[Bug c++/60553] segfault in gt_ggc_mx_lang_tree_node in Chromium with LTO

["marxin.liska at gmail dot com" <gcc-bugzilla at gcc dot gnu dot org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60553

--- Comment #2 from Martin LiÅka <marxin.liska at gmail dot com> ---
Reduced input object files to ~800, bt consists of ~66K frames.

gdb:
(gdb) bt 10
#0  0x00000000005cec2c in lookup_page_table_entry (p=<error reading variable:
Cannot access memory at address 0x7fff63d42ff8>) at ../../gcc/ggc-page.c:584
#1  0x00000000005cfc5e in ggc_set_mark (p=0x7feaf406c020) at
../../gcc/ggc-page.c:1467
#2  0x00000000005a9222 in gt_ggc_mx_lang_tree_node (x_p=0x7feaf406c020) at
./gtype-lto.h:36
#3  0x00000000005aae37 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec684bd0) at
./gtype-lto.h:356
#4  0x00000000005aa461 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec6ad398) at
./gtype-lto.h:243
#5  0x00000000005aaf17 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec68af18) at
./gtype-lto.h:374
#6  0x00000000005aaf34 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec68c2a0) at
./gtype-lto.h:375
#7  0x00000000005aa461 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec695e60) at
./gtype-lto.h:243
#8  0x00000000005aaf17 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec69a0a8) at
./gtype-lto.h:374
#9  0x00000000005aaf34 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec697d20) at
./gtype-lto.h:375

