Bug#1131840: gcc-15: non-deterministic DWARF debug info (.debug_info, .debug_loclists) across identical builds

Package: gcc-15
Version: 15.2.0-16
Severity: normal
Tags: reproducible

GCC 15.2.0-16 produces non-deterministic DWARF debug information when
building the same source twice with identical flags, parallelism, and
build environment on amd64. The generated machine code is byte-for-byte
identical across builds, but .debug_info and .debug_loclists differ in
size and content. All other debug sections (.debug_abbrev, .debug_line,
.debug_str, .debug_line_str, .debug_aranges, .debug_rnglists) are
identical.

Because the build-id is computed over the unstripped binary, the
differing debug sections cause the build-id to change, which then
propagates into the stripped binary via .gnu_debuglink. The end result
is that the final .deb is not reproducible even though the actual
executable code has not changed.

I confirmed this is not caused by dwz by repeating the test with
dh_dwz disabled. The result is the same. I was unable to reproduce
this with a small standalone test case; it may require a large
codebase to trigger. If this turns out to be a linker issue, please
reassign to binutils.

I noticed this while investigating reproducibility failures for the
quickshell package (src:quickshell, 0.2.1-1). The Salsa CI debrebuild
job passed with gcc-15 15.2.0-14 and began failing after the update to
15.2.0-16. Both builds in my local test used sbuild with ninja -j2,
the same build path, the same SOURCE_DATE_EPOCH, and the same package
versions.

In a local two-build comparison (dwz disabled), the debug section sizes
were:

   .debug_info:     0x34eaf8c vs 0x34eb0aa (+286 bytes)
   .debug_loclists: 0x30c72c  vs 0x30c729  (-3 bytes)

The stripped binary differed in only 61 bytes, all within
.note.gnu.build-id and .gnu_debuglink.

The reproducible-builds.org results for this package can be seen at:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/quickshell.html
https://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/quickshell.html

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEINV1e2m17/gt/4jVFUw51sGTZp0FAmnDkr4ACgkQFUw51sGT
Zp3V+BAAg6yF3tQ0m32EofOWJGrw4Jrh3g8x23DCjIm3fD9CUW+qM/T18Wn0IRh+
q5KQ4dhz5E7vWPuEMofNM+jh2XwqGBPxERLmI2z7+w2l2mnmh+0snil9iXi6fx0R
Am3hPuyKMmbxOJYK9c5jWbR8x3RFvEsZkY4H8cMbeyYBnyoNPTeIRPUPdngOUK7D
9LLZGLj+iBi+HCwlf4e6OhQ/i6CD7jrWKg7pvtWgekvlHXk1ef/Yfzmdbhwt8LhZ
IKxojs9ebRDNM+dFNe7XypGenR+f5xYZBJYkPBUN6xBRh7QD88InWiKtFAyJWvY9
E3IWDCSc+sPjU0LT2Djw+Xf6EdXREcky1Ii9zMYd2B3heJFb/Ycy8BGXOe6iHuN8
td1s/WWJCh5yfUd//Qo9zr2AChp9qwKVjbAijmY5bCjyvP6AH57ZtG1nlQLKTzbY
p5RLGKTYbo8OrEF/KVSvIahn6S8h3CwAqWunxl8tHa8x7aq+30XHF2eMzForx6KQ
dBJRqHx/El4haqlOlyzzQ5fJk7EcJCuHbPBOC8VGGeg9ESEAQ91Yoa9SXycnhoeO
1Oi7hc367OU1+cWlEXzdr65MCUG46BleJGp6LvmG75N0zYBQf/URoEfsDOYqXUVQ
CikovPhAnugXXc2gnvDksbRvFxZY+C/DOlc3UOpJ5rNyPCZ5cdY=
=XEnS
-----END PGP SIGNATURE-----