[Bug bootstrap/97857] New: profiledbootstrap broken freeing speculative call summary

[Bug bootstrap/97857] New: profiledbootstrap broken freeing speculative call summary

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

            Bug ID: 97857
           Summary: profiledbootstrap broken freeing speculative call
                    summary
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: bootstrap
          Assignee: unassigned at gcc dot gnu.org
          Reporter: hubicka at gcc dot gnu.org
  Target Milestone: ---

Configuring with 
../configure --with-build-config=bootstrap-lto --enable-checking=release
--disable-plugin

leads to ICE building stage feedback libstdc++. This is already with optimized
cc1plus so it may a miscompile of cc1plus.

0x8fcd5a crash_signal
        ../../gcc/toplev.c:330
0x7ffff789c83f ???
       
/build/glibc-vjB4T1/glibc-2.28/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x11fcf44 vec<speculative_call_target, va_heap, vl_ptr>::release()
        ../../gcc/vec.h:1813
0x11fcf2e auto_vec<speculative_call_target, 0ul>::~auto_vec()
        ../../gcc/vec.h:1542
0x11fcf2e speculative_call_summary::~speculative_call_summary()
        ../../gcc/ipa-profile.c:178
0x11fcf2e
object_allocator<speculative_call_summary>::remove(speculative_call_summary*)
        ../../gcc/alloc-pool.h:522
0x11fcf2e
call_summary_base<speculative_call_summary>::release(speculative_call_summary*)
        ../../gcc/symbol-summary.h:625
0xd03fbe call_summary<speculative_call_summary*>::~call_summary()
        ../../gcc/symbol-summary.h:771
0x11e106f ipa_profile_call_summaries::~ipa_profile_call_summaries()
        ../../gcc/ipa-profile.c:192
0x11e106f ipa_profile_call_summaries::~ipa_profile_call_summaries()
        ../../gcc/ipa-profile.c:192
0x11e0cff ipa_profile
        ../../gcc/ipa-profile.c:1031
0x11e0cff execute
        ../../gcc/ipa-profile.c:1070

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
            Summary|profiledbootstrap broken    |[11 Regression]
                   |freeing speculative call    |profiledbootstrap broken
                   |summary                     |freeing speculative call
                   |                            |summary since
                   |                            |r11-4987-g602c6cfc79ce4ae61
                   |                            |e277107e0a60079c1a93a97
                 CC|                            |marxin at gcc dot gnu.org
   Target Milestone|---                         |11.0
             Status|UNCONFIRMED                 |NEW
           Priority|P3                          |P1
   Last reconfirmed|                            |2020-11-16
            Version|unknown                     |11.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
I see a similar bootstrap failure that's with:

../configure --enable-languages=c,c++,lto --prefix=/home/marxin/bin/gcc
--disable-multilib --without-isl --disable-libsanitizer
--with-build-config=bootstrap-lto-lean && make profiledbootstrap
'STAGE1_CFLAGS=-g -O2'

started with r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97.

Re: [Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[Jan Hubicka]

> I see a similar bootstrap failure that's with:
> 
> ../configure --enable-languages=c,c++,lto --prefix=/home/marxin/bin/gcc
> --disable-multilib --without-isl --disable-libsanitizer
> --with-build-config=bootstrap-lto-lean && make profiledbootstrap
> 'STAGE1_CFLAGS=-g -O2'
> 
> started with r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97.

Yep, I already worked out it is ipa-icf...
Do you have easy way to bisect what merge is causing the failure?
It is odd it reproduces only with profile feedback and now without since
ICF does not care about it very much.

Honza

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #2 from Jan Hubicka <hubicka at ucw dot cz> ---
> I see a similar bootstrap failure that's with:
> 
> ../configure --enable-languages=c,c++,lto --prefix=/home/marxin/bin/gcc
> --disable-multilib --without-isl --disable-libsanitizer
> --with-build-config=bootstrap-lto-lean && make profiledbootstrap
> 'STAGE1_CFLAGS=-g -O2'
> 
> started with r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97.

Yep, I already worked out it is ipa-icf...
Do you have easy way to bisect what merge is causing the failure?
It is odd it reproduces only with profile feedback and now without since
ICF does not care about it very much.

