[Bug bootstrap/55792] [4.8 Regression] Bad memory access with profiledbootstrap and LTO

["rguenth at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55792

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> 2013-01-08 10:17:16 UTC ---
(In reply to comment #11)
> (In reply to comment #9)
> > Eh.  Diego, how does GTY((user)) work here?  It smells like a bug in vec.h
> > to me.
> > 
> > /* Garbage collection support for vec<T, A, vl_embed>.  */
> > 
> > template<typename T>
> > void
> > gt_ggc_mx (vec<T, va_gc> *v)
> > {
> >   extern void gt_ggc_mx (T &);
> >   for (unsigned i = 0; i < v->length (); i++)
> >     gt_ggc_mx ((*v)[i]);
> > }
> > 
> > doesn't it need to mark the vec itself?  Maybe automatic registration of
> > roots (this is a GC root) does not work with GTY((user))?
> 
> No.  The root is/should be marked by the code calling gt_ggc_mx.  gengtype will
> generate code like:
> 
>   if (ggc_test_and_set_mark (x))
>     {
>       gt_ggc_mx (x);
>     }
> 
> ggc_test_and_set_mark() is the one that marks the root.  Has gengtype generated
> a function for this global?  It should be something like this
> 
> void
> gt_ggc_mx_vec_<mangled_type_name> (void *x_p)
> {
>   vec<type_name,va_gc> * const x = (vec<type_name,va_gc> *)x_p;
>   if (ggc_test_and_set_mark (x))
>     {
>       gt_ggc_mx (x);
>     }
> }

There is

EXPORTED_CONST struct ggc_root_tab gt_ggc_r_gtype_desc_c[] = {
...
  {
    &lto_global_var_decls,
    1,
    sizeof (lto_global_var_decls),
    &gt_ggc_mx_vec_tree_va_gc_,
    &gt_pch_nx_vec_tree_va_gc_
  },

in gtype-desc.c, which looks like

void
gt_ggc_mx_vec_tree_va_gc_ (void *x_p)
{
  vec<tree,va_gc> * const x = (vec<tree,va_gc> *)x_p;
  if (ggc_test_and_set_mark (x))
    {
      gt_ggc_mx (x);
    }
}

with

/* If EXPR is not NULL and previously unmarked, mark it and evaluate
   to true.  Otherwise evaluate to false.  */
#define ggc_test_and_set_mark(EXPR) \
  ((EXPR) != NULL && ((void *) (EXPR)) != (void *) 1 && ! ggc_set_mark (EXPR))

this indeed looks correct to me given vec.h's

template<typename T>
void
gt_ggc_mx (vec<T, va_gc> *v)
{
  extern void gt_ggc_mx (T &);
  for (unsigned i = 0; i < v->length (); i++)
    gt_ggc_mx ((*v)[i]);
}

and the generated(?)

void
gt_ggc_mx (union tree_node *& x)
{
  if (x)
    gt_ggc_mx_lang_tree_node ((void *) x);
}

So I'm still not sure what HJ means with "it's collected".  GC roots are
never collected.  HJ, should your patch fix anything?  What do you think
the bug is?