https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101839
Bug ID: 101839
Summary: [9/10/11/12 Regression] Hand in C++ code with
-fdevirtualize
Product: gcc
Version: 12.0
Status: UNCONFIRMED
Keywords: wrong-code
Severity: normal
Priority: P3
Component: ipa
Assignee: unassigned at gcc dot gnu.org
Reporter: marxin at gcc dot gnu.org
CC: hubicka at gcc dot gnu.org, marxin at gcc dot gnu.org
Target Milestone: ---
Reported by leon zadorin <[email protected]> via email:
The following produces hanged application (busy-polling by what appears to be
calling self-method in a loop indefinitely) when, essentially, "-fdevirtualize"
is brought into play (albeit with other options possibly).
The reproduction was achieved on
Linux: gcc version 9.2.1 20191008 (Ubuntu 9.2.1-9ubuntu2), x86_64-linux-gnu
and Windows: gcc version 11.1.0 (GCC), x86_64-w64-mingw32
Code compiled as:
c++ -O3 -fprofile-generate ./devirtualize.cpp
Whilst consistently reproducible ("done writing" is never printed out), the
buggy behavior is rather strange and any of the following would change/"fix"
the situation:
Taking out the anonymous namespace;
Marking BA::type() as non-final;
Taking out std::map from CA;
Adding -fno-devirtualize flag to GCC compilation flags.
Note: taking out -fprofile-generate from GCC compilation flags results in
different busy-print loop (potentially followed by segfault) i.e. different,
yet still buggy behaviour.
The repro code could be simplified even further (e.g. by taking out Buf class,
reducing number of calls to 'add', etc) and still reproduce in gcc-9.2 on
Linux. However on gcc-11.1 on Windows it would then no longer reproduce.
So I've left the following code in its current state so as to hopefully induce
more consistent reproduction across different versions.
Here it is, devirtualize.cpp (also attached):
#include <string.h>
#include <iostream>
#include <map>
namespace {
struct Buf {
char * buf; int a{0}; int b{0};
Buf(char * b) : buf(b) { }
void add(int v) {
::memcpy(buf, &v, sizeof(v));
a += sizeof(v);
b += sizeof(v);
}
};
struct A {
virtual void fill(Buf &buf) {
buf.add(type());
buf.add(type());
}
virtual ~A() {}
virtual int type() = 0;
};
struct BA : A {
void fill(Buf &buf) {
A::fill(buf);
buf.add(type());
buf.add(type());
}
int type() final {
return 1;
}
};
struct CBA final : BA {
};
struct CA final : A {
::std::map<int, int> m;
int type() final {
return 2;
}
};
}
int main(int argc, char ** ) {
char d[1024];
CBA cba;
::std::cerr << "writing \n"; ::std::cerr.flush();
Buf buf(d);
cba.fill(buf);
::std::cerr << "done writing \n"; ::std::cerr.flush();
CA ca;
}
Richi replied:
The issue also reproduces with GCC 7.5
(on Leap 15.3), -O -fprofile-generate -fdevirtualize is enough
to trigger it there. Confirmed also with GCC 9, 10, 11 and trunk
and those options.
We hang in
Program received signal SIGINT, Interrupt.
0x00000000004017d5 in (anonymous namespace)::A::fill (buf=...,
this=<optimized out>) at t.C:16
16 buf.add(type());
Missing separate debuginfos, use: zypper install
libgcc_s1-debuginfo-10.3.0+git1587-1.6.4.x86_64
libstdc++6-debuginfo-10.3.0+git1587-1.6.4.x86_64
(gdb) bt
#0 0x00000000004017d5 in (anonymous namespace)::A::fill (buf=...,
this=<optimized out>) at t.C:16
#1 (anonymous namespace)::BA::fill (this=this@entry=0x7fffffffde08,
buf=...)
at t.C:24
#2 0x0000000000401860 in main (argc=<optimized out>) at t.C:46
(gdb) s
(anonymous namespace)::BA::fill (this=this@entry=0x7fffffffde08, buf=...)
at t.C:24
24 A::fill(buf);
(gdb) s
(anonymous namespace)::A::fill (buf=..., this=0x7fffffffddd8) at t.C:15
15 virtual void fill(Buf &buf) {
(gdb) s
16 buf.add(type());
(gdb) s
(anonymous namespace)::BA::fill (this=this@entry=0x7fffffffde08, buf=...)
at t.C:24
24 A::fill(buf);
(gdb) s
(anonymous namespace)::A::fill (buf=..., this=0x7fffffffddd8) at t.C:15
15 virtual void fill(Buf &buf) {
(gdb) s
16 buf.add(type());
there is one thing that I'm not sure is allowed. You do:
struct A {
virtual void fill(Buf &buf) {
buf.add(type());
buf.add(type());
}
virtual ~A() {}
virtual int type() = 0;
};
struct BA : A {
void fill(Buf &buf) {
A::fill(buf);
buf.add(type());
buf.add(type());
}
thus override virtual A::fill with non-virtual BA::fill. But this
might be where the devirtualization code (or the indirect call/devirt
profiling code?) is confused.
