[Bug lto/96291] New: -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[Bug lto/96291] New: -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[slyfox at inbox dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

            Bug ID: 96291
           Summary: -flto fails as "internal compiler error: Segmentation
                    fault" during IPA pass: cp
                    incall_for_symbol_thunks_and_aliases()
           Product: gcc
           Version: 10.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: lto
          Assignee: unassigned at gcc dot gnu.org
          Reporter: slyfox at inbox dot ru
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

Originally reported by Gabriel Marcano as https://bugs.gentoo.org/733482 where
radare-4.5.0 ICEs gcc if that is built with -flto.

ICE is reproducible on both gcc-10 and gcc-11. Here is the minimal(ish)
reproducer:

// cat sdb.c
  int b;
  void a();
  void sdb_ns_free();
  void c(int d) {
    sdb_ns_free();
    a(b, 0);
  }
  void sdb_free() { c(0); }

// cat ns.c
  void sdb_free();
  void sdb_ns_free() { sdb_free(); }

// cat main.c
  void sdb_free();
  void a() { sdb_free(); }

$ x86_64-pc-linux-gnu-gcc -c -O2 -flto -o sdb.o sdb.c
$ x86_64-pc-linux-gnu-gcc -c -O2 -flto -o ns.o ns.c
$ x86_64-pc-linux-gnu-gcc -c -O2 -flto -O0 -o main.o main.c
$+ x86_64-pc-linux-gnu-gcc -O2 -flto -o sdb main.o sdb.o ns.o
during IPA pass: cp
lto1: internal compiler error: Segmentation fault
0xa6d3df crash_signal
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/toplev.c:328
0x7f1656e35c3f ???
       
/usr/src/debug/sys-libs/glibc-2.31-r6/glibc-2.31/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x5d4751 has_undead_caller_from_outside_scc_p
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/ipa-cp.c:5670
0x680054 cgraph_node::call_for_symbol_thunks_and_aliases(bool (*)(cgraph_node*,
void*), void*, bool, bool)
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/cgraph.c:2450
0x12fe86d identify_dead_nodes
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/ipa-cp.c:5687
0x12fe86d ipcp_decision_stage
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/ipa-cp.c:5730
0x12fe86d ipcp_driver
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/ipa-cp.c:5908
0x12fe86d execute
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/ipa-cp.c:5999
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
lto-wrapper: fatal error: /usr/bin/x86_64-pc-linux-gnu-gcc returned 1 exit
status
compilation terminated.
/usr/lib/gcc/x86_64-pc-linux-gnu/11.0.0/../../../../x86_64-pc-linux-gnu/bin/ld:
error: lto-wrapper failed
collect2: error: ld returned 1 exit status

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org
   Target Milestone|---                         |10.3
            Summary|-flto fails as "internal    |[10/11 Regression] -flto
                   |compiler error:             |fails as "internal compiler
                   |Segmentation fault" during  |error: Segmentation fault"
                   |IPA pass: cp                |during IPA pass: cp
                   |incall_for_symbol_thunks_an |incall_for_symbol_thunks_an
                   |d_aliases()                 |d_aliases()

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-07-23
                 CC|                            |hubicka at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed. With checking enabled WPA is stuck staging from:

  r8-1894-g29f1e2b173f1701b(07 Jul 2017 13:28)(hubicka@ucw.cz): [took: 1.445s]
result: FAILED (124)
ipa-comdats.c: Remove optimize check from gate.


