[Bug ipa/61842] New: [4.10 Regression]: Firefox start-up SEGFAULT with LTO and O3

[mliska at suse dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61842

            Bug ID: 61842
           Summary: [4.10 Regression]: Firefox start-up SEGFAULT with LTO
                    and O3
           Product: gcc
           Version: 4.10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: mliska at suse dot cz

Firefox: https://github.com/marxin/gecko-dev/tree/lto-stable (revision:
88a7edf3bab2d1b9a2c140c1f36217f4fbdd1e03)
GCC revision: r212778 with applied
(https://gcc.gnu.org/ml/gcc-patches/2014-07/msg00929.html)

error:
*** Error in
`/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/firefox':
double free or corruption (fasttop): 0x0000000000587930 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7410f)[0x7ffff737d10f]
/lib64/libc.so.6(+0x7996e)[0x7ffff738296e]
/lib64/libc.so.6(+0x7a647)[0x7ffff7383647]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(+0xa7120f)[0x7ffff2d0120f]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(+0xaf2e54)[0x7ffff2d82e54]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(+0xb54ebc)[0x7ffff2de4ebc]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(+0xb55d81)[0x7ffff2de5d81]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(+0xac9d77)[0x7ffff2d59d77]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(+0x244b27f)[0x7ffff46db27f]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(+0x244b415)[0x7ffff46db415]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/libxul.so(XRE_main+0x203c)[0x7ffff46e221c]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/firefox[0x4074af]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/firefox[0x402fc8]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7ffff732abe5]
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/dist/bin/firefox[0x403051]

BT:
Program received signal SIGABRT, Aborted.
0x00007ffff733e849 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
56    ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff733e849 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff733fcd8 in __GI_abort () at abort.c:89
#2  0x00007ffff737d114 in __libc_message (do_abort=do_abort@entry=2,
fmt=fmt@entry=0x7ffff7473220 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff738296e in malloc_printerr (action=3, str=0x7ffff7473408 "double
free or corruption (fasttop)", ptr=<optimized out>)
    at malloc.c:4916
#4  0x00007ffff7383647 in _int_free (av=<optimized out>, p=0x587920,
have_lock=0) at malloc.c:3772
#5  0x00007ffff2d0120f in operator delete () at
../../../dist/include/mozilla/mozalloc.h:225
#6  __base_dtor (this=<synthetic pointer>) at
../../../dist/include/nsAutoPtr.h:73
#7  nsPrefBranch::RemoveObserver (this=<optimized out>, aDomain=<optimized
out>, aObserver=<optimized out>)
    at
/home/marxin/Programming/gecko-dev/modules/libpref/src/nsPrefBranch.cpp:658
#8  0x00007ffff2d82e54 in nsSocketTransportService::Shutdown (this=0x586690)
    at
/home/marxin/Programming/gecko-dev/netwerk/base/src/nsSocketTransportService2.cpp:537
#9  0x00007ffff2de4ebc in nsIOService::SetOffline (this=0x582260,
offline=<optimized out>)
    at /home/marxin/Programming/gecko-dev/netwerk/base/src/nsIOService.cpp:748
#10 0x00007ffff2de5d81 in nsIOService::Observe (this=0x582260,
subject=<optimized out>, topic=<optimized out>, 
    data=0x7ffff56bd7a0 <nsXREDirProvider::DoShutdown()::kShutdownPersist>
u"shutdown-persist")
    at /home/marxin/Programming/gecko-dev/netwerk/base/src/nsIOService.cpp:918
#11 0x00007ffff2d59d77 in NotifyObservers (
    someData=0x7ffff56bd7a0 <nsXREDirProvider::DoShutdown()::kShutdownPersist>
u"shutdown-persist", 
    aTopic=0x7ffff542f899 "profile-change-net-teardown", aSubject=0x0,
this=<optimized out>)
    at /home/marxin/Programming/gecko-dev/xpcom/ds/nsObserverList.cpp:96
#12 nsObserverService::NotifyObservers (this=0x57b8f0, aSubject=0x0,
aTopic=0x7ffff542f899 "profile-change-net-teardown", 
    someData=0x7ffff56bd7a0 <nsXREDirProvider::DoShutdown()::kShutdownPersist>
u"shutdown-persist")
    at /home/marxin/Programming/gecko-dev/xpcom/ds/nsObserverService.cpp:303
#13 0x00007ffff46db27f in _ZN16nsXREDirProvider10DoShutdownEv.part.17
(this=0x7fffffffc220)
    at /home/marxin/Programming/gecko-dev/toolkit/xre/nsXREDirProvider.cpp:853
#14 0x00007ffff46db415 in DoShutdown (this=<optimized out>) at
/home/marxin/Programming/gecko-dev/toolkit/xre/nsAppRunner.cpp:1204
#15 __base_dtor  (this=0x50bdc0) at
/home/marxin/Programming/gecko-dev/toolkit/xre/nsAppRunner.cpp:1196
#16 0x00007ffff46e221c in XRE_main (aAppData=<optimized out>, argv=<optimized
out>, argc=<optimized out>, this=<optimized out>)
    at /home/marxin/Programming/gecko-dev/toolkit/xre/nsAppRunner.cpp:4109
#17 XRE_main (argc=7864321, argv=0x50bdc0, aAppData=0x1, aFlags=4294967295)
    at /home/marxin/Programming/gecko-dev/toolkit/xre/nsAppRunner.cpp:4298
#18 0x00000000004074af in do_main(int, char**, nsIFile*) [clone .lto_priv.42]
(argc=argc@entry=1, argv=argv@entry=0x7fffffffdac8, 
    xreDirectory=0x415010) at
/home/marxin/Programming/gecko-dev/browser/app/nsBrowserApp.cpp:282
#19 0x0000000000402fc8 in main (argc=1, argv=0x7fffffffdac8) at
/home/marxin/Programming/gecko-dev/browser/app/nsBrowserApp.cpp:643

Thank you,
Martin