[Bug gcov-profile/97461] [11 Regression] allocate_gcov_kvp() deadlocks in firefox LTO+PGO build (overridden malloc() recursion)

["slyfox at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97461

--- Comment #20 from Sergei Trofimovich <slyfox at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #17)
> Or I may have a smarter trick: let's do dry run of malloc/free functions
> early in __gcov_init. Can you please test the patch as well?
> 
> commit d80cecdb87d159f0b3a4072b6e1ef80515ad2afb
> Author: Martin Liska <mliska@suse.cz>
> Date:   Thu Oct 29 19:52:37 2020 +0100
> 
>     PGO: use dry run of malloc and free functions.
> 
> diff --git a/libgcc/libgcov-driver.c b/libgcc/libgcov-driver.c
> index e53e4dc392a..dd481b48e22 100644
> --- a/libgcc/libgcov-driver.c
> +++ b/libgcc/libgcov-driver.c
> @@ -608,12 +608,25 @@ __gcov_exit (void)
>    gcov_error_exit ();
>  }
>  
> +/* Test memory that forces malloc and free functions to be called early
> +   so that allocate_gcov_kvp can use calloc.  Indirect call counters
> +   taken from a pre-allocated array are used before that.  */
> +char *__gcov_test_memory;
> +
>  /* Add a new object file onto the bb chain.  Invoked automatically
>    when running an object file's global ctors.  */
>  
>  void
>  __gcov_init (struct gcov_info *info)
>  {
> +  static int malloc_utilized = 0;
> +  if (!malloc_utilized)
> +    {
> +      __gcov_test_memory  = malloc (16);
> +      free (__gcov_test_memory);
> +      malloc_utilized = 1;
> +    }
> +
>    if (!info->version || !info->n_functions)
>      return;
>    if (gcov_version (info, info->version, 0))

Did not seem to help (I only applied the patch, did not bump
GCOV_PREALLOCATED_KVP 64 to 128). The backtrace of new deadlock:

(gdb) bt
#0  __lll_lock_wait (futex=0x7eff76800018, private=0) at lowlevellock.c:52
#1  0x00007eff76f5f305 in __GI___pthread_mutex_lock (mutex=0x7eff76800018) at
../nptl/pthread_mutex_lock.c:135
#2  0x0000563beb0fd171 in arena_t::MallocSmall(unsigned long, bool) ()
#3  0x0000563beb0fe09c in arena_t::Malloc(unsigned long, bool) ()
#4  0x0000563beb0ff212 in calloc ()
#5  0x0000563beb1efa5b in allocate_gcov_kvp () at
/var/tmp/portage/sys-devel/gcc-11.0.0_pre9999/work/gcc-11.0.0_pre9999/libgcc/libgcov.h:431
#6  gcov_topn_add_value (count=1, use_atomic=1, increment_total=1, value=496,
counters=0x563beb2608c0
<__gcov3._ZL20arena_run_reg_dallocP11arena_run_tP11arena_bin_tPvm>)
    at
/var/tmp/portage/sys-devel/gcc-11.0.0_pre9999/work/gcc-11.0.0_pre9999/libgcc/libgcov.h:477
#7  __gcov_topn_values_profiler_body (use_atomic=1, value=496,
counters=0x563beb2608c0
<__gcov3._ZL20arena_run_reg_dallocP11arena_run_tP11arena_bin_tPvm>)
    at
/var/tmp/portage/sys-devel/gcc-11.0.0_pre9999/work/gcc-11.0.0_pre9999/libgcc/libgcov-profiler.c:103
#8  __gcov_topn_values_profiler_atomic (counters=0x563beb2608c0
<__gcov3._ZL20arena_run_reg_dallocP11arena_run_tP11arena_bin_tPvm>, value=496)
    at
/var/tmp/portage/sys-devel/gcc-11.0.0_pre9999/work/gcc-11.0.0_pre9999/libgcc/libgcov-profiler.c:128
#9  0x0000563beb0fc085 in arena_t::DallocSmall(arena_chunk_t*, void*,
arena_chunk_map_t*) ()
#10 0x0000563beb0fc68c in free ()
#11 0x00007eff59e73047 in driConcatConfigs () at /usr/lib64/dri/swrast_dri.so
#12 0x00007eff599f6714 in dri_init_screen_helper () at
/usr/lib64/dri/swrast_dri.so
#13 0x00007eff599efe63 in drisw_init_screen () at /usr/lib64/dri/swrast_dri.so
#14 0x00007eff59e73c15 in driCreateNewScreen2 () at
/usr/lib64/dri/swrast_dri.so
#15 0x00007eff5a536c44 in driswCreateScreen () at /usr/lib64/libGLX_mesa.so.0
#16 0x00007eff5a53ce10 in __glXInitialize () at /usr/lib64/libGLX_mesa.so.0
#17 0x00007eff5a539371 in glXQueryServerString () at
/usr/lib64/libGLX_mesa.so.0
#18 0x00007eff74f82b79 in epoxy_glx_version () at /usr/lib64/libepoxy.so.0
#19 0x00007eff75373645 in gdk_x11_screen_init_gl () at /usr/lib64/libgdk-3.so.0
#20 0x00007eff753739ea in _gdk_x11_screen_update_visuals_for_gl () at
/usr/lib64/libgdk-3.so.0
#21 0x00007eff7537c9d8 in _gdk_x11_screen_init_visuals () at
/usr/lib64/libgdk-3.so.0
#22 0x00007eff753799ab in _gdk_x11_screen_new () at /usr/lib64/libgdk-3.so.0
#23 0x00007eff75369450 in _gdk_x11_display_open () at /usr/lib64/libgdk-3.so.0
#24 0x00007eff7533b8c8 in gdk_display_manager_open_display () at
/usr/lib64/libgdk-3.so.0
#25 0x00007eff697ad710 in XREMain::XRE_mainStartup(bool*) () at
/home/slyfox/tmp/portage/www-client/firefox-82.0/work/firefox_build/instrumented/dist/firefox/libxul.so
#26 0x00007eff697b2bd5 in XREMain::XRE_main(int, char**,
mozilla::BootstrapConfig const&) ()
    at
/home/slyfox/tmp/portage/www-client/firefox-82.0/work/firefox_build/instrumented/dist/firefox/libxul.so
#27 0x00007eff697b3bf3 in XRE_main(int, char**, mozilla::BootstrapConfig
const&) () at
/home/slyfox/tmp/portage/www-client/firefox-82.0/work/firefox_build/instrumented/dist/firefox/libxul.so
#28 0x00007eff697bc280 in mozilla::BootstrapImpl::XRE_main(int, char**,
mozilla::BootstrapConfig const&) ()
    at
/home/slyfox/tmp/portage/www-client/firefox-82.0/work/firefox_build/instrumented/dist/firefox/libxul.so
#29 0x0000563beb0e53a0 in do_main(int, char**, char**) ()
#30 0x0000563beb0e30d1 in main ()

I suspect that this custom malloc hits TOPN (and resizes dynamic array)
frequently.