Bug 97918

Summary: [8/9/10/11 Regression] ICE near htab_hash_string when LTO, -O & -g
Product: gcc Reporter: Jan Engelhardt <jengelh>
Component: c++Assignee: Jason Merrill <jason>
Status: RESOLVED FIXED    
Severity: normal CC: jakub, jason, marxin, mpolacek, rguenth, webrown.cpp
Priority: P3 Keywords: lto
Version: 11.0   
Target Milestone: 8.5   
See Also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93951
Host: Target:
Build: Known to work:
Known to fail: 10.2.1 Last reconfirmed: 2020-11-20 00:00:00
Attachments: Reproducer.

Description Jan Engelhardt 2020-11-20 01:00:32 UTC
Created attachment 49602 [details]
Reproducer.

An ICE is observed on firefox-83 with gcc-10.2.1, persisting in git master du jour too (d3f293348768667c07770e433ff00af51fee73a2).
I distilled the original cpp output from 298k to about 80k lines so far (x3.ii attachment). The last two functions in that file ultimately trigger it all. Perhaps the template parameter packs are causing this…


Taking away any one of -flto, -O or -g makes the compile succeed.

» ./xg++ -B $PWD -std=gnu++17 -flto -O -g -c x3.ii
/home/jengelh/x3.ii: At global scope:
/home/jengelh/x3.ii:80113:1: internal compiler error: Segmentation fault
80113 | }
      | ^
0x103917f crash_signal
        ../.././gcc/toplev.c:330
0x7f09bf684d1f ???
        /usr/src/debug/glibc-2.32-2.1.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x1c09464 htab_hash_string
        ../.././libiberty/hashtab.c:838
0xc71874 external_ref_hasher::hash(external_ref const*)
        ../.././gcc/dwarf2out.c:8963
0xc71874 hash_table<external_ref_hasher, false, xcallocator>::find_slot(external_ref* const&, insert_option)
        ../.././gcc/hash-table.h:435
0xc71874 lookup_external_ref
        ../.././gcc/dwarf2out.c:8991
0xc71943 optimize_external_refs_1
        ../.././gcc/dwarf2out.c:9029
0xc7190f optimize_external_refs_1
        ../.././gcc/dwarf2out.c:9033
0xc71a08 optimize_external_refs
        ../.././gcc/dwarf2out.c:9082
0xc7aae9 output_comp_unit
        ../.././gcc/dwarf2out.c:11101
0xca95a3 dwarf2out_early_finish
        ../.././gcc/dwarf2out.c:32299
0xc066af symbol_table::finalize_compilation_unit()
        ../.././gcc/cgraphunit.c:2537
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

» ./xgcc -v
Using built-in specs.
COLLECT_GCC=./xgcc
Target: x86_64-pc-linux-gnu
Configured with: ./configure --enable-languages=c,c++ --disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.0.0 20201119 (experimental) (GCC)
Comment 1 Marek Polacek 2020-11-20 01:03:21 UTC
This is probably bug 93951.
Comment 2 Richard Biener 2020-11-20 07:25:44 UTC
Yes, it looks very much related - the same "fix" works.  Confirmed.
Comment 3 Jakub Jelinek 2020-11-20 07:29:27 UTC
I'm reducing what looks like the same ICE for 19 hours already and am at 3.5MB so far.
Comment 4 Martin Liška 2020-11-20 07:31:39 UTC
(In reply to Jakub Jelinek from comment #3)
> I'm reducing what looks like the same ICE for 19 hours already and am at
> 3.5MB so far.

Btw. are you using C-Vise or C-Reduce?
Comment 5 Jakub Jelinek 2020-11-20 07:35:43 UTC
cvise.
Comment 6 Jakub Jelinek 2020-11-20 11:52:31 UTC
Reduced testcase (-g -std=c++17 -O1 -flto):
namespace N {
  template <typename, typename>
  bool c;
}
namespace {
class A {};
class B {};
using D = class C {};
class E {};
}
namespace O::P::Q {
struct F {};
}
namespace O::R {
template <typename>
struct G;
template <typename T>
struct H {
  using I = G<decltype (T::foo)>;
  constexpr static unsigned h = I::cr;
};
template <typename T>
A
bar ()
{
  if (N::c<T, P::Q::F>) {
    struct J {
      static void foo();
    };
    H<J>();
  }
  return A ();
}
template <typename T>
A
baz ()
{
  bar<T>;
  return A ();
}
}
namespace O::P {
template <typename T>
A
baz (B, D, C, E, T)
{
  R::baz<T>;
  return A ();
}
A
baz (B cx, D cy, C cz, E d)
{
  baz (cx, cy, cz, d, Q::F{});
  return A ();
}
}
Comment 7 Jakub Jelinek 2020-11-20 11:54:34 UTC
Started with r8-2599-g1ea85365b430b5ade1d0b824e5406c006e6ffdb7 too.
Comment 8 GCC Commits 2020-11-20 21:44:02 UTC
The master branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:89d9c634dc5c10b499c23297ef70133066946790

commit r11-5214-g89d9c634dc5c10b499c23297ef70133066946790
Author: Jason Merrill <jason@redhat.com>
Date:   Fri Nov 20 15:20:45 2020 -0500

    dwarf2: ICE with local class in unused function [PR97918]
    
