http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59737
--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> --- Valgrind shows: ==26377== Invalid read of size 4 ==26377== at 0x7D91EE: fold_stmt_1(gimple_stmt_iterator*, bool) (gimple-fold.c:1186) ==26377== by 0x997F29: fold_marked_statements(int, pointer_set_t*) (tree-inline.c:4511) ==26377== by 0x99FF50: optimize_inline_calls(tree_node*) (tree-inline.c:4592) ==26377== by 0xDAF93E: (anonymous namespace)::pass_early_inline::execute() (ipa-inline.c:2272) ==26377== by 0x8BC9C9: execute_one_pass(opt_pass*) (passes.c:2226) ==26377== by 0x8BCC45: execute_pass_list(opt_pass*) (passes.c:2279) ==26377== by 0x8BB54D: do_per_function_toporder(void (*)(void*), void*) (passes.c:1627) ==26377== by 0x8BD156: execute_ipa_pass_list(opt_pass*) (passes.c:2610) ==26377== by 0x6E4229: compile() (cgraphunit.c:2033) ==26377== by 0x6E4A74: finalize_compilation_unit() (cgraphunit.c:2319) ==26377== by 0x5960C4: cp_write_global_declarations() (decl2.c:4431) ==26377== by 0x957DCC: compile_file() (toplev.c:562) ==26377== Address 0x5627794 is 4 bytes inside a block of size 40 free'd ==26377== at 0x402AABE: realloc (vg_replace_malloc.c:687) ==26377== by 0xE4BF8C: xrealloc (xmalloc.c:179) ==26377== by 0x803712: maybe_record_node(vec<cgraph_node*, va_heap, vl_ptr>&, tree_node*, pointer_set_t*, bool*) (vec.h:293) ==26377== by 0x805668: possible_polymorphic_call_targets(tree_node*, long, ipa_polymorphic_call_context, bool*, void**) (ipa-devirt.c:1185) ==26377== by 0x7D91DA: fold_stmt_1(gimple_stmt_iterator*, bool) (ipa-utils.h:135) ==26377== by 0x997F29: fold_marked_statements(int, pointer_set_t*) (tree-inline.c:4511) ==26377== by 0x99FF50: optimize_inline_calls(tree_node*) (tree-inline.c:4592) ==26377== by 0xDAF93E: (anonymous namespace)::pass_early_inline::execute() (ipa-inline.c:2272) ==26377== by 0x8BC9C9: execute_one_pass(opt_pass*) (passes.c:2226) ==26377== by 0x8BCC45: execute_pass_list(opt_pass*) (passes.c:2279) ==26377== by 0x8BB54D: do_per_function_toporder(void (*)(void*), void*) (passes.c:1627) ==26377== by 0x8BD156: execute_ipa_pass_list(opt_pass*) (passes.c:2610) ==26377== ==26377== Invalid read of size 1 ==26377== at 0x8061D8: hash_table<polymorphic_call_target_hasher, xcallocator>::dispose() (vec.h:1656) ==26377== by 0x804386: free_polymorphic_call_targets_hash() (ipa-devirt.c:845) ==26377== by 0x6DCD08: cgraph_remove_node(cgraph_node*) (cgraph.c:364) ==26377== by 0x8248D4: symtab_remove_unreachable_nodes(bool, _IO_FILE*) (ipa.c:472) ==26377== by 0x6E4027: compile() (cgraphunit.c:2176) ==26377== by 0x6E4A74: finalize_compilation_unit() (cgraphunit.c:2319) ==26377== by 0x5960C4: cp_write_global_declarations() (decl2.c:4431) ==26377== by 0x957DCC: compile_file() (toplev.c:562) ==26377== by 0x959A27: toplev_main(int, char**) (toplev.c:1914) ==26377== by 0x4ED5F8F: (below main) (in /lib64/libc-2.18.90.so) ==26377== Address 0x5627793 is 3 bytes inside a