[Bug ipa/96059] New: ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[Bug ipa/96059] New: ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[krzysztof.a.nowicki+gcc at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

            Bug ID: 96059
           Summary: ICE: in remove_unreachable_nodes, at ipa.c:575 with
                    -fdevirtualize-at-ltrans
           Product: gcc
           Version: 10.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: krzysztof.a.nowicki+gcc at gmail dot com
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

When building the ktexteditor-5.71 from the KDE Frameworks with LTO enabled I'm
seeing an ICE when linking libKF5TextEditor.so:

during IPA pass: inline
lto1: internal compiler error: in remove_unreachable_nodes, at ipa.c:575
0xa7e802 symbol_table::remove_unreachable_nodes(_IO_FILE*)
        /var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/ipa.c:575
0x19cb14f ipa_inline
       
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/ipa-inline.c:2696
0x19cb702 execute
       
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/ipa-inline.c:3091
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.

GDB backtrace:

#0  internal_error (gmsgid=gmsgid@entry=0x233d39a "in %s, at %s:%d") at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/diagnostic.c:1706
#1  0x0000000001b09d9a in fancy_abort (file=file@entry=0x1c07468
"/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/ipa.c",
line=line@entry=575, function=function@entry=0x1c073fc
"remove_unreachable_nodes")
    at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/diagnostic.c:1778
#2  0x0000000000a7e803 in symbol_table::remove_unreachable_nodes
(this=0x7ffff6e8d100, file=0x0) at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/ipa.c:577
#3  0x00000000019cb150 in ipa_inline () at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/ipa-inline.c:2696
#4  0x00000000019cb703 in (anonymous namespace)::pass_ipa_inline::execute
(this=<optimized out>) at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/ipa-inline.c:3091
#5  0x0000000000c047a3 in execute_one_pass (pass=pass@entry=0x3edc4a0) at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/passes.c:2502
#6  0x0000000000c06052 in execute_ipa_pass_list (pass=0x3edc4a0) at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/passes.c:2929
#7  0x00000000006442ac in do_whole_program_analysis () at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/context.h:48
#8  0x00000000006445f7 in lto_main () at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/lto/lto.c:637
#9  0x0000000000d1844d in compile_file () at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/toplev.c:458
#10 0x0000000000d1b891 in do_compile () at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/toplev.c:2277
#11 0x0000000000d1c1fd in toplev::main (this=this@entry=0x7fffffffd7f6,
argc=<optimized out>, argc@entry=36, argv=<optimized out>,
argv@entry=0x7fffffffd8f8) at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/toplev.c:2416
#12 0x0000000001ae9eeb in main (argc=36, argv=0x7fffffffd8f8) at
/var/tmp/portage/sys-devel/gcc-10.1.0-r1/work/gcc-10.1.0/gcc/main.c:39

CXXFLAGS: -O2 -pipe -march=skylake -flto=3 -fgraphite-identity
-floop-nest-optimize -fdevirtualize-at-ltrans -fipa-pta
-fno-semantic-interposition

The ICE goes away after removing the -fdevirtualize-at-ltrans flag.

The backtrace above was generated from Gentoo-patched version of GCC, but it's
also reproducible with a vanilla version compiled directly from sources.

This is a regression since GCC 10 (reproducible also with latest GCC 11 trunk),
as GCC 9 compiles this package with the same CXXFLAGS without issues.

I've bisected the regression to the following commit:

commit 2bc2379be5c98d34ecbb347b2abf059aa6d94499
Author: Jan Hubicka <jh@suse.cz>
Date:   Mon Nov 4 20:39:52 2019 +0100

    ipa-inline-transform.c: Include ipa-utils.h


            * ipa-inline-transform.c: Include ipa-utils.h
            (inline_call): Set thunk_expansion flag.
            * ipa-utils.h (thunk_expansion): Declare.
            * ipa-devirt.c (thunk_expansion): New global var.
            (devirt_node_removal_hook): Do not invalidate cache while
            doing thunk expansion.

    From-SVN: r277789

Maybe the "HACK alert" in the commit diff has something to do with it :)

[Bug ipa/96059] ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-07-07
             Status|UNCONFIRMED                 |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed, I can reproduce that I'm reducing that right now..

[Bug ipa/96059] ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48841
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48841&action=edit
Reduced test-case

$ g++ -O2 -flto=auto -fdevirtualize-at-ltrans -fvisibility=hidden
-fvisibility-inlines-hidden -fPIC *.ii
...
during IPA pass: inline
lto1: internal compiler error: in remove_unreachable_nodes, at ipa.c:575
0x5cb461 symbol_table::remove_unreachable_nodes(_IO_FILE*)
        ../../gcc/ipa.c:575
0x12a7597 ipa_inline
        ../../gcc/ipa-inline.c:2696
0x12a7597 execute
        ../../gcc/ipa-inline.c:3091
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
lto-wrapper: fatal error: g++ returned 1 exit status
compilation terminated.
/usr/bin/ld: error: lto-wrapper failed
collect2: error: ld returned 1 exit status

[Bug ipa/96059] ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have summarized some observations in 
https://gcc.gnu.org/pipermail/gcc/2023-March/240887.html

[Bug ipa/96059] ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
...and Honza correctly guessed that it is ICF that merges the two functions
(virtual and non-virtual) and that is how we ended up in the situation that the
devirtualizing machinery returns a non-virtual function cgraph_node.

[Bug ipa/96059] ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

--- Comment #5 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Which means that the following (untested) patch might be the correct fix:

diff --git a/gcc/ipa.cc b/gcc/ipa.cc
index 5c15b60a603..c2d94163dc2 100644
--- a/gcc/ipa.cc
+++ b/gcc/ipa.cc
@@ -199,6 +199,11 @@ walk_polymorphic_call_targets (hash_set<void *>
*reachable_call_targets,
          n->indirect_call_target = true;
          symtab_node *body = n->function_symbol ();

+         /* We have already decided that an offlie copy which could be a
+            target of a virtual call is not necessary.  */
+         if (n->inlined_to)
+           continue;
+         
          /* Prior inlining, keep alive bodies of possible targets for
             devirtualization.  */
          if (n->definition

[Bug ipa/96059] ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|59859                       |
           See Also|                            |https://bugs.gentoo.org/sho
                   |                            |w_bug.cgi?id=900146

--- Comment #6 from Sam James <sjames at gcc dot gnu.org> ---
Actually, let me drop the PR59859 blocker, as IIRC we've had reports of this
downstream w/o graphite.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59859
[Bug 59859] [meta-bug] GRAPHITE issues

[Bug ipa/96059] ICE: in remove_unreachable_nodes, at ipa.c:575 with -fdevirtualize-at-ltrans

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96059

--- Comment #7 from Jan Hubicka <hubicka at ucw dot cz> ---
> Actually, let me drop the PR59859 blocker, as IIRC we've had reports of this
> downstream w/o graphite.
I think you edited wrong PR here.