https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118318
--- Comment #13 from Jan Hubicka <hubicka at gcc dot gnu.org> --- Thanks for running this through debugger Breakpoint 2.2, profile_count::operator+= (this=0x7ffff6e7e888, other=...) at /usr/src/debug/sys-devel/gcc-15.0.9999/gcc-15.0.9999/gcc/profile-count.h:932 932 gcc_checking_assert (compatible_p (other)); (gdb) p other $1 = (const profile_count &) @0x7fffffff72c0: { static n_bits = 61, static max_count = 2305843009213693950, static uninitialized_count = 2305843009213693951, m_val = 3694, m_quality = ADJUSTED } is an IPA count. It would be nice to know "p *this", but for compatible_p to return false it should be function local count. static void adjust_clone_incoming_counts (cgraph_node *node, desc_incoming_count_struct *desc) { for (cgraph_edge *cs = node->callers; cs; cs = cs->next_caller) if (cs->caller->thunk) { adjust_clone_incoming_counts (cs->caller, desc); profile_count sum = profile_count::zero (); for (cgraph_edge *e = cs->caller->callers; e; e = e->next_caller) if (e->count.initialized_p ()) sum += e->count.ipa (); cs->count = cs->count.combine_with_ipa_count (sum); } else if (!desc->processed_edges->contains (cs) && cs->caller->clone_of == desc->orig) { cs->count += desc->count; if (dump_file) { fprintf (dump_file, " Adjusted count of an incoming edge of " "a clone %s -> %s to ", cs->caller->dump_name (), cs->callee->dump_name ()); cs->count.dump (dump_file); fprintf (dump_file, "\n"); } } } Here are two calls to + and it is not clear which one triggers the ICE. However sum += e->count.ipa (); quite obviously preserves the fact that sum is an IPA count. So I think it is cs->count += desc->count which makes sense to me. dest->count is IPA count if (cs->count.initialized_p ()) desc->count += cs->count.ipa (); So I suppose what happens here is that we clone function with no profile feedback available. This can happen in some cases, with profile mismatches or with comdat merging. Martin, I think this is yours code, but I would say that if desc is IPA count of 3694 while cs->count is locally estimated, we don't really have way to add them together, so I would just skip the adjustment on !cs->count.ipa_p () However it is not clear to me how desc can be something non-zero in this case? >From where the number comes? It is possible that we scaled down the profile from non-zero to 0 which makes us to downgrade IPA profile to non-IPA, but in that case the updating code attempts to do something fisly making call site within function with 0 invocations to have non-zero count. Honza