[Bug target/103028] New: ICE in extract_constrain_insn, at recog.c:2670

[Bug target/103028] New: ICE in extract_constrain_insn, at recog.c:2670

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

            Bug ID: 103028
           Summary: ICE in extract_constrain_insn, at recog.c:2670
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: aoliva at gcc dot gnu.org, krebbel at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-linux-gnu
            Target: s390x-linux-gnu

The following fails:

$ s390x-linux-gnu-gcc
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/tree-ssa/vrp37.c
-fif-conversion2 -Og -fharden-conditional-branches -march=z9-ec -c
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/tree-ssa/vrp37.c: In function
‘foo’:
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/tree-ssa/vrp37.c:12:1: error:
insn does not satisfy its constraints:
   12 | }
      | ^
(insn 64 28 65 5 (set (reg:CCU 33 %cc)
        (compare:CCU (reg/v:DI 1 %r1 [orig:63 i ] [63])
            (const_int 4294967296 [0x100000000])))
"/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/tree-ssa/vrp37.c":9:6 1428
{*cmpdi_ccu}
     (nil))
during RTL pass: cprop_hardreg
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/tree-ssa/vrp37.c:12:1:
internal compiler error: in extract_constrain_insn, at recog.c:2670
0x5cc39e _fatal_insn(char const*, rtx_def const*, char const*, int, char
const*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/rtl-error.c:108
0x5cc3c4 _fatal_insn_not_found(rtx_def const*, char const*, int, char const*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/rtl-error.c:118
0x5cb800 extract_constrain_insn(rtx_insn*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/recog.c:2670
0xaa5d3e copyprop_hardreg_forward_1
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/regcprop.c:825
0xaa6afd execute
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/regcprop.c:1390
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug target/103028] ICE in extract_constrain_insn, at recog.c:2670

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.0
   Last reconfirmed|                            |2021-11-01
             Status|UNCONFIRMED                 |NEW

[Bug target/103028] ICE in extract_constrain_insn, at recog.c:2670

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
You should be able to hit this without -fharden-conditional-branches

Try something like:

unsigned char x;
int foo(void)
{
  unsigned long long i = x;
  i = i + 0x80000000;
  unsigned long long t = 0xffffffff;
  unsigned long long tt, ii;
  asm("":"=g"(tt):"g"(t));
  asm("":"=g"(ii):"g"(i));
  if (i > t) {
    if ((ii <= tt))  __builtin_trap();
    return x;
 } else if (!(ii <= tt))  __builtin_trap();
  return 0;
}

[Bug target/103028] ICE in extract_constrain_insn, at recog.c:2670

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.0                        |---

[Bug target/103028] ICE in extract_constrain_insn, at recog.c:2670

[krebbel at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #2 from Andreas Krebbel <krebbel at gcc dot gnu.org> ---
IF-convert generates the compare *after* reload. The operands get checked for
validity only by invoking the predicates. That means everything which is
accepted by TARGET_LEGITIMATE_CONSTANT_P is ok for a general_operand. However,
we have several patterns where the union of all constraints would accept less
operands than the predicate assuming that reload is able to sort this out. The
ICE is triggered by emitting a pattern which actually would need to be fixed by
reload.

The problem could easily be avoided by e.g. enforcing operand1 to satisfy the
constraint used in the pattern. However, I'm wondering how this is supposed to
work in general. Couldn't this trigger all sorts of problems? Are we the only
backend relying on LRA sorting out these kind of issues for us?

Btw. I couldn't trigger the problem without -fharden-conditional-branches so
far.

[Bug target/103028] ICE in extract_constrain_insn, at recog.c:2670

[krebbel at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #3 from Andreas Krebbel <krebbel at gcc dot gnu.org> ---
So I think what is needed is something like this:

diff --git a/gcc/ifcvt.c b/gcc/ifcvt.c
index 017944f4f79a..1f5b9476ac2e 100644
--- a/gcc/ifcvt.c
+++ b/gcc/ifcvt.c
@@ -4341,7 +4341,8 @@ find_if_header (basic_block test_bb, int pass)
       && cond_exec_find_if_block (&ce_info))
     goto success;

-  if (targetm.have_trap ()
+  if (!reload_completed
+      && targetm.have_trap ()
       && optab_handler (ctrap_optab, word_mode) != CODE_FOR_nothing
       && find_cond_trap (test_bb, then_edge, else_edge))
     goto success;

[Bug rtl-optimization/103028] ICE in extract_constrain_insn, at recog.c:2670

[aoliva at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #4 from Alexandre Oliva <aoliva at gcc dot gnu.org> ---
Andrew,

  asm("":"=g"(tt):"g"(t));
  asm("":"=g"(ii):"g"(i));

Make it "0" for the inputs:

  asm("":"=g"(tt):"0"(t));

and AFAICT if you "detach" the immediate constant, you won't get the bug.

