[Bug tree-optimization/70427] New: autofdo bootstrap generates wrong code

[andi-gcc at firstfloor dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70427

            Bug ID: 70427
           Summary: autofdo bootstrap generates wrong code
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: andi-gcc at firstfloor dot org
  Target Milestone: ---

I've been working on building gcc with an autofdo bootstrap.

Currently I always run into an crash while rebuilding tree.c with the stage2
compiler and the autofdo information 

Looking at the code it is clearly miscompiled in ipa_profile_generate_summary:

                        struct cgraph_edge * e = node->get_edge (stmt);
                        if (e && !e->indirect_unknown_callee)
                          continue;


   0x000000000093bb16 <+326>:   callq  0x7be530
<_ZN11cgraph_node8get_edgeEP6gimple> 
   0x000000000093bb1b <+331>:   test   %rax,%rax           # check for NUULL
   0x000000000093bb1e <+334>:   mov    %rax,%r8
   0x000000000093bb21 <+337>:   je     0x93bb2d           
<_ZL28ipa_profile_generate_summaryv+349>
   0x000000000093bb23 <+339>:   testb  $0x2,0x60(%rax)
   0x000000000093bb27 <+343>:   je     0x93baa7
<_ZL28ipa_profile_generate_summaryv+215>
   0x000000000093bb2d <+349>:   mov    0x10(%r13),%rax     # go here because of
NULL
=> 0x000000000093bb31 <+353>:   mov    0x40(%r8),%rsi      # but we still
reference!

(gdb) p $r8
$4 = 0

The crash is on bb31 because r8 is NULL. The code checked the return value of
the call, but then references it afterwards before doing the continue.

Command line option:

cc1plus -fauto-profile=cc1plus.fda  -g -O2 tree.i

cc1plus.fda is at http://halobates.de/cc1plus.fda (too big to attach)