#2  0x00000000005a9222 in gt_ggc_mx_lang_tree_node (x_p=0x7feaf406c020) at
./gtype-lto.h:36
36      while (ggc_test_and_set_mark (xlimit))
(gdb) print (*x).generic.base
$20 = {code = INTEGER_CST, side_effects_flag = 0, constant_flag = 1,
addressable_flag = 0, volatile_flag = 0, readonly_flag = 0, asm_written_flag =
0, nowarning_flag = 0, visited = 0, used_flag = 0, nothrow_flag = 0,
static_flag = 0, 
  public_flag = 0, private_flag = 0, protected_flag = 0, deprecated_flag = 0,
default_def_flag = 0, u = {bits = {lang_flag_0 = 0, lang_flag_1 = 0,
lang_flag_2 = 0, lang_flag_3 = 0, lang_flag_4 = 0, lang_flag_5 = 0, lang_flag_6
= 0, 
      saturating_flag = 0, unsigned_flag = 0, packed_flag = 0, user_align = 0,
nameless_flag = 0, atomic_flag = 0, spare0 = 0, spare1 = 0, address_space = 0},
length = 0, version = 0}}
(gdb) up
#3  0x00000000005aae37 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec684bd0) at
./gtype-lto.h:356
356                  gt_ggc_m_9tree_node
((*x).generic.type_non_common.with_lang_specific.common.size);
(gdb) print (*x).generic.base
$21 = {code = INTEGER_TYPE, side_effects_flag = 0, constant_flag = 0,
addressable_flag = 0, volatile_flag = 0, readonly_flag = 0, asm_written_flag =
0, nowarning_flag = 0, visited = 0, used_flag = 0, nothrow_flag = 0,
static_flag = 0, 
  public_flag = 0, private_flag = 0, protected_flag = 0, deprecated_flag = 0,
default_def_flag = 0, u = {bits = {lang_flag_0 = 0, lang_flag_1 = 0,
lang_flag_2 = 0, lang_flag_3 = 0, lang_flag_4 = 0, lang_flag_5 = 0, lang_flag_6
= 0, 
      saturating_flag = 0, unsigned_flag = 1, packed_flag = 0, user_align = 0,
nameless_flag = 0, atomic_flag = 0, spare0 = 0, spare1 = 0, address_space = 0},
length = 256, version = 256}}
(gdb) up
#4  0x00000000005aa461 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec6ad398) at
./gtype-lto.h:243
243                  gt_ggc_m_9tree_node
((*x).generic.type_decl.common.common.common.common.common.common.typed.type);
(gdb) print (*x).generic.base
$22 = {code = TYPE_DECL, side_effects_flag = 0, constant_flag = 0,
addressable_flag = 0, volatile_flag = 0, readonly_flag = 0, asm_written_flag =
0, nowarning_flag = 0, visited = 0, used_flag = 0, nothrow_flag = 0,
static_flag = 0, 
  public_flag = 0, private_flag = 0, protected_flag = 0, deprecated_flag = 0,
default_def_flag = 0, u = {bits = {lang_flag_0 = 0, lang_flag_1 = 0,
lang_flag_2 = 0, lang_flag_3 = 0, lang_flag_4 = 0, lang_flag_5 = 0, lang_flag_6
= 0, 
      saturating_flag = 0, unsigned_flag = 1, packed_flag = 0, user_align = 0,
nameless_flag = 0, atomic_flag = 0, spare0 = 0, spare1 = 0, address_space = 0},
length = 256, version = 256}}
(gdb) up
#5  0x00000000005aaf17 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec68af18) at
./gtype-lto.h:374
374                  gt_ggc_m_9tree_node
((*x).generic.type_non_common.with_lang_specific.common.name);
(gdb) print (*x).generic.base
$23 = {code = RECORD_TYPE, side_effects_flag = 0, constant_flag = 0,
addressable_flag = 1, volatile_flag = 0, readonly_flag = 0, asm_written_flag =
0, nowarning_flag = 0, visited = 0, used_flag = 0, nothrow_flag = 0,
static_flag = 0, 
  public_flag = 0, private_flag = 0, protected_flag = 0, deprecated_flag = 0,
default_def_flag = 0, u = {bits = {lang_flag_0 = 0, lang_flag_1 = 0,
lang_flag_2 = 0, lang_flag_3 = 0, lang_flag_4 = 0, lang_flag_5 = 0, lang_flag_6
= 0, 
      saturating_flag = 0, unsigned_flag = 0, packed_flag = 0, user_align = 0,
nameless_flag = 0, atomic_flag = 0, spare0 = 0, spare1 = 0, address_space = 0},
length = 0, version = 0}}
(gdb) up
#6  0x00000000005aaf34 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec68c2a0) at
./gtype-lto.h:375
375                  gt_ggc_m_9tree_node
((*x).generic.type_non_common.with_lang_specific.common.next_variant);
(gdb) print (*x).generic.base
$24 = {code = RECORD_TYPE, side_effects_flag = 0, constant_flag = 0,
addressable_flag = 1, volatile_flag = 0, readonly_flag = 0, asm_written_flag =
0, nowarning_flag = 0, visited = 0, used_flag = 0, nothrow_flag = 0,
static_flag = 0, 
  public_flag = 0, private_flag = 0, protected_flag = 0, deprecated_flag = 0,
default_def_flag = 0, u = {bits = {lang_flag_0 = 0, lang_flag_1 = 0,
lang_flag_2 = 0, lang_flag_3 = 0, lang_flag_4 = 0, lang_flag_5 = 0, lang_flag_6
= 0, 
      saturating_flag = 0, unsigned_flag = 0, packed_flag = 0, user_align = 0,
nameless_flag = 0, atomic_flag = 0, spare0 = 0, spare1 = 0, address_space = 0},
length = 0, version = 0}}
(gdb) up
#7  0x00000000005aa461 in gt_ggc_mx_lang_tree_node (x_p=0x7feaec695e60) at
./gtype-lto.h:243
243                  gt_ggc_m_9tree_node
((*x).generic.type_decl.common.common.common.common.common.common.typed.type);
(gdb) print (*x).generic.base
$25 = {code = TYPE_DECL, side_effects_flag = 0, constant_flag = 0,
addressable_flag = 0, volatile_flag = 0, readonly_flag = 0, asm_written_flag =
0, nowarning_flag = 0, visited = 0, used_flag = 0, nothrow_flag = 0,
static_flag = 0, 
  public_flag = 0, private_flag = 1, protected_flag = 0, deprecated_flag = 0,
default_def_flag = 0, u = {bits = {lang_flag_0 = 0, lang_flag_1 = 0,
lang_flag_2 = 0, lang_flag_3 = 0, lang_flag_4 = 0, lang_flag_5 = 0, lang_flag_6
= 0, 
      saturating_flag = 0, unsigned_flag = 0, packed_flag = 0, user_align = 0,
nameless_flag = 0, atomic_flag = 0, spare0 = 0, spare1 = 0, address_space = 0},
length = 0, version = 0}}