Honza

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #2)
> > I see a similar bootstrap failure that's with:
> > 
> > ../configure --enable-languages=c,c++,lto --prefix=/home/marxin/bin/gcc
> > --disable-multilib --without-isl --disable-libsanitizer
> > --with-build-config=bootstrap-lto-lean && make profiledbootstrap
> > 'STAGE1_CFLAGS=-g -O2'
> > 
> > started with r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97.
> 
> Yep, I already worked out it is ipa-icf...
> Do you have easy way to bisect what merge is causing the failure?

Working on that will send details soon.

> It is odd it reproduces only with profile feedback and now without since
> ICF does not care about it very much.
> 
> Honza

Re: [Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[Jan Hubicka]

> > Yep, I already worked out it is ipa-icf...
> > Do you have easy way to bisect what merge is causing the failure?
> 
> Working on that will send details soon.
Great, thanks.  In meantime I will check if I can isolate one of the paths
(constant access merging, variable access merging on the two other
changes).

Honza

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #4 from Jan Hubicka <hubicka at ucw dot cz> ---
> > Yep, I already worked out it is ipa-icf...
> > Do you have easy way to bisect what merge is causing the failure?
> 
> Working on that will send details soon.
Great, thanks.  In meantime I will check if I can isolate one of the paths
(constant access merging, variable access merging on the two other
changes).

Honza

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
I'm planning to use merged_ipa_icf debug counter to isolate that..

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
It crashes here:

echo timestamp > stmp-int-hdrs
/home/mliska/Programming/gcc/objdir/./gcc/xgcc
-B/home/mliska/Programming/gcc/objdir/./gcc/ -xc -nostdinc /dev/null -S -o
/dev/null -fself-test=../../gcc/testsuite/selftests
cc1: internal compiler error: Segmentation fault
0xb5e54f crash_signal
        ../../gcc/toplev.c:330
0x143223f hash_table<const_double_hasher, false,
xcallocator>::is_empty(rtx_def*&)
        ../../gcc/hash-table.h:541
0x143223f void
gt_cleare_cache<const_double_hasher>(hash_table<const_double_hasher, false,
xcallocator>*)
        ../../gcc/hash-table.h:1218
0x143223f gt_clear_caches_gt_emit_rtl_h()
        ./gt-emit-rtl.h:387
0x14c575a gt_clear_caches()
        ./gtype-c.h:167
0x1044837 ggc_mark_roots()
        ../../gcc/ggc-common.c:103
0x1001c7b ggc_collect()
        ../../gcc/ggc-page.c:2220
0x1001c7b ggc_collect()
        ../../gcc/ggc-page.c:2181
0xa73921 selftest::forcibly_ggc_collect()
        ../../gcc/ggc-tests.c:36
0xa73921 test_basic_struct
        ../../gcc/ggc-tests.c:61
0xa73921 selftest::ggc_tests_c_tests()
        ../../gcc/ggc-tests.c:478
0xe78d35 selftest::run_tests()
        ../../gcc/selftest-run-tests.c:70
0xb5eeb7 toplev::run_self_tests()
        ../../gcc/toplev.c:2384
Please submit a full bug report,

Re: [Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[Jan Hubicka]

It seems to crash on quite few locaitons but always related to indirect
calls.  So perhaps there is some sort of weird relation to indirect call
profiling or devirutalization...

I am going to move my build to faster machine.
Honza

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #7 from Jan Hubicka <hubicka at ucw dot cz> ---
It seems to crash on quite few locaitons but always related to indirect
calls.  So perhaps there is some sort of weird relation to indirect call
profiling or devirutalization...

