Bug 50946 - [4.6 Regression] ICE on armhf with webkitgtk+
Summary: [4.6 Regression] ICE on armhf with webkitgtk+
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: target (show other bugs)
Version: 4.6.2
: P3 normal
Target Milestone: 4.7.0
Assignee: Not yet assigned to anyone
URL:
Keywords: ice-on-valid-code
Depends on:
Blocks:
 
Reported: 2011-11-01 19:54 UTC by Konstantinos Margaritis
Modified: 2013-04-12 16:18 UTC (History)
4 users (show)

See Also:
Host:
Target: arm-linux-gnueabihf
Build:
Known to work: 4.5.3, 4.7.0
Known to fail: 4.6.3
Last reconfirmed: 2011-11-01 00:00:00

Attachments
minimal testcase produced using delta tool from Source/WebCore/bindings/js/SerializedScriptValue.cpp in webkitgtk+ (913 bytes, application/octet-stream)
2011-11-01 19:54 UTC, Konstantinos Margaritis 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Konstantinos Margaritis 2011-11-01 19:54:49 UTC 
Created attachment 25677 [details]
minimal testcase produced using delta tool from Source/WebCore/bindings/js/SerializedScriptValue.cpp in webkitgtk+

webkitgtk+_1.4.2-2 fails to build from source on Debian armhf due to a gcc ICE:

http://buildd.debian-ports.org/status/fetch.php?pkg=webkitgtk%2B&arch=armhf&ver=1.4.2-2&stamp=1311782209

Compiler originally used was g++ 4.6.1-10 but the same ICE appears with 4.6.2-3 (current Debian/unstable):

...
  CXX    Source/WebCore/bindings/js/libWebCore_la-SerializedScriptValue.lo
In file included from ../Source/JavaScriptCore/wtf/PassRefPtr.h:25:0,
                 from ../Source/JavaScriptCore/wtf/RefPtr.h:28,
                 from ../Source/JavaScriptCore/wtf/HashFunctions.h:24,
                 from ../Source/JavaScriptCore/wtf/HashTraits.h:24,
                 from ../Source/JavaScriptCore/runtime/JSValue.h:31,
                 from
../Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h:29,
                 from ../Source/JavaScriptCore/runtime/JSGlobalData.h:32,
                 from ../Source/JavaScriptCore/interpreter/CallFrame.h:26,
                 from ../Source/JavaScriptCore/runtime/ArgList.h:25,
                 from ../Source/JavaScriptCore/runtime/JSObject.h:26,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/wtf/NullPtr.h:48:1: warning: identifier
'nullptr' will become a keyword in C++0x [-Wc++0x-compat]
In file included from ../Source/JavaScriptCore/runtime/JSObject.h:31:0,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/runtime/JSCell.h: In member function 'void*
JSC::MarkedBlock::allocate()':
../Source/JavaScriptCore/runtime/JSCell.h:380:78: warning: cast from
'char (*)[8]' to 'JSC::JSCell*' increases required alignment of target
type [-Wcast-align]
In file included from ../Source/JavaScriptCore/collector/handles/Handle.h:29:0,
                 from
../Source/JavaScriptCore/collector/handles/HandleHeap.h:30,
                 from ../Source/JavaScriptCore/runtime/Heap.h:25,
                 from ../Source/JavaScriptCore/runtime/JSGlobalData.h:33,
                 from ../Source/JavaScriptCore/interpreter/CallFrame.h:26,
                 from ../Source/JavaScriptCore/runtime/ArgList.h:25,
                 from ../Source/JavaScriptCore/runtime/JSObject.h:26,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::JSGlobalObject]':
../Source/JavaScriptCore/runtime/ScopeChain.h:76:86:   instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::JSGlobalObject*' increases required
alignment of target type [-Wcast-align]
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::ObjectPrototype]':
../Source/JavaScriptCore/runtime/JSGlobalObject.h:185:81:
instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::ObjectPrototype*' increases required
alignment of target type [-Wcast-align]
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::StringPrototype]':
../Source/JavaScriptCore/runtime/JSGlobalObject.h:189:81:
instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::StringPrototype*' increases required
alignment of target type [-Wcast-align]
../Source/JavaScriptCore/runtime/WriteBarrier.h: In member function
'T* JSC::WriteBarrierBase<T>::get() const [with T =
JSC::NumberPrototype]':
../Source/JavaScriptCore/runtime/JSGlobalObject.h:190:81:
instantiated from here
../Source/JavaScriptCore/runtime/WriteBarrier.h:97:56: warning: cast
from 'JSC::JSCell*' to 'JSC::NumberPrototype*' increases required
alignment of target type [-Wcast-align]
In file included from
../Source/JavaScriptCore/collector/handles/HandleHeap.h:30:0,
                 from ../Source/JavaScriptCore/runtime/Heap.h:25,
                 from ../Source/JavaScriptCore/runtime/JSGlobalData.h:33,
                 from ../Source/JavaScriptCore/interpreter/CallFrame.h:26,
                 from ../Source/JavaScriptCore/runtime/ArgList.h:25,
                 from ../Source/JavaScriptCore/runtime/JSObject.h:26,
                 from ../Source/JavaScriptCore/runtime/JSArray.h:24,
                 from ../Source/JavaScriptCore/runtime/JSGlobalObject.h:25,
                 from ../Source/WebCore/bindings/js/JSDOMGlobalObject.h:30,
                 from ../Source/WebCore/bindings/js/JSDOMBinding.h:25,
                 from ../Source/WebCore/bindings/js/ScriptValue.h:34,
                 from ../Source/WebCore/bindings/js/SerializedScriptValue.h:30,
                 from
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:28:
../Source/JavaScriptCore/collector/handles/Handle.h: In static member
function 'static T* JSC::HandleTypes<T>::getFromSlot(JSC::HandleSlot)
[with T = WebCore::DOMObject, JSC::HandleTypes<T>::ExternalType =
WebCore::DOMObject*, JSC::HandleSlot = JSC::JSValue*]':
../Source/JavaScriptCore/runtime/WeakGCPtr.h:59:74:   instantiated
from 'JSC::WeakGCPtr<T>::ExternalType JSC::WeakGCPtr<T>::get() const
[with T = WebCore::DOMObject, JSC::WeakGCPtr<T>::ExternalType =
WebCore::DOMObject*]'
../Source/WebCore/bindings/js/ScriptWrappable.h:47:30:   instantiated from here
../Source/JavaScriptCore/collector/handles/Handle.h:94:130: warning:
cast from 'JSC::JSCell*' to
'JSC::HandleTypes<WebCore::DOMObject>::ExternalType {aka
WebCore::DOMObject*}' increases required alignment of target type
[-Wcast-align]
../Source/WebCore/bindings/js/SerializedScriptValue.cpp: In member
function 'void WebCore::CloneSerializer::write(double)':
../Source/WebCore/bindings/js/SerializedScriptValue.cpp:499:5:
internal compiler error: in simplify_gen_subreg_concatn, at
lower-subreg.c:489
Please submit a full bug report,
with preprocessed source if appropriate.
See <file:///usr/share/doc/gcc-4.6/README.Bugs> for instructions.

