[Bug ipa/97565] New: -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[Bug ipa/97565] New: -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[slyfox at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

            Bug ID: 97565
           Summary: -flto -ipa-pta ICE: at
                    cgraph_node::get_untransformed_body()
           Product: gcc
           Version: 10.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: slyfox at gcc dot gnu.org
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

This is a forward of https://bugs.gentoo.org/750473 ICE where
spidermonkey-78.4.0 fails when built with -O1 flto -fipa-pta.

Here is the "minimal" 2-file reproducer:

  // cat abort.cpp
  extern "C" void abort(void) {
    abort();
  }

  // cat main.cpp
  extern "C" void abort(void);

  int main(int argc, char * argv[]) {
    abort();
  }

To crash it reliably on a small example I had to for LTO partitions to smallest
sizes:

$ x86_64-pc-linux-gnu-g++ -o abort.o -flto -O1 -fipa-pta
--param=lto-min-partition=1 -flto-partition=max -c abort.cpp
$ x86_64-pc-linux-gnu-g++ -o main.o -flto -O1 -fipa-pta
--param=lto-min-partition=1 -flto-partition=max -c main.cpp
$ x86_64-pc-linux-gnu-g++ -o o -flto -O1 -fipa-pta --param=lto-min-partition=1
-flto-partition=max main.o abort.o

during IPA pass: pta
lto1: internal compiler error: Segmentation fault
0xa798ba crash_signal
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/toplev.c:330
0x7fe1b23d4eef ???
       
/usr/src/debug/sys-libs/glibc-2.32-r2/glibc-2.32/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x6ab959 cgraph_node::get_untransformed_body()
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/cgraph.c:3934
0x6aba89 cgraph_node::get_body()
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/cgraph.c:3967
0xc2e433 ipa_pta_execute
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/tree-ssa-structalias.c:8150
0xc2e433 execute
       
/usr/src/debug/sys-devel/gcc-11.0.0_pre9999/gcc-11.0.0_pre9999/gcc/tree-ssa-structalias.c:8569
Please submit a full bug report,

It does not seem to be a regression. I see the same crash on g++-6.5.0  
g++-7.5.0   g++-8.4.0   g++-9.3.0 g++-10.2.0  g++-11.0.0.

It seems to have to do with a abort() symbol type. During LTO partition it's
not consider either external or internal during partitioning:

  $ cat o.res
  2
  main.o 1
  203 af1adcfd998498c1 PREVAILING_DEF main
  abort.o 1
  201 8749e101441c301e PREVAILING_DEF_IRONLY_EXP abort

I think we expect something like 'RESOLVED_IR abort' (or some form of external
symbol?) for first 'main.o' partition.

Otherwise crash happens when attempt to use the information around the symbol:

Program received signal SIGSEGV, Segmentation fault.
0x000000000056f52a in cgraph_node::get_untransformed_body (this=0x7ffff744e2a0)
at ../../gcc/gcc/cgraph.c:3920
3920                                   decl_state->compressed);
(gdb) bt
#0  0x000000000056f52a in cgraph_node::get_untransformed_body
(this=0x7ffff744e2a0) at ../../gcc/gcc/cgraph.c:3920
#1  0x000000000056f6b8 in cgraph_node::get_body (this=0x7ffff744e2a0) at
../../gcc/gcc/cgraph.c:3951
#2  0x000000000101903a in ipa_pta_execute () at
../../gcc/gcc/tree-ssa-structalias.c:8154
#3  0x000000000101a6df in (anonymous namespace)::pass_ipa_pta::execute
(this=0x2f09810) at ../../gcc/gcc/tree-ssa-structalias.c:8573
#4  0x0000000000b346b4 in execute_one_pass (pass=0x2f09810) at
../../gcc/gcc/passes.c:2517
#5  0x0000000000b35635 in execute_ipa_pass_list (pass=0x2f09810) at
../../gcc/gcc/passes.c:2944
#6  0x0000000000582fc4 in symbol_table::compile (this=0x7ffff7646100) at
../../gcc/gcc/cgraphunit.c:2805
#7  0x000000000043ba1b in lto_main () at ../../gcc/gcc/lto/lto.c:653
#8  0x0000000000cbd763 in compile_file () at ../../gcc/gcc/toplev.c:460
#9  0x0000000000cc0b25 in do_compile () at ../../gcc/gcc/toplev.c:2321
#10 0x0000000000cc0e3e in toplev::main (this=0x7fffffffd4a6, argc=20,
argv=0x2ee3a10) at ../../gcc/gcc/toplev.c:2460
#11 0x0000000001f614e3 in main (argc=20, argv=0x7fffffffd5b8) at
../../gcc/gcc/main.c:39
(gdb) list
3915        origin = origin->clone_of;
3916
3917      int stream_order = origin->order - file_data->order_base;
3918      data = lto_get_section_data (file_data, LTO_section_function_body,
3919                                   name, stream_order, &len,
3920                                   decl_state->compressed);
3921      if (!data)
3922        fatal_error (input_location, "%s: section %s.%d is missing",
3923                     file_data->file_name, name, stream_order);
3924
(gdb) print decl_state
$1 = (lto_in_decl_state *) 0x0