    Here, since we only mention bar<B>, we never emit debug information for it.
    But we do emit debug information for H<J>::h, so we need to refer to the
    debug info for bar<B>::J even though there is no bar<B>.  We deal with this
    sort of thing in dwarf2out with the limbo_die_list; parentless dies like J
    get attached to the CU at EOF.  But here, we were flushing the limbo list,
    then generating the template argument DIE for H<J> that refers to J, which
    adds J to the limbo list, too late to be flushed.  So let's flush a little
    later.
    
    gcc/ChangeLog:
    
            PR c++/97918
            * dwarf2out.c (dwarf2out_early_finish): flush_limbo_die_list
            after gen_scheduled_generic_parms_dies.
    
    gcc/testsuite/ChangeLog:
    
            PR c++/97918
            * g++.dg/debug/localclass2.C: New test.
Comment 9 Jan Engelhardt 2020-11-20 22:29:24 UTC
The new g++.dg/debug/localclass2.C test file you added is marked "target c++11", but it seems I can only cause the crash with -std=c++17 or later standards. Should the test file perhaps be amended?
Comment 10 Jakub Jelinek 2020-11-20 22:37:12 UTC
For debug/ tests I guess it isn't really used, just documents that the testcase is valid C++11 or later, because debug/ tests iterate over various debug options rather than C++ standard options.
Comment 11 Jakub Jelinek 2020-11-20 22:37:54 UTC
And the default is -std=gnu++17.
Comment 12 GCC Commits 2020-11-24 17:55:05 UTC
The releases/gcc-10 branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:8157b74114f2ba8a6495244f3e171a818a86436a

commit r10-9071-g8157b74114f2ba8a6495244f3e171a818a86436a
Author: Jason Merrill <jason@redhat.com>
Date:   Fri Nov 20 15:20:45 2020 -0500

    dwarf2: ICE with local class in unused function [PR97918]
    
    Here, since we only mention bar<B>, we never emit debug information for it.
    But we do emit debug information for H<J>::h, so we need to refer to the
    debug info for bar<B>::J even though there is no bar<B>.  We deal with this
    sort of thing in dwarf2out with the limbo_die_list; parentless dies like J
    get attached to the CU at EOF.  But here, we were flushing the limbo list,
    then generating the template argument DIE for H<J> that refers to J, which
    adds J to the limbo list, too late to be flushed.  So let's flush a little
    later.
    
    gcc/ChangeLog:
    
            PR c++/97918
            * dwarf2out.c (dwarf2out_early_finish): flush_limbo_die_list
            after gen_scheduled_generic_parms_dies.
    
    gcc/testsuite/ChangeLog:
    
            PR c++/97918
            * g++.dg/debug/localclass2.C: New test.
Comment 13 GCC Commits 2020-11-24 17:57:54 UTC
The releases/gcc-8 branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:ca8325441a6bb06292db9f165607d4e395f46c4b

commit r8-10638-gca8325441a6bb06292db9f165607d4e395f46c4b
Author: Jason Merrill <jason@redhat.com>
Date:   Fri Nov 20 15:20:45 2020 -0500

    dwarf2: ICE with local class in unused function [PR97918]
    
    Here, since we only mention bar<B>, we never emit debug information for it.
    But we do emit debug information for H<J>::h, so we need to refer to the
    debug info for bar<B>::J even though there is no bar<B>.  We deal with this
    sort of thing in dwarf2out with the limbo_die_list; parentless dies like J
    get attached to the CU at EOF.  But here, we were flushing the limbo list,
    then generating the template argument DIE for H<J> that refers to J, which
    adds J to the limbo list, too late to be flushed.  So let's flush a little
    later.
    
    gcc/ChangeLog:
    
            PR c++/97918
            * dwarf2out.c (dwarf2out_early_finish): flush_limbo_die_list
            after gen_scheduled_generic_parms_dies.
    
    gcc/testsuite/ChangeLog:
    
            PR c++/97918
            * g++.dg/debug/localclass2.C: New test.
Comment 14 GCC Commits 2020-11-24 17:58:13 UTC
The releases/gcc-9 branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:196716c10bcd4074c404cc8f13bf8d9b31c76238

commit r9-9067-g196716c10bcd4074c404cc8f13bf8d9b31c76238
Author: Jason Merrill <jason@redhat.com>
Date:   Fri Nov 20 15:20:45 2020 -0500

    dwarf2: ICE with local class in unused function [PR97918]
    
    Here, since we only mention bar<B>, we never emit debug information for it.
    But we do emit debug information for H<J>::h, so we need to refer to the
    debug info for bar<B>::J even though there is no bar<B>.  We deal with this
    sort of thing in dwarf2out with the limbo_die_list; parentless dies like J
    get attached to the CU at EOF.  But here, we were flushing the limbo list,
    then generating the template argument DIE for H<J> that refers to J, which
    adds J to the limbo list, too late to be flushed.  So let's flush a little
    later.
    
    gcc/ChangeLog:
    
            PR c++/97918
            * dwarf2out.c (dwarf2out_early_finish): flush_limbo_die_list
            after gen_scheduled_generic_parms_dies.
    
    gcc/testsuite/ChangeLog:
    
            PR c++/97918
            * g++.dg/debug/localclass2.C: New test.
Comment 15 Jason Merrill 2020-11-25 21:43:30 UTC
Fixed for 8.5/9.4/10.3/11.