I used the delta package to produce a minimal testcase for the ICE
which I attach.
You can reproduce the ICE with g++ -O2 -fpermissive -Wfatal-errors -w
webkit_testcase-min.i.

The bug has also been reported to the Debian BTS:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641849

Thanks

Konstantinos
Comment 1 Richard Earnshaw 2011-11-01 20:56:25 UTC 
arm-linux-gnueabihf isn't a configuration supported by FSF GCC; if this is vendor distribution you need to contact your vendor.  Alternatively you need to show how to produce this on the FSF sources.
Comment 2 Konstantinos Margaritis 2011-11-01 21:15:29 UTC 
This is the actual cmd line used:

g++ -O2 -mfpu=vfpv3 -mfloat-abi=hard -march=armv7-a -mthumb -fpermissive -w -c webkit_testcase-min.i 

The Debian armhf package is based on SVN 20111028 (r180603) from the
gcc-4_6-branch.
Comment 3 Matthew Gretton-Dann 2012-01-18 13:57:12 UTC 
I can reproduce this for GCC 4.6.2 (rev 183061) with an bare-metal target (arm-none-eabi):c

arm-none-eabi-g++ -O2 -mfpu=vfpv3 -mfloat-abi=hard -march=armv7-a -mthumb -fpermissive -w -c webkit_testcase-min.i 

Current trunk does not ICE on the test case.
Comment 4 Mikael Pettersson 2012-02-19 17:29:00 UTC 
The ICE stopped on trunk with Richard Sandiford's "Tighten ARM's CANNOT_CHANGE_MODE_CLASS" patch in r171520:
http://gcc.gnu.org/ml/gcc-patches/2011-03/msg01631.html
http://gcc.gnu.org/ml/gcc-cvs/2011-03/msg00945.html

The patch was described only as improving code quality, not as fixing any specific bugs, so it's possible the underlying bug is still latent on trunk.
Comment 5 Matthias Klose 2012-02-28 20:07:20 UTC 
works with 4.5 branch and trunk, still ftbfs with 4.6.
Comment 6 Jakub Jelinek 2013-04-12 16:18:05 UTC 
The 4.6 branch has been closed, fixed in GCC 4.7.0.