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[slyfox at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #1 from Sergei Trofimovich <slyfox at gcc dot gnu.org> ---
If I change 'abort' name to 'foo' then test works fine:

$ cat abort.cpp
extern "C" void foo(void) {
  foo();
}
$ cat main.cpp
extern "C" void foo(void);

int main(int argc, char * argv[]) {
    foo();
}
$ cat o.res
2
main.o 2
203 3cd4d3b7ff8d0f59 PREVAILING_DEF main
206 3cd4d3b7ff8d0f59 RESOLVED_IR foo
abort.o 1
191 2179600d205ec4af PREVAILING_DEF_IRONLY foo

Looks like 'abort' is considered a builtin of some sort that conflicts with
user's override in a way that breaks LTO streaming of type declaration.

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-10-26
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
So the odd thing is that PTA sees

      /* Nodes without a body are not interesting.  Especially do not
         visit clones at this point for now - we get duplicate decls
         there for inline clones at least.  */
      if (!node->has_gimple_body_p () || node->inlined_to)
        continue;
      node->get_body ();

(gdb) p node->debug ()
abort/0 (abort) @0x7ffff661b000
  Type: function definition
  Visibility: in_other_partition externally_visible prevailing_def_ironly_exp
external public visibility_specified
  References: 
  Referring: abort/2 (alias) 
  Read from file: ./t.ltrans0.o
  Availability: available
  Unit id: 2
  Function flags: count:1073741824 (estimated locally) nonfreeing_fn
unlikely_executed
  Called by: 
  Calls: 


but

  /* Return true when callgraph node is a function with Gimple body defined
     in current unit.  Functions can also be define externally or they
     can be thunks with no Gimple representation.

     Note that at WPA stage, the function body may not be present in memory. 
*/
  inline bool has_gimple_body_p (void);

where I assume that this means the current _LTRANS_ unit has the body
defined.

The other odd thing is that the node has ->used_from_other_partition false.

Full initial symtab:

Creating file ./t.ltrans0.o with sub id 0x7c0d6948e785db2d
Symbol table:

abort/0 (abort) @0x7f3431cf9000
  Type: function definition
  Visibility: in_other_partition externally_visible prevailing_def_ironly_exp
external public visibility_specified
  References:
  Referring: abort/2 (alias)
  Read from file: ./t.ltrans0.o
  Unit id: 2
  Function flags: count:1073741824 (estimated locally) nonfreeing_fn
unlikely_executed
  Called by:
  Calls:
abort/2 (abort) @0x7f3431ef5ee0
  Type: function definition analyzed alias transparent_alias
  Visibility: externally_visible external public visibility_specified
  References: abort/0 (alias)
  Referring:
  Read from file: ./t.ltrans0.o
  Unit id: 3
  Function flags:
  Called by: main/1 (0 (precise),0.00 per call) (can throw external)
  Calls:
main/1 (main) @0x7f3431ef5dd0
  Type: function definition analyzed
  Visibility: externally_visible prevailing_def public
  References:
  Referring:
  Read from file: ./t.ltrans0.o
  Unit id: 3
  Function flags: count:0 (precise) only_called_at_startup nonfreeing_fn
unlikely_executed
  Called by:
  Calls: abort/2 (0 (precise),0.00 per call) (can throw external)


oddly enough symbol and alias are in different partitions?

Honza - is this a PTA bug (need to check in_other_partition?) or a IPA bug?

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[xry111 at mengyan1223 dot wang]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #4 from Xi Ruoyao <xry111 at mengyan1223 dot wang> ---
This issue still exists in trunk.  "-fno-builtin-abort" can be used as a
workaround for SpiderMonkey though.

Any progress?

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2020-10-26 00:00:00         |2021-7-13
      Known to fail|10.2.0                      |10.3.0, 11.1.1, 12.0

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
No, I'm still waiting for feedback from Honza.  It can also be worked around by
not using -fipa-pta ;)

Re-confirmed btw.

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #6 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
has_gimple_body_p really cares about the WPA unit (we should probably note that
in the comment).  Here you seem to have function that is in the WPA translation
unit but lands in different partition and in that case you have
in_other_partition.

used_from_other_partition is about symbols defined in current ltrans partition
but being used from other ltrans.

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:0230e69a3fabe6ad1d80cdf308ad1bf1934c4381

commit r12-3085-g0230e69a3fabe6ad1d80cdf308ad1bf1934c4381
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Aug 23 15:37:48 2021 +0200

    ipa/97565 - fix IPA PTA body availability check

    Looks like the existing check using has_gimple_body_p isn't enough
    at LTRANS time but I need to check in_other_partition as well.

    2021-08-23  Richard Biener  <rguenther@suse.de>

            PR ipa/97565
            * tree-ssa-structalias.c (ipa_pta_execute): Check
in_other_partition
            in addition to has_gimple_body.

            * g++.dg/lto/pr97565_0.C: New testcase.
            * g++.dg/lto/pr97565_1.C: Likewise.

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |12.0

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar, will push it to branches if it happens to help.

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[slyfox at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #9 from Sergei Trofimovich <slyfox at gcc dot gnu.org> ---
Tested gcc-master against spidermonkey-78.13.0 with -flto -fipa-pta -O1. Works
without a problem. Thank you!

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:5bc33f0318152235ce10220f0d1a2e0c87bde9f1

commit r11-8897-g5bc33f0318152235ce10220f0d1a2e0c87bde9f1
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Aug 23 15:37:48 2021 +0200

    ipa/97565 - fix IPA PTA body availability check

    Looks like the existing check using has_gimple_body_p isn't enough
    at LTRANS time but I need to check in_other_partition as well.

    2021-08-23  Richard Biener  <rguenther@suse.de>

            PR ipa/97565
            * tree-ssa-structalias.c (ipa_pta_execute): Check
in_other_partition
            in addition to has_gimple_body.

            * g++.dg/lto/pr97565_0.C: New testcase.
            * g++.dg/lto/pr97565_1.C: Likewise.

    (cherry picked from commit 0230e69a3fabe6ad1d80cdf308ad1bf1934c4381)

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:3b0c38012093078549811ae1ca0215d1047a2be2

commit r10-10061-g3b0c38012093078549811ae1ca0215d1047a2be2
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Aug 23 15:37:48 2021 +0200

    ipa/97565 - fix IPA PTA body availability check

    Looks like the existing check using has_gimple_body_p isn't enough
    at LTRANS time but I need to check in_other_partition as well.

    2021-08-23  Richard Biener  <rguenther@suse.de>

            PR ipa/97565
            * tree-ssa-structalias.c (ipa_pta_execute): Check
in_other_partition
            in addition to has_gimple_body.

            * g++.dg/lto/pr97565_0.C: New testcase.
            * g++.dg/lto/pr97565_1.C: Likewise.

    (cherry picked from commit 0230e69a3fabe6ad1d80cdf308ad1bf1934c4381)

[Bug ipa/97565] -flto -ipa-pta ICE: at cgraph_node::get_untransformed_body()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97565

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to fail|11.1.1                      |11.2.0
      Known to work|                            |10.3.1, 11.2.1
   Target Milestone|---                         |10.4
           Keywords|                            |ice-on-valid-code
         Resolution|---                         |FIXED

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed up to where originally reported.