Bug 64043 - [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_at_offset/tree.c:11914
Summary: [5 Regression] ICE (segfault) with LTO: in tree_check/tree.h:2758 get_binfo_a...
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: lto (show other bugs)
Version: 5.0
: P1 normal
Target Milestone: 5.0
Assignee: Jan Hubicka
URL:
Keywords: ice-on-valid-code
: 64285 (view as bug list)
Depends on:
Blocks:
 
Reported: 2014-11-24 09:59 UTC by Tobias Burnus
Modified: 2015-01-29 07:16 UTC (History)
4 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2014-11-24 00:00:00


Attachments
Test case (unpack, run "make") (2.42 KB, application/gzip)
2014-11-24 09:59 UTC, Tobias Burnus
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Tobias Burnus 2014-11-24 09:59:43 UTC
Created attachment 34087 [details]
Test case (unpack, run "make")

Using GCC 5.0.0 20141121, the attached program fails with the following ICE.

To reproduce: Unpack and hit "make". It will compile one.ii and two.ii and gcc-ar them to libonetwo.ii; it compiles three.ii - and then LTOs them together.

(Requires an LD with plugin capabilities; I've put the git version of binutils into the path.)

The failure is:

0xa36e4f crash_signal
        ../../gcc/toplev.c:359
0xc97211 tree_check(tree_node*, char const*, int, char const*, tree_code)
        ../../gcc/tree.h:2758
0xc97211 get_binfo_at_offset(tree_node*, long, tree_node*)
        ../../gcc/tree.c:11914
0x884cf4 possible_polymorphic_call_targets(tree_node*, long, ipa_polymorphic_call_context, bool*, void**, bool)
        ../../gcc/ipa-devirt.c:2404
0x7ef9d7 possible_polymorphic_call_targets(tree_node*, gimple_statement_base*, bool*, void**)
        ../../gcc/ipa-utils.h:126
0x7edcd0 gimple_fold_call
        ../../gcc/gimple-fold.c:2667
0x7edcd0 fold_stmt_1
        ../../gcc/gimple-fold.c:3246
0xb55323 execute
        ../../gcc/tree-ssa-forwprop.c:2228
Comment 1 Markus Trippelsdorf 2014-11-24 10:29:34 UTC
This is a case of -O0 vs -O2 (during final link):

Further reduced:

markus@x4 testcase % cat one.ii
class Validator
{
public:
  virtual ~Validator ();
};
class FooWriter
{
  Validator *validator;
  ~FooWriter ();
};
FooWriter::~FooWriter () { delete validator; }

markus@x4 testcase % g++ -flto -std=c++11 -c one.ii
markus@x4 testcase % g++ -r -nostdlib -O2 -flto one.o
one.ii: In member function ‘__base_dtor ’:
one.ii:11:1: internal compiler error: Segmentation fault
 FooWriter::~FooWriter () { delete validator; }
 ^
0x9dc45f crash_signal
        ../../gcc/gcc/toplev.c:359
0xc3f211 tree_check
        ../../gcc/gcc/tree.h:2758
0xc3f211 get_binfo_at_offset(tree_node*, long, tree_node*)
        ../../gcc/gcc/tree.c:11914
0x82855b possible_polymorphic_call_targets(tree_node*, long, ipa_polymorphic_call_context, bool*, void**, bool)
        ../../gcc/gcc/ipa-devirt.c:2404
0x792a2f possible_polymorphic_call_targets(tree_node*, gimple_statement_base*, bool*, void**)
        ../../gcc/gcc/ipa-utils.h:126
0x790c4a gimple_fold_call
        ../../gcc/gcc/gimple-fold.c:2667
0x790c4a fold_stmt_1
        ../../gcc/gcc/gimple-fold.c:3246
0xafb1a3 execute
        ../../gcc/gcc/tree-ssa-forwprop.c:2228
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
lto-wrapper: fatal error: /var/tmp/gcc_test/usr/local/bin/g++ returned 1 exit status
compilation terminated.
/usr/bin/ld: fatal error: lto-wrapper failed
collect2: error: ld returned 1 exit status
Comment 2 Jan Hubicka 2014-12-01 23:09:00 UTC
Mine.
Comment 3 Jan Hubicka 2014-12-02 21:04:36 UTC
OK, the problem is that the unit is compiled without -O2 and -fdevirtualize is not properly marked as Optimization (have separate patch for this).

However it seems that for units that are not optimized with -fdevirtualize we can just drop OBJ_TYPE_REF and save some of IL memory?

Jason, does this have chance to interfere with devirtualization required by C++ language that happens at -fno-devirtualize too?

Honza

Index: cp/class.c
===================================================================
--- cp/class.c  (revision 218249)
+++ cp/class.c  (working copy)
@@ -736,7 +736,8 @@ build_vfn_ref (tree instance_ptr, tree i
                   cp_build_addr_expr (aref, tf_warning_or_error));
 
   /* Remember this as a method reference, for later devirtualization.  */
-  aref = build3 (OBJ_TYPE_REF, TREE_TYPE (aref), aref, instance_ptr, idx);
+  if (flag_devirtualize)
+    aref = build3 (OBJ_TYPE_REF, TREE_TYPE (aref), aref, instance_ptr, idx);
 
   return aref;
 }
Index: testsuite/g++.dg/lto/pr64043_0.C
===================================================================
--- testsuite/g++.dg/lto/pr64043_0.C    (revision 0)
+++ testsuite/g++.dg/lto/pr64043_0.C    (revision 0)
@@ -0,0 +1,14 @@
+// { dg-lto-do link }
+// { dg-lto-options { { -flto -std=c++11 } } }
+// { dg-extra-ld-options "-r -nostdlib -O2" }
+class Validator
+{
+public:
+  virtual ~Validator ();
+};
+class FooWriter
+{
+  Validator *validator;
+  ~FooWriter ();
+};
+FooWriter::~FooWriter () { delete validator; }
Comment 4 Jan Hubicka 2014-12-02 21:08:00 UTC
Actually my tree has flag_devirtualize marked as Optimization, as a separate problem I need to figure out how it happens to be true.
Comment 5 Jason Merrill 2014-12-02 21:20:11 UTC
(In reply to Jan Hubicka from comment #3)
> Jason, does this have chance to interfere with devirtualization required by
> C++ language that happens at -fno-devirtualize too?

No, non-virtual calls to virtual functions never make it to build_vfn_ref.
Comment 6 Tobias Burnus 2014-12-12 15:41:22 UTC
*** Bug 64285 has been marked as a duplicate of this bug. ***
Comment 7 Tobias Burnus 2014-12-12 15:43:04 UTC
Now fails with the following backtrace. The location of the failure might have changed due to the patch at https://gcc.gnu.org/ml/gcc-patches/2014-12/msg01076.html ; in any case, currently the failure is:


foo.ii: In member function ‘__base_dtor ’:
foo.ii:11:1: internal compiler error: Segmentation fault
 FooWriter::~FooWriter () { delete validator; }
 ^
0xa1f99f crash_signal
        ../../gcc/toplev.c:358
0x873daf tree_check(tree_node*, char const*, int, char const*, tree_code)
        ../../gcc/tree.h:2778
0x873daf ipa_polymorphic_call_context::get_dynamic_type(tree_node*, tree_node*, tree_node*, gimple_statement_base*)
0xb9787e eliminate_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/tree-ssa-pre.c:4334
Comment 8 Jan Hubicka 2014-12-12 19:01:21 UTC
The following patch should help.  Still need to work out why flag_devirtualize is set at final link - it should not
Index: tree.c
===================================================================
--- tree.c      (revision 218658)
+++ tree.c      (working copy)
@@ -11870,6 +11870,11 @@
   if (TREE_CODE (target) == FUNCTION_TYPE)
     return false;
   gcc_checking_assert (TREE_CODE (target) == METHOD_TYPE);
+  /* If we do not have BINFO associated, it means that type was built
+     without devirtualization enabled.  Do not consider this a virtual
+     call.  */
+  if (!TYPE_BINFO (obj_type_ref_class (target)))
+    return false;
   return true;
 }
Comment 9 Jan Hubicka 2014-12-15 03:42:13 UTC
Author: hubicka
Date: Mon Dec 15 03:41:41 2014
New Revision: 218727

URL: https://gcc.gnu.org/viewcvs?rev=218727&root=gcc&view=rev
Log:

	PR lto/64043
	* tree.c (virtual_method_call_p): Return false when OTR type has
	no BINFO.
	* g++.dg/lto/pr64043_0.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/lto/pr64043_0.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree.c
Comment 10 Jan Hubicka 2014-12-15 22:35:52 UTC
Author: hubicka
Date: Mon Dec 15 22:35:20 2014
New Revision: 218767

URL: https://gcc.gnu.org/viewcvs?rev=218767&root=gcc&view=rev
Log:

	PR lto/64043
	* gcc.dg/lto/20110201-1_0.c: New testcase.

