[Bug ipa/60727] ICE in ipcp_verify_propagated_values, at ipa-cp.c:892

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60727

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Can be reproduced with http://gcc.gnu.org/ml/gcc-patches/2014-03/msg01237.html
ontop of r208807 and the following reduced testcase:

typedef long unsigned int size_t;
class JSCell;
class JSObject;
class X;
class JSValue {
public:
    JSValue(JSCell* ptr);
};
class MarkStack{ };
class I { };
class JSCell {
    friend class JSObject;
    virtual JSObject* toObject() const;
    bool fastGetOwnX(const I& propertyName, X&);
    virtual bool getOwnX(const I& propertyName, X&);
};
class X {
public:
    typedef JSValue (*GetValueFunc)(const I&, const X&);
    void setValueSlot(JSValue, JSValue*, size_t) { m_getValue = 0; }
    GetValueFunc m_getValue;
};
class JSObject : public JSCell {
    friend class JSCell;
    virtual void markChildren(MarkStack&);
    bool getX(const I& propertyName, X&);
    virtual bool getOwnX(const I& propertyName, X&);
    bool inlineGetOwnX(const I& propertyName, X&);
};
inline __attribute__((__always_inline__)) bool
JSObject::inlineGetOwnX(const I& propertyName, X& slot)
{
    slot.setValueSlot(this, 0, 0);
}
inline __attribute__((__always_inline__)) bool
JSObject::getOwnX(const I& propertyName, X& slot)
{
    return inlineGetOwnX(propertyName, slot);
}
inline __attribute__((__always_inline__)) bool
JSCell::fastGetOwnX(const I& propertyName, X& slot)
{
    return getOwnX(propertyName, slot);
}
inline __attribute__((__always_inline__)) bool
JSObject::getX(const I& propertyName, X& slot)
{
    this->fastGetOwnX(propertyName, slot);
}
bool JSCell::getOwnX(const I& identifier, X& slot)
{
    JSObject* object = toObject();
    object->getX(identifier, slot);
}

I suppose that patch either pulls the bodies from IPA-CP at some bogus
time or ends up with cgraph nodes confusing IPA-CP.  Needs -flto only
because the patch changes the -flto path only (as opposed to Honzas proposed
change in that thread that doesn't fix the issue).  Somehow the patch
doesn't trigger the same issue on trunk though.