I am going to move my build to faster machine.
Honza

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #8 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
In my setup I get ICE segfault with
#0  0x00000000011fcf44 in vec<speculative_call_target, va_heap,
vl_ptr>::release (this=0x0) at ../../gcc/vec.h:1811
#1  0x00000000011fcf2f in auto_vec<speculative_call_target, 0ul>::~auto_vec
(this=<optimized out>, this=<optimized out>) at ../../gcc/vec.h:1542
#2  speculative_call_summary::~speculative_call_summary (this=<optimized out>,
this=<optimized out>) at ../../gcc/ipa-profile.c:178
#3  object_allocator<speculative_call_summary>::remove (object=0x0,
this=0x2c980f8) at ../../gcc/alloc-pool.h:522
#4  call_summary_base<speculative_call_summary>::release (this=0x2c980c0,
item=0x0) at ../../gcc/symbol-summary.h:625
#5  0x0000000000d03fbf in
call_summary<speculative_call_summary*>::~call_summary (this=<optimized out>,
this=<optimized out>) at ../../gcc/hash-map.h:270
#6  0x00000000011e1070 in
ipa_profile_call_summaries::~ipa_profile_call_summaries (this=<optimized out>,
this=<optimized out>) at ../../gcc/ipa-profile.c:192
#7  ipa_profile_call_summaries::~ipa_profile_call_summaries (this=<optimized
out>, this=<optimized out>) at ../../gcc/ipa-profile.c:192
#8  0x00000000011e0d00 in ipa_profile () at ../../gcc/ipa-profile.c:1031
#9  (anonymous namespace)::pass_ipa_profile::execute (this=<optimized out>) at
../../gcc/ipa-profile.c:1070
#10 0x0000000000d01344 in execute_one_pass (pass=0x1cc8fe0) at
../../gcc/passes.c:2564
#11 0x00000000011ded75 in execute_ipa_pass_list (pass=0x1cc8fe0) at
../../gcc/passes.c:2993
#12 0x0000000000cffe1f in ipa_passes () at ../../gcc/cgraphunit.c:2217
#13 symbol_table::compile (this=0x7ffff7066100) at ../../gcc/cgraphunit.c:2294
#14 0x00000000011cb792 in symbol_table::finalize_compilation_unit
(this=0x7ffff7066100) at ../../gcc/cgraphunit.c:2542
#15 compile_file () at ../../gcc/toplev.c:485
#16 0x000000000119744d in do_compile () at ../../gcc/toplev.c:2321
#17 toplev::main (argv=<optimized out>, argc=6, this=<synthetic pointer>) at
../../gcc/toplev.c:2460
#18 main (argc=<optimized out>, argv=0x7fffffffeb08) at ../../gcc/main.c:39

What is wrong is already

#4  call_summary_base<speculative_call_summary>::release (this=0x2c980c0,
item=0x0) at ../../gcc/symbol-summary.h:625
625           m_allocator.remove (item);

here item should be non-NULL. This is called from:
template <typename T>                                                           
call_summary<T *>::~call_summary ()                                             
{                                                                               
  this->unregister_hooks ();                                                    

  /* Release all summaries.  */                                                 
  typedef typename hash_map <map_hash, T *>::iterator map_iterator;             
  for (map_iterator it = m_map.begin (); it != m_map.end (); ++it)              
    this->release ((*it).second);                                               
}                                                                               

and here

Dump of assembler code for function
call_summary<speculative_call_summary*>::~call_summary():

   0x0000000000d03f9e <+94>:    movaps %xmm0,(%rsp)
   0x0000000000d03fa2 <+98>:    callq  0xd16140
<hash_table<hash_map<int_hash<int, 0, -1>, thunk_info*,
simple_hashmap_traits<default_hash_traits<int_hash<int, 0, -1> >, thunk_info*>
>::hash_entry, false, xcallocator>::iterator::slide()>
   0x0000000000d03fa7 <+103>:   movdqa (%rsp),%xmm2
   0x0000000000d03fac <+108>:   movaps %xmm2,0x10(%rsp)
   0x0000000000d03fb1 <+113>:   jmp    0xd03fcf
<call_summary<speculative_call_summary*>::~call_summary()+143>
   0x0000000000d03fb3 <+115>:   mov    0x8(%rdx),%rsi
   0x0000000000d03fb7 <+119>:   mov    %rbx,%rdi
   0x0000000000d03fba <+122>:   callq  0x11fcf10
<call_summary_base<speculative_call_summary>::release(speculative_call_summary*)>
=> 0x0000000000d03fbf <+127>:   lea    0x10(%rsp),%rdi
   0x0000000000d03fc4 <+132>:   addq   $0x10,0x10(%rsp)
   0x0000000000d03fca <+138>:   callq  0xd16140
<hash_table<hash_map<int_hash<int, 0, -1>, thunk_info*,
simple_hashmap_traits<default_hash_traits<int_hash<int, 0, -1> >, thunk_info*>
>::hash_entry, false, xcallocator>::iterator::slide()>
   0x0000000000d03fcf <+143>:   mov    0x10(%rsp),%rdx
   0x0000000000d03fd4 <+148>:   test   %rdx,%rdx

so clearly ICF happens on iterator::slide() and something goes wrong here.
We merge quite a lot of slies.

