https://gcc.gnu.org/g:522e0c0bdabfa39f2c3bfc3f7a3d3c2b60b62381
commit r15-11240-g522e0c0bdabfa39f2c3bfc3f7a3d3c2b60b62381 Author: Jan Hubicka <[email protected]> Date: Fri Apr 17 17:34:35 2026 +0200 Fix handling of anonymous type vtables in ipa-devirt Solve first problem discussed in PR120098 where modified devirt-23 testcase leads to wrong code. The testcase triggers situation whre anonymous type MultiTermDocs is derived by C. When we look for possible polymorphic call targets, we special case anonymous type and check if they have been instantiated by looking if their virtual table is used at all. In this case it is not, however C has construction vtable which refers to MultiTermDocs's virtual function. Since we have no easy way to go from a type to all construction vtables of its derived types, this is fixed by adding a walk of variables and noting them. Walk is triggered lazilly only when such anonymous types exists. gcc/ChangeLog: PR ipa/120098 * ipa-devirt.cc (odr_type_p): Add no_derived_construction_vtables (odr_types_ptr): Move ahead in file. (odr_types): Move ahead in file. (anonymous_construction_vtable_p): New function. (mark_derived_construction_vtables): New function. (construction_vtable_hook): New function. (type_possibly_instantiated_p): Watch for construction vtables. gcc/testsuite/ChangeLog: PR ipa/120098 * g++.dg/torture/pr120098.C: New test. (cherry picked from commit 5e492f27e44c052237a7296d7fb754bae5755982) Diff: --- gcc/ipa-devirt.cc | 86 ++++++++++++++++++++++++++++++--- gcc/testsuite/g++.dg/torture/pr120098.C | 47 ++++++++++++++++++ 2 files changed, 125 insertions(+), 8 deletions(-) diff --git a/gcc/ipa-devirt.cc b/gcc/ipa-devirt.cc index 532e25e87c60..3aa2d1dfad0c 100644 --- a/gcc/ipa-devirt.cc +++ b/gcc/ipa-devirt.cc @@ -227,8 +227,17 @@ struct GTY(()) odr_type_d bool rtti_broken; /* Set when the canonical type is determined using the type name. */ bool tbaa_enabled; + /* Set when we determined there are no derived construction vtables. */ + bool no_derived_construction_vtables; }; +/* ODR types also stored into ODR_TYPE vector to allow consistent + walking. Bases appear before derived types. Vector is garbage collected + so we won't end up visiting empty types. */ + +static GTY(()) vec <odr_type, va_gc> *odr_types_ptr; +#define odr_types (*odr_types_ptr) + /* Return TRUE if all derived types of T are known and thus we may consider the walk of derived type complete. @@ -268,6 +277,46 @@ type_all_ctors_visible_p (tree t) && type_in_anonymous_namespace_p (t); } +/* Return true if VTABLE is is a virtual table of an anonymous namespace + type and it is not the main virtual table for its type. */ + +static bool +anonymous_construction_vtable_p (tree vtable) +{ + if (!DECL_VIRTUAL_P (vtable) + || !type_in_anonymous_namespace_p (DECL_CONTEXT (vtable))) + return false; + tree vtable2 = BINFO_VTABLE (TYPE_BINFO (DECL_CONTEXT (vtable))); + if (TREE_CODE (vtable2) == POINTER_PLUS_EXPR) + vtable2 = TREE_OPERAND (TREE_OPERAND (vtable2, 0), 0); + return vtable2 != vtable; +} + +/* Set if construction vtables are computed. */ +static bool construction_vtables_detected = false; + +/* Mark all bases of T as having derived construction vtables. */ + +static void +mark_derived_construction_vtables (odr_type t) +{ + for (odr_type b: t->bases) + { + b->no_derived_construction_vtables = false; + mark_derived_construction_vtables (b); + } +} + +/* Watch removal of construction vtables so we recompute their + existence. */ + +void +construction_vtable_hook (varpool_node *v, void *) +{ + if (anonymous_construction_vtable_p (v->decl)) + construction_vtables_detected = false; +} + /* Return TRUE if type may have instance. */ static bool @@ -284,7 +333,34 @@ type_possibly_instantiated_p (tree t) if (TREE_CODE (vtable) == POINTER_PLUS_EXPR) vtable = TREE_OPERAND (TREE_OPERAND (vtable, 0), 0); vnode = varpool_node::get (vtable); - return vnode && vnode->definition; + if (vnode && vnode->definition) + return true; + + /* If T is derived, we may see only the construction vtable. + To find them, we need to walk symbol table. Cache the result + and only recompute when some vtables are removed. This only + happens in unreachable node removal, which is only called + constant number of times during computation. */ + odr_type odr_t = get_odr_type (t); + if (odr_t->derived_types.length () && !construction_vtables_detected) + { + static bool hook_registered = false; + if (!hook_registered) + { + symtab->add_varpool_removal_hook (construction_vtable_hook, NULL); + hook_registered = true; + } + for (odr_type t: odr_types) + if (t) + t->no_derived_construction_vtables = true; + FOR_EACH_VARIABLE (vnode) + if (vnode->definition + && anonymous_construction_vtable_p (vnode->decl)) + mark_derived_construction_vtables + (get_odr_type (DECL_CONTEXT (vnode->decl))); + construction_vtables_detected = true; + } + return !odr_t->no_derived_construction_vtables; } /* Return true if T or type derived from T may have instance. */ @@ -507,13 +583,6 @@ odr_name_hasher::remove (odr_type_d *v) typedef hash_table<odr_name_hasher> odr_hash_type; static odr_hash_type *odr_hash; -/* ODR types are also stored into ODR_TYPE vector to allow consistent - walking. Bases appear before derived types. Vector is garbage collected - so we won't end up visiting empty types. */ - -static GTY(()) vec <odr_type, va_gc> *odr_types_ptr; -#define odr_types (*odr_types_ptr) - /* All enums defined and accessible for the unit. */ static GTY(()) vec <tree, va_gc> *odr_enums; @@ -1979,6 +2048,7 @@ get_odr_type (tree type, bool insert) val->type = type; val->bases = vNULL; val->derived_types = vNULL; + val->no_derived_construction_vtables = false; if (type_with_linkage_p (type)) val->anonymous_namespace = type_in_anonymous_namespace_p (type); else diff --git a/gcc/testsuite/g++.dg/torture/pr120098.C b/gcc/testsuite/g++.dg/torture/pr120098.C new file mode 100644 index 000000000000..882f613d5d20 --- /dev/null +++ b/gcc/testsuite/g++.dg/torture/pr120098.C @@ -0,0 +1,47 @@ +// { dg-do run } + +#define N ((int*)0) +namespace { +class A { +public: + unsigned length; +}; +class B {}; +class MultiTermDocs : public virtual B { +protected: + A readerTermDocs; + A subReaders; + virtual B *m_fn1(int *) { return (B *)0; } + virtual inline ~MultiTermDocs(); + inline void wrap(void) + { + m_fn1(N); + m_fn1(N); + m_fn1(N); + m_fn1(N); + m_fn1(N); + m_fn1(N); + m_fn1(N); + m_fn1(N); + m_fn1(N); + } +}; +class C : MultiTermDocs { + B *m_fn1(int *); +}; +MultiTermDocs::~MultiTermDocs() { + wrap (); + if (&readerTermDocs) { + B *a; + for (unsigned i = 0; i < subReaders.length; i++) + (a != 0); + } +} + +B *C::m_fn1(int *) { __builtin_abort (); } +} + +int main() +{ + class C c; +}