block of size 40 free'd ==26377== at 0x402AABE: realloc (vg_replace_malloc.c:687) ==26377== by 0xE4BF8C: xrealloc (xmalloc.c:179) ==26377== by 0x803712: maybe_record_node(vec<cgraph_node*, va_heap, vl_ptr>&, tree_node*, pointer_set_t*, bool*) (vec.h:293) ==26377== by 0x805668: possible_polymorphic_call_targets(tree_node*, long, ipa_polymorphic_call_context, bool*, void**) (ipa-devirt.c:1185) ==26377== by 0x7D91DA: fold_stmt_1(gimple_stmt_iterator*, bool) (ipa-utils.h:135) ==26377== by 0x997F29: fold_marked_statements(int, pointer_set_t*) (tree-inline.c:4511) ==26377== by 0x99FF50: optimize_inline_calls(tree_node*) (tree-inline.c:4592) ==26377== by 0xDAF93E: (anonymous namespace)::pass_early_inline::execute() (ipa-inline.c:2272) ==26377== by 0x8BC9C9: execute_one_pass(opt_pass*) (passes.c:2226) ==26377== by 0x8BCC45: execute_pass_list(opt_pass*) (passes.c:2279) ==26377== by 0x8BB54D: do_per_function_toporder(void (*)(void*), void*) (passes.c:1627) ==26377== by 0x8BD156: execute_ipa_pass_list(opt_pass*) (passes.c:2610) ==26377== ==26377== Invalid free() / delete / delete[] / realloc() ==26377== at 0x40298B0: free (vg_replace_malloc.c:468) ==26377== by 0x8061EC: hash_table<polymorphic_call_target_hasher, xcallocator>::dispose() (vec.h:312) ==26377== by 0x804386: free_polymorphic_call_targets_hash() (ipa-devirt.c:845) ==26377== by 0x6DCD08: cgraph_remove_node(cgraph_node*) (cgraph.c:364) ==26377== by 0x8248D4: symtab_remove_unreachable_nodes(bool, _IO_FILE*) (ipa.c:472) ==26377== by 0x6E4027: compile() (cgraphunit.c:2176) ==26377== by 0x6E4A74: finalize_compilation_unit() (cgraphunit.c:2319) ==26377== by 0x5960C4: cp_write_global_declarations() (decl2.c:4431) ==26377== by 0x957DCC: compile_file() (toplev.c:562) ==26377== by 0x959A27: toplev_main(int, char**) (toplev.c:1914) ==26377== by 0x4ED5F8F: (below main) (in /lib64/libc-2.18.90.so) ==26377== Address 0x5627790 is 0 bytes inside a block of size 40 free'd ==26377== at 0x402AABE: realloc (vg_replace_malloc.c:687) ==26377== by 0xE4BF8C: xrealloc (xmalloc.c:179) ==26377== by 0x803712: maybe_record_node(vec<cgraph_node*, va_heap, vl_ptr>&, tree_node*, pointer_set_t*, bool*) (vec.h:293) ==26377== by 0x805668: possible_polymorphic_call_targets(tree_node*, long, ipa_polymorphic_call_context, bool*, void**) (ipa-devirt.c:1185) ==26377== by 0x7D91DA: fold_stmt_1(gimple_stmt_iterator*, bool) (ipa-utils.h:135) ==26377== by 0x997F29: fold_marked_statements(int, pointer_set_t*) (tree-inline.c:4511) ==26377== by 0x99FF50: optimize_inline_calls(tree_node*) (tree-inline.c:4592) ==26377== by 0xDAF93E: (anonymous namespace)::pass_early_inline::execute() (ipa-inline.c:2272) ==26377== by 0x8BC9C9: execute_one_pass(opt_pass*) (passes.c:2226) ==26377== by 0x8BCC45: execute_pass_list(opt_pass*) (passes.c:2279) ==26377== by 0x8BB54D: do_per_function_toporder(void (*)(void*), void*) (passes.c:1627) ==26377== by 0x8BD156: execute_ipa_pass_list(opt_pass*) (passes.c:2610)