Re: [Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[Jan Hubicka]

The checking enabled build ICEs for me at same spot as for you

   0x0000000001475505 <+165>:   punpcklqdq %xmm2,%xmm3
   0x0000000001475509 <+169>:   movaps %xmm3,0x30(%rsp)
   0x000000000147550e <+174>:   callq  0x10949d0 <hash_table<const_fixed_hasher, false, xcallocator>::iterator::slide()>
   0x0000000001475513 <+179>:   mov    %r12,0x20(%rsp)
   0x0000000001475518 <+184>:   mov    %rbx,0x28(%rsp)
   0x000000000147551d <+189>:   jmp    0x1475548 <gt_clear_caches_gt_emit_rtl_h()+232>
=> 0x000000000147551f <+191>:   mov    (%r14),%rdi
   0x0000000001475522 <+194>:   cmp    $0x1,%rdi
   0x0000000001475526 <+198>:   jbe    0x1475535 <gt_clear_caches_gt_emit_rtl_h()+213>
   0x0000000001475528 <+200>:   callq  0x1094a30 <ggc_marked_p(void const*)>
   0x000000000147552d <+205>:   test   %eax,%eax
   0x000000000147552f <+207>:   je     0x14757c2 <gt_clear_caches_gt_emit_rtl_h()+866>
   0x0000000001475535 <+213>:   add    $0x8,%r14
   0x0000000001475539 <+217>:   lea    0x20(%rsp),%rdi
   0x000000000147553e <+222>:   mov    %r14,0x20(%rsp)
   0x0000000001475543 <+227>:   callq  0x10949d0 <hash_table<const_fixed_hasher, false, xcallocator>::iterator::slide()>
   0x0000000001475548 <+232>:   mov    0x20(%rsp),%r14

So same loop merging slide, also vectorized code around.

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #9 from Jan Hubicka <hubicka at ucw dot cz> ---
The checking enabled build ICEs for me at same spot as for you

   0x0000000001475505 <+165>:   punpcklqdq %xmm2,%xmm3
   0x0000000001475509 <+169>:   movaps %xmm3,0x30(%rsp)
   0x000000000147550e <+174>:   callq  0x10949d0
<hash_table<const_fixed_hasher, false, xcallocator>::iterator::slide()>
   0x0000000001475513 <+179>:   mov    %r12,0x20(%rsp)
   0x0000000001475518 <+184>:   mov    %rbx,0x28(%rsp)
   0x000000000147551d <+189>:   jmp    0x1475548
<gt_clear_caches_gt_emit_rtl_h()+232>
=> 0x000000000147551f <+191>:   mov    (%r14),%rdi
   0x0000000001475522 <+194>:   cmp    $0x1,%rdi
   0x0000000001475526 <+198>:   jbe    0x1475535
<gt_clear_caches_gt_emit_rtl_h()+213>
   0x0000000001475528 <+200>:   callq  0x1094a30 <ggc_marked_p(void const*)>
   0x000000000147552d <+205>:   test   %eax,%eax
   0x000000000147552f <+207>:   je     0x14757c2
<gt_clear_caches_gt_emit_rtl_h()+866>
   0x0000000001475535 <+213>:   add    $0x8,%r14
   0x0000000001475539 <+217>:   lea    0x20(%rsp),%rdi
   0x000000000147553e <+222>:   mov    %r14,0x20(%rsp)
   0x0000000001475543 <+227>:   callq  0x10949d0
<hash_table<const_fixed_hasher, false, xcallocator>::iterator::slide()>
   0x0000000001475548 <+232>:   mov    0x20(%rsp),%r14

So same loop merging slide, also vectorized code around.

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #10 from Jan Hubicka <hubicka at ucw dot cz> ---
So I think I know what happens. It is actually the pre-existing 
problem I mentioned in
https://gcc.gnu.org/pipermail/gcc-patches/2020-November/559017.html
the iterator is small type consiting of two pointers and thus at WPA
time it gets conflict with non-ODR type and all iterators become the
same.

At ltrans however with fortunate partitioning this does not need to
happen (which is where -fproifle-use comes into game: it reorders the
code) we end up with separate ODR types because the C type is not
streamed in.

I am testing fix

Re: [Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[Jan Hubicka]

This patch fixes the issue by making the conflict with C type sticky via
clearing the CXX bit.  I checked that it recovers profiledbootstrap,
hwoever I want to look into the code tomorrow bit more to be sure that
it does not disable more than it should.