	* tree-streamer.c (preload_common_nodes): Skip preloading
	of main_identifier_node, pid_type and optimization/option nodes.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gcc.dg/lto/20110201-1_0.c
    trunk/gcc/tree-streamer.c
Comment 11 Andreas Schwab 2014-12-16 11:22:28 UTC
This breaks ada:

$ gcc/gnatmake --GCC=gcc/xgcc --GNATBIND=gcc/gnatbind --GNATLINK=gcc/gnatlink -cargs -Bgcc/ -largs '--GCC=gcc/xgcc -Bgcc'  -margs --RTS=ia64-suse-linux/./libada -f ../gcc/testsuite/gnat.dg/lto8.adb -gnatws -flto -lm -o ./lto8.exe
gcc/xgcc -c -I../gcc/testsuite/gnat.dg/ -Bgcc/ --RTS=ia64-suse-linux/./libada -gnatws -flto -lm -I- ../gcc/testsuite/gnat.dg/lto8.adb
gcc/xgcc -c -I../gcc/testsuite/gnat.dg/ -Bgcc/ --RTS=ia64-suse-linux/./libada -gnatws -flto -lm -I- ../gcc/testsuite/gnat.dg/lto8_pkg.adb
gcc/gnatbind --RTS=ia64-suse-linux/./libada -x lto8.ali
gcc/gnatlink lto8.ali --GCC=gcc/xgcc -Bgcc -flto -o ./lto8.exe
../gcc/testsuite/gnat.dg/lto8_pkg.ads: In function ‘lto8_pkg___elabs’:
../gcc/testsuite/gnat.dg/lto8_pkg.ads:4:1: internal compiler error: in expand_gimple_stmt_1, at cfgexpand.c:3420
 package Lto8_Pkg is
 ^
0x400000000026d36f expand_gimple_stmt_1
        ../../gcc/cfgexpand.c:3420
0x400000000026e52f expand_gimple_stmt
        ../../gcc/cfgexpand.c:3447
0x400000000027014f expand_gimple_basic_block
        ../../gcc/cfgexpand.c:5280
0x400000000027453f execute
        ../../gcc/cfgexpand.c:5889
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
lto-wrapper: fatal error: /usr/local/gcc/test/Build/gcc/xgcc returned 1 exit status
Comment 12 Dominique d'Humieres 2014-12-17 14:29:26 UTC
> This breaks ada: ...

It is now pr64340.
Comment 13 Igor Zamyatin 2014-12-22 15:03:50 UTC
I also see performance degradation for several spec2006 tests after this commit (mostly on FP tests).
Eg. on Haswell 433.milc shows ~-7-8% if compiled with "-O3 -flto -funroll-loops -march=core-avx2"

Not investigated this so far though
Comment 14 Jan Hubicka 2014-12-22 15:17:25 UTC
Hi,
do you use same flags at compile time and link time?
I did not see anything unusual at our testers, but perhaps some of the optimization flags are streamed wrong?

Honza
Comment 15 Igor Zamyatin 2014-12-22 15:36:07 UTC
Just checked: everywhere "-Ofast -flto -funroll-loops -static -m64   -march=core-avx2" used (not -O3 as I mentioned before)
Comment 16 Igor Zamyatin 2015-01-12 07:47:22 UTC
Hi, Honza!

I still see that performance degradations for spec2006 tests. Could you please check those on your side?
Comment 17 Jan Hubicka 2015-01-14 06:37:27 UTC
Unforutnately it is a bit difficult without Haswell machine. Would be possible to profile it and post the difference in internal loops?
Possibly the target option node is not streamed fully and some flags are getting lost, though I do not see how that can happen...
Comment 18 Jan Hubicka 2015-01-29 07:16:47 UTC
Igor,
I believe the perofmrance issue is fixed and the Ada issue is separate PR. I think we can close this PR. If performance issue remain, please just open PR for that.
The original problem is fixed now.