https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128226
--- Comment #6 from Josef Melcr <jmelcr at gcc dot gnu.org> --- Created attachment 66045 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=66045&action=edit untested patch The mechanism of this ICE is really bizzare. If a function has exactly 100 calls and 2 assumes, first the 100 regular calls get their edges and then during ipa-prop the callback edges are created. When the first one is being made, cgraph_node::get_edge looks through 100 edges, which doesn't pass the call_site_hash creation threshold, sets it callback flag and happily returns. When the second one is created, cgraph_node::get_edge is called in symbol_table::create_edge. This time, get_edge counts 101 edges and creates call_site_hash, but because the first edge already has the callback field set, it won't be added because of the early bail in cgraph_add_edge_to_call_site_hash, leaving the slot empty. The second edge will be added during symbol_table::create_edge, because its callback field is set only after this method returns. The empty slot then causes fnsummary to skip over the assume call during summary generation, leading to an ICE when the edge reaches code which expects its summary to be present. Attached is an untested patch I'll test and submit after the weekend, along with a new testcase which actually showcases the issue.