Honza

diff --git a/gcc/ipa-utils.h b/gcc/ipa-utils.h
index 880e527c590..91571d8e82a 100644
--- a/gcc/ipa-utils.h
+++ b/gcc/ipa-utils.h
@@ -211,8 +211,6 @@ type_with_linkage_p (const_tree t)
   if (!TYPE_CONTEXT (t))
     return false;
 
-  gcc_checking_assert (TREE_CODE (t) == ENUMERAL_TYPE || TYPE_CXX_ODR_P (t));
-
   return true;
 }
 
diff --git a/gcc/lto/lto-common.c b/gcc/lto/lto-common.c
index 6944c469f89..0a3033c3695 100644
--- a/gcc/lto/lto-common.c
+++ b/gcc/lto/lto-common.c
@@ -415,8 +415,8 @@ gimple_register_canonical_type_1 (tree t, hashval_t hash)
      that we can use to lookup structurally equivalent non-ODR type.
      In case we decide to treat type as unique ODR type we recompute hash based
      on name and let TBAA machinery know about our decision.  */
-  if (RECORD_OR_UNION_TYPE_P (t)
-      && odr_type_p (t) && !odr_type_violation_reported_p (t))
+  if (RECORD_OR_UNION_TYPE_P (t) && odr_type_p (t)
+      && TYPE_CXX_ODR_P (t) && !odr_type_violation_reported_p (t))
     {
       /* Anonymous namespace types never conflict with non-C++ types.  */
       if (type_with_linkage_p (t) && type_in_anonymous_namespace_p (t))
@@ -434,6 +434,7 @@ gimple_register_canonical_type_1 (tree t, hashval_t hash)
       if (slot && !TYPE_CXX_ODR_P (*(tree *)slot))
 	{
 	  tree nonodr = *(tree *)slot;
+	  gcc_checking_assert (!flag_ltrans);
 	  if (symtab->dump_file)
 	    {
 	      fprintf (symtab->dump_file,
diff --git a/gcc/tree-streamer-out.c b/gcc/tree-streamer-out.c
index d7a451cfef4..237c87fbf62 100644
--- a/gcc/tree-streamer-out.c
+++ b/gcc/tree-streamer-out.c
@@ -343,7 +343,15 @@ pack_ts_type_common_value_fields (struct bitpack_d *bp, tree expr)
     {
       bp_pack_value (bp, TYPE_TRANSPARENT_AGGR (expr), 1);
       bp_pack_value (bp, TYPE_FINAL_P (expr), 1);
-      bp_pack_value (bp, TYPE_CXX_ODR_P (expr), 1);
+      /* alias_ptr_types_compatible_p relies on fact that during LTO
+         types do not get refined from WPA time to ltrans.  */
+      gcc_checking_assert (!in_lto_p
+			   || !TYPE_CANONICAL (expr)
+			   || TYPE_CXX_ODR_P (TYPE_CANONICAL (expr))
+			      == TYPE_CXX_ODR_P (expr));
+      bp_pack_value (bp, flag_wpa && TYPE_CANONICAL (expr)
+			 ? TYPE_CXX_ODR_P (TYPE_CANONICAL (expr))
+			 : TYPE_CXX_ODR_P (expr), 1);
     }
   else if (TREE_CODE (expr) == ARRAY_TYPE)
     bp_pack_value (bp, TYPE_NONALIASED_COMPONENT (expr), 1);

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #11 from Jan Hubicka <hubicka at ucw dot cz> ---
This patch fixes the issue by making the conflict with C type sticky via
clearing the CXX bit.  I checked that it recovers profiledbootstrap,
hwoever I want to look into the code tomorrow bit more to be sure that
it does not disable more than it should.

Honza

diff --git a/gcc/ipa-utils.h b/gcc/ipa-utils.h
index 880e527c590..91571d8e82a 100644
--- a/gcc/ipa-utils.h
+++ b/gcc/ipa-utils.h
@@ -211,8 +211,6 @@ type_with_linkage_p (const_tree t)
   if (!TYPE_CONTEXT (t))
     return false;