        * ipa-comdats.c: Remove optimize check from gate.
        * ipa-fnsummary.c (ipa_fn_summary_generate): do not generate summary
        for functions not optimized.
        (ipa_fn_summary_read): Skip optimize check.
        (ipa_fn_summary_write): Likewise.
        * ipa-inline-analysis.c (do_estimate_growth_1): Check that caller
        is optimized.
        * ipa-inline.c (can_inline_edge_p): Not optimized functions are
        uninlinable.
        (can_inline_edge_p): Check flag_pcc_struct_return for match.
        (check_callers): Give up on caller which is not optimized.
        (inline_small_functions): Likewise.
        (ipa_inline): Do not give up when not optimizing.
        * ipa-visbility.c (function_and_variable_visibility): Do not optimize
        away unoptimizes cdtors.
        (whole_program_function_and_variable_visibility): Do
        ipa_discover_readonly_nonaddressable_vars in LTO mode.
        * ipa.c (process_references): Do not check optimize.
        (symbol_table::remove_unreachable_nodes): Update optimize check.
        (set_writeonly_bit): Update optimize check.
        (pass_ipa_cdtor_merge::gate): Do not check optimize.
        (pass_ipa_single_use::gate): Remove.

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org

--- Comment #2 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I guess I should take a look

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[romain.geissler at amadeus dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

Romain Geissler <romain.geissler at amadeus dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |romain.geissler at amadeus dot com

--- Comment #3 from Romain Geissler <romain.geissler at amadeus dot com> ---
Hi,

FYI, I just tried to build Protobuf 3.12.3 with the trunk from a few days ago,
using "-flto" and I experience similar ICE:

[2020-07-24T12:16:07.637Z]   CXXLD    protobuf-lite-test
[2020-07-24T12:16:10.993Z] during IPA pass: cp
[2020-07-24T12:16:10.993Z] lto1: internal compiler error: Segmentation fault
[2020-07-24T12:16:15.263Z] 0x9e42da crash_signal
[2020-07-24T12:16:15.263Z]      /workdir/src/gcc-11.0.0/gcc/toplev.c:328
[2020-07-24T12:16:15.263Z] 0xfe6b04 has_undead_caller_from_outside_scc_p
[2020-07-24T12:16:15.263Z]      /workdir/src/gcc-11.0.0/gcc/ipa-cp.c:5670
[2020-07-24T12:16:15.263Z] 0xf042c0
cgraph_node::call_for_symbol_thunks_and_aliases(bool (*)(cgraph_node*, void*),
void*, bool, bool)
[2020-07-24T12:16:15.263Z]      /workdir/src/gcc-11.0.0/gcc/cgraph.c:2450
[2020-07-24T12:16:15.263Z] 0x13130bc identify_dead_nodes
[2020-07-24T12:16:15.263Z]      /workdir/src/gcc-11.0.0/gcc/ipa-cp.c:5687
[2020-07-24T12:16:15.263Z] 0x13130bc ipcp_decision_stage
[2020-07-24T12:16:15.263Z]      /workdir/src/gcc-11.0.0/gcc/ipa-cp.c:5730
[2020-07-24T12:16:15.263Z] 0x13130bc ipcp_driver
[2020-07-24T12:16:15.263Z]      /workdir/src/gcc-11.0.0/gcc/ipa-cp.c:5908
[2020-07-24T12:16:15.263Z] 0x13130bc execute
[2020-07-24T12:16:15.263Z]      /workdir/src/gcc-11.0.0/gcc/ipa-cp.c:5999
[2020-07-24T12:16:15.263Z] Please submit a full bug report,
[2020-07-24T12:16:15.263Z] with preprocessed source if appropriate.
[2020-07-24T12:16:15.263Z] Please include the complete backtrace with any bug
report.
[2020-07-24T12:16:15.263Z] See <https://gcc.gnu.org/bugs/> for instructions.
[2020-07-24T12:16:15.263Z]   CXXLD    protobuf-lite-arena-test
[2020-07-24T12:16:15.263Z] lto-wrapper: fatal error: g++ returned 1 exit status
[2020-07-24T12:16:15.263Z] compilation terminated.

If you have a patch, I can try to test it as well on this Protobuf case.

