug()
_ZNK6google8protobuf11MessageLite23IsInitializedWithErrorsEv/15805768
(IsInitializedWithErrors) @0x7ffff6d44438
  Type: function definition analyzed
  Visibility: external public visibility_specified visibility:hidden
  References: _ZNK4trpc15RequestProtocol13IsInitializedEv/15470318 (addr)
(speculative)
  Referring:
  Function IsInitializedWithErrors/15805768 is inline copy in
OnExtendedInfosReceive/3878638
  Availability: local
  Unit id: 1201
  Function flags: count:26415 (adjusted) first_run:577 body local hot
  Called by:
_ZN7yottadb2ds18BoundedReadWatcher22OnExtendedInfosReceiveERKSs/3878638
(inlined) (26415 (adjusted),1.00
per call) (can throw external)
  Calls:
_ZNK6google8protobuf11MessageLite29LogInitializationErrorMessageEv/15806151 (0
(guessed),0.00 per call) (can
throw external)
_ZNK7yottadb2ds28AppendLogRequestExtendedInfo13IsInitializedEv.constprop.0/16350633
(speculative) (inl
ined) (12547 (adjusted),0.47 per call) (can throw external)
_ZNK7yottadb2ds28AppendLogRequestExtendedInfo13IsInitializ
edEv.constprop.0/16375492 (inlined) (indirect_inlining) (13868 (adjusted),0.52
per call) (can throw external)
$84 = void
(gdb) p old_edge->callee->debug()
_ZNK7yottadb2ds28AppendLogRequestExtendedInfo13IsInitializedEv.constprop.0/16350633
(IsInitialized.constprop) @0x7ffff
6d44b40
  Type: function definition analyzed
  Visibility: artificial
  References:
  Referring:
  Read from file: db_server.ltrans32.o
  Function IsInitialized.constprop/16350633 is inline copy in
OnExtendedInfosReceive/3878638
  Availability: local
  Unit id: 116
  Function flags: count:12547 (adjusted) first_run:8235 body local icf_merged
nonfreeing_fn
  Called by:
_ZNK6google8protobuf11MessageLite23IsInitializedWithErrorsEv/15805768
(speculative) (inlined) (12547 (adj
usted),0.47 per call) (can throw external)
  Calls:


In wpa.079i.inline, it has TWO *polymorphic indirect call* speculative targets,
I wrote a case like it but passed.

_ZNK6google8protobuf11MessageLite23IsInitializedWithErrorsEv/15805768
(IsInitializedWithErrors) @0x7efdc479a2d0
  Type: function definition analyzed
  Visibility: prevailing_def_ironly
  previous sharing asm name: 16375490
  References: _ZNK4trpc15RequestProtocol13IsInitializedEv/15470318 (addr)
(speculative) _ZNK7yottadb3rpc17RunCommandRequest13IsInitializedEv/9954194
(addr) (speculative)
  Referring:
  Read from file:
bazel-out/k8-dbg/bin/external/com_google_protobuf/libprotobuf_lite.a
  Availability: local
  Profile id: 19598949
  Unit id: 1200
  Function flags: count:1072 (adjusted) first_run:577 local
  Called by:
_ZN6google8protobuf11MessageLite9ParseFromILNS1_10ParseFlagsE1ESsEEbRKT0_/16456195
(1824663 (estimated locally),0.00 per call) (can throw external)
_ZN6google8protobuf11MessageLite9ParseFromILNS1_10ParseFlagsE1EPNS0_2io19ZeroCopyInputStreamEEEbRKT0_/15806727
(14 (adjusted),1.00 per call) (can throw external)
_ZN6google8protobuf11MessageLite9ParseFromILNS1_10ParseFlagsE1ESsEEbRKT0_/15806733
(1006 (adjusted),1.00 per call) (can throw external)
_ZN6google8protobuf11MessageLite9ParseFromILNS1_10ParseFlagsE1ENS0_11StringPieceEEEbRKT0_/15806735
(52 (precise),1.00 per call) (can throw external)
  Calls:
_ZNK7yottadb2ds28AppendLogRequestExtendedInfo13IsInitializedEv.constprop.0/16365519
(speculative) (inlined) (456 (adjusted),0.43 per call) (can throw external)
_ZNK7yottadb2ds28AppendLogRequestExtendedInfo13IsInitializedEv.constprop.0/16365518
(speculative) (inlined) (509 (adjusted),0.47 per call) (can throw external)
_ZNK6google8protobuf11MessageLite29LogInitializationErrorMessageEv/15806151 (0
(guessed),0.00 per call) (can throw external)
   Polymorphic indirect call of type const struct MessageLite
token:8(speculative) (106 (adjusted),0.10 per call) (can throw external)  of
param:0 Num speculative call targets: 2
    Outer type (dynamic):struct MessageLite (or a derived type) offset 0


The only other difference is IsInitialized.constprop is *indirect_inlining*
into caller, it seems NOT easy to reduce protobuf to a small case, any clue to
fix it? Thanks.
@Honza