-  gcc_checking_assert (TREE_CODE (t) == ENUMERAL_TYPE || TYPE_CXX_ODR_P (t));
-
   return true;
 }

diff --git a/gcc/lto/lto-common.c b/gcc/lto/lto-common.c
index 6944c469f89..0a3033c3695 100644
--- a/gcc/lto/lto-common.c
+++ b/gcc/lto/lto-common.c
@@ -415,8 +415,8 @@ gimple_register_canonical_type_1 (tree t, hashval_t hash)
      that we can use to lookup structurally equivalent non-ODR type.
      In case we decide to treat type as unique ODR type we recompute hash
based
      on name and let TBAA machinery know about our decision.  */
-  if (RECORD_OR_UNION_TYPE_P (t)
-      && odr_type_p (t) && !odr_type_violation_reported_p (t))
+  if (RECORD_OR_UNION_TYPE_P (t) && odr_type_p (t)
+      && TYPE_CXX_ODR_P (t) && !odr_type_violation_reported_p (t))
     {
       /* Anonymous namespace types never conflict with non-C++ types.  */
       if (type_with_linkage_p (t) && type_in_anonymous_namespace_p (t))
@@ -434,6 +434,7 @@ gimple_register_canonical_type_1 (tree t, hashval_t hash)
       if (slot && !TYPE_CXX_ODR_P (*(tree *)slot))
        {
          tree nonodr = *(tree *)slot;
+         gcc_checking_assert (!flag_ltrans);
          if (symtab->dump_file)
            {
              fprintf (symtab->dump_file,
diff --git a/gcc/tree-streamer-out.c b/gcc/tree-streamer-out.c
index d7a451cfef4..237c87fbf62 100644
--- a/gcc/tree-streamer-out.c
+++ b/gcc/tree-streamer-out.c
@@ -343,7 +343,15 @@ pack_ts_type_common_value_fields (struct bitpack_d *bp,
tree expr)
     {
       bp_pack_value (bp, TYPE_TRANSPARENT_AGGR (expr), 1);
       bp_pack_value (bp, TYPE_FINAL_P (expr), 1);
-      bp_pack_value (bp, TYPE_CXX_ODR_P (expr), 1);
+      /* alias_ptr_types_compatible_p relies on fact that during LTO
+         types do not get refined from WPA time to ltrans.  */
+      gcc_checking_assert (!in_lto_p
+                          || !TYPE_CANONICAL (expr)
+                          || TYPE_CXX_ODR_P (TYPE_CANONICAL (expr))
+                             == TYPE_CXX_ODR_P (expr));
+      bp_pack_value (bp, flag_wpa && TYPE_CANONICAL (expr)
+                        ? TYPE_CXX_ODR_P (TYPE_CANONICAL (expr))
+                        : TYPE_CXX_ODR_P (expr), 1);
     }
   else if (TREE_CODE (expr) == ARRAY_TYPE)
     bp_pack_value (bp, TYPE_NONALIASED_COMPONENT (expr), 1);

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #12 from Martin Liška <marxin at gcc dot gnu.org> ---
I can confirm that, using dbgcnt-bisect.py script I was able to reduce that to:
-fdbg-cnt=merged_ipa_icf:4876-4877 where the problematic function is really
slide:

../../gcc/hash-table.h:1110:1: optimized: Semantic equality
hit:slide/237223->slide/237233
../../gcc/hash-table.h:1110:1: optimized: Assembler symbol
names:_ZN10hash_tableI18const_fixed_hasherLb0E11xcallocatorE8iterator5slideEv/237223->_ZN10hash_tableI19const_double_hasherLb0E11xcallocatorE8iterator5slideEv/237233
slide (struct iterator * const this)
{
  <bb 2> [count: 316679]:
  goto <bb 6>; [100.00%]

  <bb 3> [count: 715461]:
  # DEBUG x => _2
  # DEBUG v => _2
  # DEBUG INLINE_ENTRY is_empty
  _10 = *_2;
  # DEBUG e => _10
  # DEBUG INLINE_ENTRY NULL
  # DEBUG e => NULL
  # DEBUG v => NULL
  if (_10 != 0B)
    goto <bb 4>; [42.62%]
  else
    goto <bb 5>; [57.38%]

  <bb 4> [count: 304951]:
  # DEBUG v => _2
  # DEBUG INLINE_ENTRY NULL
  # DEBUG e => _10
  # DEBUG INLINE_ENTRY NULL
  # DEBUG e => NULL
  # DEBUG v => NULL
  if (_10 != 1B)
    goto <bb 8>; [100.00%]
  else
    goto <bb 5>; [0.00%]

  <bb 5> [count: 410510]:
  # DEBUG BEGIN_STMT
  _1 = _2 + 8;
  this_7(D)->m_slot = _1;