Cheers,
Romain

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[slyfox at inbox dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

--- Comment #4 from Sergei Trofimovich <slyfox at inbox dot ru> ---
Peeking at the crash:
"""
Program received signal SIGSEGV, Segmentation fault.
0x0000000001ca0fed in has_undead_caller_from_outside_scc_p
(node=0x7ffff7670438, data=0x0) at ../../gcc/gcc/ipa-cp.c:5670
5670                 && !IPA_NODE_REF (cs->caller)->node_dead)
(gdb) list
5665        if (cs->caller->thunk.thunk_p
5666            && cs->caller->call_for_symbol_thunks_and_aliases
5667              (has_undead_caller_from_outside_scc_p, NULL, true))
5668          return true;
5669        else if (!ipa_edge_within_scc (cs)
5670                 && !IPA_NODE_REF (cs->caller)->node_dead)
5671          return true;
5672      return false;
5673    }
5674

(gdb) print IPA_NODE_REF(cs->caller)
$1 = (ipa_node_params *) 0x0
"""

Is it an expected invariant? Looks like most of code does not expect NULL
there:

$ git grep IPA_NODE_REF | fgrep NULL
gcc/ipa-prop.c:   && IPA_NODE_REF (node) != NULL)
gcc/ipa-prop.c:   && IPA_NODE_REF (node) != NULL)

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[slyfox at inbox dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

--- Comment #5 from Sergei Trofimovich <slyfox at inbox dot ru> ---
I shrunk example to "single-file" (almost) example to ease local tweaking:

$ cat 1file.c
  void e(void);
  void f(void);
  void a(int, int);
  void c(int);
  #ifdef COMPILE_F1
  int b;
  void c(int d) {
    f();
    a(b, 0);
  }
  void e(void) { c(0); }
  #endif
  #ifdef COMPILE_F2
  void f(void) { c(0); }
  #endif
  #ifdef COMPILE_F3
  void a(int a1, int a2) { e(); }
  #endif

$ x86_64-pc-linux-gnu-gcc -c -O2 -flto -o f1.o 1file.c -DCOMPILE_F1
$ x86_64-pc-linux-gnu-gcc -c -O2 -flto -o f2.o 1file.c -DCOMPILE_F2
$ x86_64-pc-linux-gnu-gcc -c -O2 -flto -O0 -o f3.o 1file.c -DCOMPILE_F3
$ x86_64-pc-linux-gnu-gcc -O2 -flto -o sdb f1.o f2.o f3.o
during IPA pass: cp
lto1: internal compiler error: Segmentation fault

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[slyfox at inbox dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

--- Comment #6 from Sergei Trofimovich <slyfox at inbox dot ru> ---
-fdump-ipa-all-all generates sdb.wpa.076i.cp that says f() has no jump
functions:

"""
Jump functions:
  Jump functions of caller  main/9:
  Jump functions of caller  a/8:
    callsite  a/8 -> e/2 :
       no arg info
  Jump functions of caller  f/6:
  Jump functions of caller  e/2:
    callsite  e/2 -> c/1 :
       param 0: CONST: 0
         value: 0x0, mask: 0x0
         Unknown VR
  Jump functions of caller  c/1:
    callsite  c/1 -> a/8 :
       param 0: UNKNOWN
         value: 0x0, mask: 0xffffffffffffffff
         Unknown VR
       param 1: UNKNOWN
         value: 0x0, mask: 0xffffffffffffffff
         Unknown VR
    callsite  c/1 -> f/6 :
       no arg info
"""

Is it expected?

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[slyfox at inbox dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

--- Comment #7 from Sergei Trofimovich <slyfox at inbox dot ru> ---
(In reply to Sergei Trofimovich from comment #6)
> -fdump-ipa-all-all generates sdb.wpa.076i.cp that says f() has no jump
> functions:
> ...
> Is it expected?

print_all_lattices() suggests it is expected for unoptimized cases to have no
IPA info:

"""
      info = IPA_NODE_REF (node);
      /* Skip unoptimized functions and constprop clones since we don't make
         lattices for them.  */
      if (!info || info->ipcp_orig_node)
        continue;
"""

The crash happens when analysing a()->e() edge. But a() was compiled with -flto
-O0 and thus has no IPA fnsummary.

Proposed patch: https://gcc.gnu.org/pipermail/gcc-patches/2020-July/550667.html

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|jamborm at gcc dot gnu.org         |slyfox at inbox dot ru

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Sergei's patch is correct (I just suggested to write the condition
differently).

[Bug ipa/96291] [10/11 Regression] -flto fails as "internal compiler error: Segmentation fault" during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Sergei Trofimovich <slyfox@gcc.gnu.org>:

https://gcc.gnu.org/g:cbf10ac51c0b889e930f260a3d1fb601332befdf

commit r11-2391-gcbf10ac51c0b889e930f260a3d1fb601332befdf
Author: Sergei Trofimovich <siarheit@google.com>
Date:   Sat Jul 25 19:26:50 2020 +0100

    ipa/96291: don't crash on unoptimized lto functions

    In PR ipa/96291 the test contained an SCC with one
    unoptimized function. This tricked ipa-cp into NULL dereference.

    has_undead_caller_from_outside_scc_p() did not take into account
    that unoptimized funtions don't have IPA summary analysis. And
    dereferenced NULL pointer causing an ICE.

    gcc/
            PR ipa/96291
            * ipa-cp.c (has_undead_caller_from_outside_scc_p): Consider
            unoptimized callers as undead.

    gcc/testsuite/
            PR ipa/96291
            * gcc.dg/lto/pr96291_0.c: New testcase.
            * gcc.dg/lto/pr96291_1.c: Support file.
            * gcc.dg/lto/pr96291_2.c: Likewise.
            * gcc.dg/lto/pr96291.h: Likewise.

[Bug ipa/96291] [10 Regression] -flto fails as ICE during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|slyfox at inbox dot ru             |marxin at gcc dot gnu.org
      Known to fail|                            |10.2.1
            Summary|[10/11 Regression] -flto    |[10 Regression] -flto fails
                   |fails as "internal compiler |as ICE during IPA pass: cp
                   |error: Segmentation fault"  |incall_for_symbol_thunks_an
                   |during IPA pass: cp         |d_aliases()
                   |incall_for_symbol_thunks_an |
                   |d_aliases()                 |
      Known to work|                            |11.0

--- Comment #10 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed on master, I'm doing backport to gcc-10 branch right now.

[Bug ipa/96291] [10 Regression] -flto fails as ICE during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Martin Liska
<marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:18c81c8a780758ea596c530321ef5e7459b3d16f

commit r10-8613-g18c81c8a780758ea596c530321ef5e7459b3d16f
Author: Sergei Trofimovich <siarheit@google.com>
Date:   Sat Jul 25 19:26:50 2020 +0100

    ipa/96291: don't crash on unoptimized lto functions

    In PR ipa/96291 the test contained an SCC with one
    unoptimized function. This tricked ipa-cp into NULL dereference.

    has_undead_caller_from_outside_scc_p() did not take into account
    that unoptimized funtions don't have IPA summary analysis. And
    dereferenced NULL pointer causing an ICE.

    gcc/
            PR ipa/96291
            * ipa-cp.c (has_undead_caller_from_outside_scc_p): Consider
            unoptimized callers as undead.

    gcc/testsuite/
            PR ipa/96291
            * gcc.dg/lto/pr96291_0.c: New testcase.
            * gcc.dg/lto/pr96291_1.c: Support file.
            * gcc.dg/lto/pr96291_2.c: Likewise.
            * gcc.dg/lto/pr96291.h: Likewise.

    (cherry picked from commit cbf10ac51c0b889e930f260a3d1fb601332befdf)

[Bug ipa/96291] [10 Regression] -flto fails as ICE during IPA pass: cp incall_for_symbol_thunks_and_aliases()

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96291

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #12 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed on all active branches.