From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 76F403850427; Mon, 16 Nov 2020 21:27:46 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 76F403850427 From: "hubicka at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97 Date: Mon, 16 Nov 2020 21:27:46 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: bootstrap X-Bugzilla-Version: 11.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: hubicka at gcc dot gnu.org X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P1 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: 11.0 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Nov 2020 21:27:46 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D97857 --- Comment #8 from Jan Hubicka --- In my setup I get ICE segfault with #0 0x00000000011fcf44 in vec::release (this=3D0x0) at ../../gcc/vec.h:1811 #1 0x00000000011fcf2f in auto_vec::~auto_vec (this=3D, this=3D) at ../../gcc/vec.h:1542 #2 speculative_call_summary::~speculative_call_summary (this=3D, this=3D) at ../../gcc/ipa-profile.c:178 #3 object_allocator::remove (object=3D0x0, this=3D0x2c980f8) at ../../gcc/alloc-pool.h:522 #4 call_summary_base::release (this=3D0x2c980c0, item=3D0x0) at ../../gcc/symbol-summary.h:625 #5 0x0000000000d03fbf in call_summary::~call_summary (this=3D, this=3D) at ../../gcc/hash-map.h:270 #6 0x00000000011e1070 in ipa_profile_call_summaries::~ipa_profile_call_summaries (this=3D, this=3D) at ../../gcc/ipa-profile.c:192 #7 ipa_profile_call_summaries::~ipa_profile_call_summaries (this=3D, this=3D) at ../../gcc/ipa-profile.c:192 #8 0x00000000011e0d00 in ipa_profile () at ../../gcc/ipa-profile.c:1031 #9 (anonymous namespace)::pass_ipa_profile::execute (this=3D) at ../../gcc/ipa-profile.c:1070 #10 0x0000000000d01344 in execute_one_pass (pass=3D0x1cc8fe0) at ../../gcc/passes.c:2564 #11 0x00000000011ded75 in execute_ipa_pass_list (pass=3D0x1cc8fe0) at ../../gcc/passes.c:2993 #12 0x0000000000cffe1f in ipa_passes () at ../../gcc/cgraphunit.c:2217 #13 symbol_table::compile (this=3D0x7ffff7066100) at ../../gcc/cgraphunit.c= :2294 #14 0x00000000011cb792 in symbol_table::finalize_compilation_unit (this=3D0x7ffff7066100) at ../../gcc/cgraphunit.c:2542 #15 compile_file () at ../../gcc/toplev.c:485 #16 0x000000000119744d in do_compile () at ../../gcc/toplev.c:2321 #17 toplev::main (argv=3D, argc=3D6, this=3D) at ../../gcc/toplev.c:2460 #18 main (argc=3D, argv=3D0x7fffffffeb08) at ../../gcc/main.= c:39 What is wrong is already #4 call_summary_base::release (this=3D0x2c980c0, item=3D0x0) at ../../gcc/symbol-summary.h:625 625 m_allocator.remove (item); here item should be non-NULL. This is called from: template =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20 call_summary::~call_summary ()=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20 {=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20 this->unregister_hooks ();=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20 /* Release all summaries. */=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20 typedef typename hash_map ::iterator map_iterator;=20=20= =20=20=20=20=20=20=20=20=20=20=20 for (map_iterator it =3D m_map.begin (); it !=3D m_map.end (); ++it)=20= =20=20=20=20=20=20=20=20=20=20=20=20=20 this->release ((*it).second);=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20 }=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20 and here Dump of assembler code for function call_summary::~call_summary(): 0x0000000000d03f9e <+94>: movaps %xmm0,(%rsp) 0x0000000000d03fa2 <+98>: callq 0xd16140 , thunk_info*, simple_hashmap_traits >, thunk_inf= o*> >::hash_entry, false, xcallocator>::iterator::slide()> 0x0000000000d03fa7 <+103>: movdqa (%rsp),%xmm2 0x0000000000d03fac <+108>: movaps %xmm2,0x10(%rsp) 0x0000000000d03fb1 <+113>: jmp 0xd03fcf ::~call_summary()+143> 0x0000000000d03fb3 <+115>: mov 0x8(%rdx),%rsi 0x0000000000d03fb7 <+119>: mov %rbx,%rdi 0x0000000000d03fba <+122>: callq 0x11fcf10 ::release(speculative_call_summ= ary*)> =3D> 0x0000000000d03fbf <+127>: lea 0x10(%rsp),%rdi 0x0000000000d03fc4 <+132>: addq $0x10,0x10(%rsp) 0x0000000000d03fca <+138>: callq 0xd16140 , thunk_info*, simple_hashmap_traits >, thunk_inf= o*> >::hash_entry, false, xcallocator>::iterator::slide()> 0x0000000000d03fcf <+143>: mov 0x10(%rsp),%rdx 0x0000000000d03fd4 <+148>: test %rdx,%rdx so clearly ICF happens on iterator::slide() and something goes wrong here. We merge quite a lot of slies.=