  <bb 6> [count: 727190]:
  # DEBUG BEGIN_STMT
  _2 = this_7(D)->m_slot;
  _3 = this_7(D)->m_limit;
  if (_2 < _3)
    goto <bb 3>; [98.39%]
  else
    goto <bb 7>; [1.61%]

  <bb 7> [count: 11729]:
  this_7(D)->m_slot = 0B;
  this_7(D)->m_limit = 0B;

  <bb 8> [count: 316679]:
  return;

}


slide (struct iterator * const this)
{
  <bb 2> [count: 258235]:
  goto <bb 6>; [100.00%]

  <bb 3> [count: 715461]:
  # DEBUG x => _2
  # DEBUG v => _2
  # DEBUG INLINE_ENTRY is_empty
  _10 = *_2;
  # DEBUG e => _10
  # DEBUG INLINE_ENTRY NULL
  # DEBUG e => NULL
  # DEBUG v => NULL
  if (_10 != 0B)
    goto <bb 4>; [34.46%]
  else
    goto <bb 5>; [65.54%]

  <bb 4> [count: 246518]:
  # DEBUG v => _2
  # DEBUG INLINE_ENTRY NULL
  # DEBUG e => _10
  # DEBUG INLINE_ENTRY NULL
  # DEBUG e => NULL
  # DEBUG v => NULL
  if (_10 != 1B)
    goto <bb 8>; [100.00%]
  else
    goto <bb 5>; [0.00%]

  <bb 5> [count: 468955]:
  # DEBUG BEGIN_STMT
  _1 = _2 + 8;
  this_7(D)->m_slot = _1;

  <bb 6> [count: 727190]:
  # DEBUG BEGIN_STMT
  _2 = this_7(D)->m_slot;
  _3 = this_7(D)->m_limit;
  if (_2 < _3)
    goto <bb 3>; [98.39%]
  else
    goto <bb 7>; [1.61%]

  <bb 7> [count: 11729]:
  this_7(D)->m_slot = 0B;
  this_7(D)->m_limit = 0B;

  <bb 8> [count: 258235]:
  return;

}

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jan Hubicka <hubicka@gcc.gnu.org>:

https://gcc.gnu.org/g:18dd295638724b455e072cd790451ace15a3d463

commit r11-5093-g18dd295638724b455e072cd790451ace15a3d463
Author: Jan Hubicka <jh@suse.cz>
Date:   Tue Nov 17 15:38:13 2020 +0100

    Make ltrans type canonicals compatible with WPA ones

    This patch fixes profiledbootstrap failure with LTO enabled.
    Not refining alias sets from WPA to ltrans time is a good invariant to
    maintain and the canonical type hash behaves this way.  However I broke
    this with the ODR logic.

    Normally we define canonical types for C++ ODR types according to their
    type names.  However to make ODR types compatible with C types we check
    if structurally equivalent C type exists and if so, we ignore ODR
    names giving up on the precision.

    This however is not stable between WPA and ltrans since at ltrans the
    type merging does not see as many types as WPA does.  To make this
    consistent the patch makes WPA ODR_TYPE_P == 0 for ODR types that
    conflicted with non-ODR type.

    I had to drop one sanity check in ipa-utils.h (that I think is not very
    important - I added it while introducing CXX_ODR_P machinery) and also
    it now may happen that we query odr_based_tbaa_p before registering
    first ODR type so we do not want to ICE here.
    ODR type registration happens early to produce ODR violation warings.
    Those are not done at ltrans, so dropping the registration is safe. The
    type will still be added while computing the type inheritance graph if
    needed for devirtualization (and late devirtualization is not very
    useful anyway since it won't enable inlining).

    gcc/ChangeLog:
            PR bootstrap/97857
            * ipa-devirt.c (odr_based_tbaa_p): Do not ICE when
            odr_hash is not initialized
            * ipa-utils.h (type_with_linkage_p): Do not sanity check
            CXX_ODR_P.
            * tree-streamer-out.c (pack_ts_type_common_value_fields): Set
            CXX_ODR_P according to the canonical type.

    gcc/lto/ChangeLog:
            PR bootstrap/97857
            * lto-common.c (gimple_register_canonical_type_1): Only
            register types with TYPE_CXX_ODR_P flag; sanity check that no
            conflict happens at ltrans time.

[Bug bootstrap/97857] [11 Regression] profiledbootstrap broken freeing speculative call summary since r11-4987-g602c6cfc79ce4ae61e277107e0a60079c1a93a97

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97857

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #14 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed.