[Bug c++/94250] New: valgrind error for ./g++.dg/ipa/remref-1.C

[Bug c++/94250] New: valgrind error for ./g++.dg/ipa/remref-1.C

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

            Bug ID: 94250
           Summary: valgrind error for ./g++.dg/ipa/remref-1.C
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

For testsuite file ./g++.dg/ipa/remref-1.C, compiled by recent trunk
in a valgrind version and compiler flag -O2, does this:

==1825381== Invalid read of size 2
==1825381==    at 0x853A7C: symtab_node::clone_reference(ipa_ref*, gimple*)
(symtab.c:712)
==1825381==    by 0xA4F665: ipa_edge_args_sum_t::duplicate(cgraph_edge*,
cgraph_edge*, ipa_edge_args*, ipa_edge_args*) (ipa-prop.c:4226)
==1825381==    by 0xA58061:
call_summary<ipa_edge_args*>::symtab_duplication(cgraph_edge*, cgraph_edge*,
void*) (symbol-summary.h:737)
==1825381==    by 0x85CBD3: call_edge_duplication_hooks (cgraph.c:450)

[Bug c++/94250] valgrind error for ./g++.dg/ipa/remref-1.C

[xerofoify at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

Nicholas Krause <xerofoify at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mliska at suse dot cz,
                   |                            |xerofoify at gmail dot com

--- Comment #1 from Nicholas Krause <xerofoify at gmail dot com> ---
After looking through the git history that last time this functions in your
trace were changed is by commit id,
db30281f0b2ff6dfc0c4146291baf020a27e4065. Martin Liska  was the original
committer so he should comment on this.
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=db30281f0b2ff6dfc0c4146291baf020a27e4065

However this was changed:
summary->duplicate (edge1, edge2, edge1_summary,
                  summary->get_create (edge2));

[Bug c++/94250] valgrind error for ./g++.dg/ipa/remref-1.C

[xerofoify at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

--- Comment #2 from Nicholas Krause <xerofoify at gmail dot com> ---
(In reply to Nicholas Krause from comment #1)
> After looking through the git history that last time this functions in your
> trace were changed is by commit id,
> db30281f0b2ff6dfc0c4146291baf020a27e4065. Martin Liska  was the original
> committer so he should comment on this.
> https://gcc.gnu.org/git/?p=gcc.git;a=commit;
> h=db30281f0b2ff6dfc0c4146291baf020a27e4065
> 
> However this was changed:
> summary->duplicate (edge1, edge2, edge1_summary,
>                   summary->get_create (edge2));

and it appears to be assuming based on the above lines:
if (summary->m_initialize_when_cloning)
 edge1_summary = summary->get_create (edge1);
else
 edge1_summary = summary->get (edge1);

That this can never occur for edge2. Martin is edge2 assumed to be good by this
comment?

[Bug c++/94250] valgrind error for ./g++.dg/ipa/remref-1.C

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-03-21
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
A nice catch David! I've got a patch for it.

[Bug ipa/94250] [10 Regression] ]valgrind error for ./g++.dg/ipa/remref-1.C

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.0
          Component|c++                         |ipa
            Summary|valgrind error for          |[10 Regression] ]valgrind
                   |./g++.dg/ipa/remref-1.C     |error for
                   |                            |./g++.dg/ipa/remref-1.C

[Bug ipa/94250] [10 Regression] valgrind error for ./g++.dg/ipa/remref-1.C

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Martin Liška from comment #3)
> A nice catch David! I've got a patch for it.

Thanks. I should also perhaps mention that testsuite file
./g++.dg/ipa/remref-2.C has the same problem. It would be
wise to ensure your patch fixes both.

[Bug ipa/94250] [10 Regression] valgrind error for ./g++.dg/ipa/remref-1.C

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to David Binderman from comment #4)
> (In reply to Martin Liška from comment #3)
> > A nice catch David! I've got a patch for it.
> 
> Thanks. I should also perhaps mention that testsuite file
> ./g++.dg/ipa/remref-2.C has the same problem. It would be
> wise to ensure your patch fixes both.

Yes, the patch covers both files. It's quite clear goes wrong there.

[Bug ipa/94250] [10 Regression] valgrind error for ./g++.dg/ipa/remref-1.C

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Liska <marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:2fa4b1ffd6e4058e53b3a486494b00098ee1bf63

commit r10-7327-g2fa4b1ffd6e4058e53b3a486494b00098ee1bf63
Author: Martin Liska <mliska@suse.cz>
Date:   Mon Mar 23 08:57:06 2020 +0100

    Save ref->speculative_id before clone_reference.

            PR ipa/94250
            * symtab.c (symtab_node::clone_references): Save speculative_id
            as ref may be overwritten by create_reference.
            (symtab_node::clone_referring): Likewise.
            (symtab_node::clone_reference): Likewise.

[Bug ipa/94250] [10 Regression] valgrind error for ./g++.dg/ipa/remref-1.C

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94250

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed.