[Bug target/102682] New: [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717

[Bug target/102682] New: [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102682

            Bug ID: 102682
           Summary: [12 Regression] ICE in simplify_gen_subreg_concatn, at
                    lower-subreg.c:717
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---
            Target: x86_64-pc-linux-gnu

Created attachment 51583
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51583&action=edit
Testcase

g++-12.0.0-alpha20211003 snapshot (g:d91056851c5c60f226e3192fb955d018b53eb66f)
ICEs when compiling the attached testcase, partially reduced from
test/std/experimental/simd/simd.mem/store.pass.cpp from the libcxx 12.0.0 test
suite, w/ -mavx2 -O1 -fno-tree-sra --param
sccvn-max-alias-queries-per-access=1:

% x86_64-pc-linux-gnu-g++-12.0.0 -mavx2 -O1 -fno-tree-sra --param
sccvn-max-alias-queries-per-access=1 -c iwely7yr.cpp
during RTL pass: subreg1
iwely7yr.cpp: In function 'void test_converting_store()':
iwely7yr.cpp:99:1: internal compiler error: in simplify_gen_subreg_concatn, at
lower-subreg.c:717
   99 | }
      | ^
0x8ff0de simplify_gen_subreg_concatn
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211003/work/gcc-12-20211003/gcc/lower-subreg.c:717
0x1e92481 resolve_simple_move
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211003/work/gcc-12-20211003/gcc/lower-subreg.c:1091
0x1e93531 decompose_multiword_subregs
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211003/work/gcc-12-20211003/gcc/lower-subreg.c:1657
0x1e93eca execute
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211003/work/gcc-12-20211003/gcc/lower-subreg.c:1773

[Bug target/102682] [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102682

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug target/102682] [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717 since r12-3899-gd06dc8a2c73735e9

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102682

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12 Regression] ICE in      |[12 Regression] ICE in
                   |simplify_gen_subreg_concatn |simplify_gen_subreg_concatn
                   |, at lower-subreg.c:717     |, at lower-subreg.c:717
                   |                            |since
                   |                            |r12-3899-gd06dc8a2c73735e9
             Status|UNCONFIRMED                 |NEW
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-10-11

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-3899-gd06dc8a2c73735e9.

[Bug target/102682] [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717 since r12-3899-gd06dc8a2c73735e9

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102682

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Breakpoint 1, fancy_abort (
    file=0x3973340 "/home/rguenther/src/gcc3/gcc/lower-subreg.c", line=717, 
    function=0x39737d0 <simplify_gen_subreg_concatn(machine_mode, rtx_def*,
machine_mode, unsigned int)::__FUNCTION__> "simplify_gen_subreg_concatn")
    at /home/rguenther/src/gcc3/gcc/diagnostic.c:1982
1982      if (global_dc->printer == NULL)
Missing separate debuginfos, use: zypper install
libgmp10-debuginfo-6.1.2-4.6.1.x86_64 libisl15-debuginfo-0.18-1.443.x86_64
libmpc3-debuginfo-1.1.0-1.47.x86_64 libmpfr6-debuginfo-4.0.2-3.3.1.x86_64
libzstd1-debuginfo-1.4.4-1.6.1.x86_64
(gdb) up
#1  0x0000000002c1c638 in simplify_gen_subreg_concatn (outermode=E_DImode, 
    op=0x7ffff63490c0, innermode=E_OImode, byte=0)
    at /home/rguenther/src/gcc3/gcc/lower-subreg.c:717
717               gcc_assert (!paradoxical_subreg_p (op));
(gdb) p debug_rtx (op)
(subreg:OI (concatn/v:TI [
            (reg:DI 92 [ buffer ])
            (reg:DI 93 [ buffer+8 ])
        ]) 0)

and the insn

(insn 6 5 7 2 (set (subreg:OI (concatn/v:TI [
                    (reg:DI 92 [ buffer ])
                    (reg:DI 93 [ buffer+8 ])
                ]) 0)
        (subreg:OI (reg/v:V8SI 85 [ __x ]) 0)) "t.ii":76:21 74
{*movoi_internal_avx}
     (nil))

looks more like a latent issue in the subreg lowering pass?  But then the
insn looks dubious in the first place...  it originally is:

;; MEM <uint256_t> [(char * {ref-all})&buffer] = _5;

(insn 6 5 0 (set (subreg:OI (reg/v:TI 84 [ buffer ]) 0)
        (subreg:OI (reg/v:V8SI 85 [ __x ]) 0)) "t.ii":76:21 -1
     (nil))

where buffer is too small:

  float buffer[4];

one thing we could do is somehow "fail" when we end up generating the
LHS subreg.  Alternatively see to this situation when expanding the
GIMPLE and mark 'buffer' as not to be expanded to a register via
forced_stack_vars because we have an access that's too big.

[Bug target/102682] [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717 since r12-3899-gd06dc8a2c73735e9

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102682

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The subreg is generated from store_bit_field_1:

#10 0x0000000001224f12 in store_bit_field (str_rtx=0x7ffff6720fc0, 
    bitsize=..., bitnum=..., bitregion_start=..., bitregion_end=..., 
    fieldmode=E_OImode, value=0x7ffff63490a8, reverse=false)
    at /home/rguenther/src/gcc3/gcc/expmed.c:1186
...
  /* If the target is a register, overwriting the entire object, or storing
     a full-word or multi-word field can be done with just a SUBREG.  */
  if (!MEM_P (op0)
      && known_eq (bitsize, GET_MODE_BITSIZE (fieldmode)))
    {

but note how fieldmode is OImode while op0 is (reg:TI 84 [ buffer ]).

it goes on

      /* Use the subreg machinery either to narrow OP0 to the required
         words or to cope with mode punning between equal-sized modes.
         In the latter case, use subreg on the rhs side, not lhs.  */
      rtx sub;
      HOST_WIDE_INT regnum;
      poly_uint64 regsize = REGMODE_NATURAL_SIZE (GET_MODE (op0));
      if (known_eq (bitnum, 0U)
          && known_eq (bitsize, GET_MODE_BITSIZE (GET_MODE (op0))))
        {
          sub = simplify_gen_subreg (GET_MODE (op0), value, fieldmode, 0);
          if (sub)
            {
              if (reverse)
                sub = flip_storage_order (GET_MODE (op0), sub);
              emit_move_insn (op0, sub);
              return true;
            }
        }

it doesn't mention the widening of the LHS, but

      else if (constant_multiple_p (bitnum, regsize * BITS_PER_UNIT, &regnum)
               && multiple_p (bitsize, regsize * BITS_PER_UNIT))
        {
          sub = simplify_gen_subreg (fieldmode, op0, GET_MODE (op0),
                                     regnum * regsize);
          if (sub)
            {
              if (reverse)
                value = flip_storage_order (fieldmode, value);
              emit_move_insn (sub, value);
              return true;
            }
        }

this does just this.  So eventually the known_eq in the first case can
be changed to known_ge in which case we no longer ICE but prune the RHS.

diff --git a/gcc/expmed.c b/gcc/expmed.c
index 59734d4841c..0e8a60245aa 100644
--- a/gcc/expmed.c
+++ b/gcc/expmed.c
@@ -788,13 +788,14 @@ store_bit_field_1 (rtx str_rtx, poly_uint64 bitsize,
poly_uint64 bitnum,
       && known_eq (bitsize, GET_MODE_BITSIZE (fieldmode)))
     {
       /* Use the subreg machinery either to narrow OP0 to the required
-        words or to cope with mode punning between equal-sized modes.
-        In the latter case, use subreg on the rhs side, not lhs.  */
+        words or to cope with mode punning between equal-sized modes
+        or storage of excess bytes.  In the latter case, use subreg on
+        the rhs side, not lhs.  */
       rtx sub;
       HOST_WIDE_INT regnum;
       poly_uint64 regsize = REGMODE_NATURAL_SIZE (GET_MODE (op0));
       if (known_eq (bitnum, 0U)
-         && known_eq (bitsize, GET_MODE_BITSIZE (GET_MODE (op0))))
+         && known_ge (bitsize, GET_MODE_BITSIZE (GET_MODE (op0))))
        {
          sub = simplify_gen_subreg (GET_MODE (op0), value, fieldmode, 0);
          if (sub)


another possibility is to fix the condition on the case we run into:

@@ -806,7 +807,7 @@ store_bit_field_1 (rtx str_rtx, poly_uint64 bitsize,
poly_uint64 bitnum,
            }
        }
       else if (constant_multiple_p (bitnum, regsize * BITS_PER_UNIT, &regnum)
-              && multiple_p (bitsize, regsize * BITS_PER_UNIT))
+              && multiple_p (regsize * BITS_PER_UNIT, bitsize))
        {
          sub = simplify_gen_subreg (fieldmode, op0, GET_MODE (op0),
                                     regnum * regsize);

[Bug target/102682] [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717 since r12-3899-gd06dc8a2c73735e9

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102682

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:147ed0184f403b51b4f180f94b0779e9905faa3a

commit r12-4428-g147ed0184f403b51b4f180f94b0779e9905faa3a
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Oct 11 14:08:52 2021 +0200

    middle-end/102682 - avoid invalid subreg on the LHS

    The following avoids generating

    (insn 6 5 7 2 (set (subreg:OI (concatn/v:TI [
                        (reg:DI 92 [ buffer ])
                        (reg:DI 93 [ buffer+8 ])
                    ]) 0)
            (subreg:OI (reg/v:V8SI 85 [ __x ]) 0)) "t.ii":76:21 74
{*movoi_internal_avx}
         (nil))

    via store_bit_field_1 when we try to store excess data into
    a register allocated temporary.  The case was supposed to

          /* Use the subreg machinery either to narrow OP0 to the required
             words...

    but the check ensured only an register-aligned but not a large
    enough piece.  The following adds such missed check which ends up
    decomposing the set to

    (insn 6 5 7 (set (subreg:DI (reg/v:TI 84 [ buffer ]) 0)
            (subreg:DI (reg/v:V8SI 85 [ __x ]) 0)) "t.ii":76:21 -1
         (nil))

    (insn 7 6 0 (set (subreg:DI (reg/v:TI 84 [ buffer ]) 8)
            (subreg:DI (reg/v:V8SI 85 [ __x ]) 8)) "t.ii":76:21 -1
         (nil))

    2021-10-11  Richard Biener  <rguenther@suse.de>

            PR middle-end/102682
            * expmed.c (store_bit_field_1): Ensure a LHS subreg would
            not create a paradoxical subreg.

[Bug target/102682] [12 Regression] ICE in simplify_gen_subreg_concatn, at lower-subreg.c:717 since r12-3899-gd06dc8a2c73735e9

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102682

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.