[Bug c++/12316] [3.4 regression] trouble with garbage collection

["steven at gcc dot gnu dot org" <gcc-bugzilla at gcc dot gnu dot org>]

PLEASE REPLY TO gcc-bugzilla@gcc.gnu.org ONLY, *NOT* gcc-bugs@gcc.gnu.org.

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=12316



------- Additional Comments From steven at gcc dot gnu dot org  2003-09-17 17:49 -------
I'm not an expert, but I can speculate about what's going on here...

It seems that the member "varray inlined_fns" of the "struct inline data" in
tree-inline.c does not have a GC root, so it gets garbage collected.  This code
hasn't been touched in a while, so one can speculate that the recent changes
only uncovered a latent bug, by somehow calling ggc_collect() in the middle of
the process of inlining...

Here's a backtrace:
#0  0x40048c56 in exit () from /lib/libc.so.6
#1  0x0832a66e in alloc_page (order=106) at ../../mainline/gcc/ggc-page.c:646
#2  0x08329053 in ggc_alloc (size=43) at ../../mainline/gcc/ggc-page.c:1051
#3  0x08309a49 in make_tree_vec (len=-1515870811)
    at ../../mainline/gcc/tree.c:571
#4  0x08344dee in optimize_inline_calls (fn=0x401adec4)
    at ../../mainline/gcc/tree-inline.c:1629
#5  0x08347906 in cgraph_optimize_function (node=0x401b03cc)
    at ../../mainline/gcc/cgraphunit.c:467
#6  0x0834792c in cgraph_expand_function (node=0x401b03cc)
    at ../../mainline/gcc/cgraphunit.c:487
#7  0x08347041 in cgraph_assemble_pending_functions ()
    at ../../mainline/gcc/cgraphunit.c:141
#8  0x08347165 in cgraph_finalize_function (decl=0x401adec4, nested=false)
    at ../../mainline/gcc/cgraphunit.c:217
#9  0x08105df4 in expand_or_defer_fn (fn=0x401a0ec4)
    at ../../mainline/gcc/cp/semantics.c:2943

Note that in #3 the tree_vec length is not quite OK:

#4  0x08344dee in optimize_inline_calls (fn=0x401adec4)
    at ../../mainline/gcc/tree-inline.c:1629
1629          tree ifn = make_tree_vec (VARRAY_ACTIVE_SIZE (id.inlined_fns));
(gdb) p *id.inlined_fns
$7 = {num_elements = 2779096485, elements_used = 2779096485,
  type = 2779096485, name = 0xa5a5a5a5 "", data = {c = "?", uc = "?", s = {
      -23131}, us = {42405}, i = {-1515870811}, u = {2779096485}, l = {
      -1515870811}, ul = {2779096485}, hint = {-1515870811}, uhint = {
      2779096485}, generic = {0xa5a5a5a5}, cptr = {0xa5a5a5a5 ""}, rtx = {
      0xa5a5a5a5}, rtvec = {0xa5a5a5a5}, tree = {0xa5a5a5a5}, bitmap = {
      0xa5a5a5a5}, reg = {0xa5a5a5a5}, const_equiv = {{rtx = 0xa5a5a5a5,
        age = 2779096485}}, bb = {0xa5a5a5a5}, te = {0xa5a5a5a5}}}
(gdb)

and id.inlined_fns is allocated with ggc_alloc()...