The problem occurs because (leu (compare reg imm)...) is turned into (ltu
(compare reg imm+1)...) for the trap_if, and then the immediate no longer fits
in the compare.

[Bug rtl-optimization/103028] ICE in extract_constrain_insn, at recog.c:2670

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Alexandre Oliva from comment #4)
> Andrew,
> 
>   asm("":"=g"(tt):"g"(t));
>   asm("":"=g"(ii):"g"(i));
> 
> Make it "0" for the inputs:
> 
>   asm("":"=g"(tt):"0"(t));

Oh yes sorry I did make that mistake there, thanks for correcting me.

[Bug rtl-optimization/103028] ICE in extract_constrain_insn, at recog.c:2670

[aoliva at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #6 from Alexandre Oliva <aoliva at gcc dot gnu.org> ---
This will probably avoid the error.  valid_insn_p checks the alternatives, and
fails for the invalid cmpdi_ccu that we attempt to create.  Conceivably, this
could be avoided by narrowing down the condition of the cbranch4 expander to
reject unfit constants after reload.  Alas, there doesn't seem to be any
existing opportunity to adjust the canonicalized condition to fit md
constraints, e.g. undoing the LEU to LTU transformation so that we could still
get a conditional trap for this case: we don't go through the cbranch4 expander
there.

diff --git a/gcc/ifcvt.c b/gcc/ifcvt.c
index 017944f4f79aa..b0052f6c5ced3 100644
--- a/gcc/ifcvt.c
+++ b/gcc/ifcvt.c
@@ -4726,7 +4726,9 @@ find_cond_trap (basic_block test_bb, edge then_edge, edge
else_edge)

   /* If that results in an invalid insn, back out.  */
   for (rtx_insn *x = seq; x; x = NEXT_INSN (x))
-    if (recog_memoized (x) < 0)
+    if (reload_completed
+       ? !valid_insn_p (x)
+       : recog_memoized (x) < 0)
       return FALSE;

   /* Emit the new insns before cond_earliest.  */

[Bug rtl-optimization/103028] ICE in extract_constrain_insn, at recog.c:2670

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Alexandre Oliva <aoliva@gcc.gnu.org>:

https://gcc.gnu.org/g:daca416fc2816a5e481b26c8d2010127101d77ce

commit r12-5787-gdaca416fc2816a5e481b26c8d2010127101d77ce
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Sat Dec 4 00:17:16 2021 -0300

    [PR103028] test ifcvt trap_if seq more strictly after reload

    When -fif-conversion2 is enabled, we attempt to replace conditional
    branches around unconditional traps with conditional traps.  That
    canonicalizes compares, which may change an immediate that barely fits
    into one that doesn't.

    The compare for the trap is first checked using the predicates of
    cbranch predicates, and then, compare and conditional trap insns are
    emitted and recognized.

    In the failing s390x testcase, i <=u 0xffff_ffff is canonicalized into
    i <u 0x1_0000_0000, and the latter immediate doesn't fit.  The insn
    predicates (both cbranch and cmpdi_ccu) happily accept it, since the
    register allocator has no trouble getting them into registers.  The
    problem is that ifcvt2 runs after reload, so we recognize the compare
    insn successfully, but later on we barf when we find that none of the
    constraints fit.

    This patch arranges for the trap_if-issuing bits in ifcvt to validate
    post-reload insns using a stricter test that also checks that operands
    fit the constraints.


    for  gcc/ChangeLog

            PR rtl-optimization/103028
            * ifcvt.c (find_cond_trap): Validate new insns more strictly
            after reload.

    for  gcc/testsuite/ChangeLog

            PR rtl-optimization/103028
            * gcc.dg/pr103028.c: New.

[Bug rtl-optimization/103028] ICE in extract_constrain_insn, at recog.c:2670

[aoliva at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

--- Comment #8 from Alexandre Oliva <aoliva at gcc dot gnu.org> ---
Fixed

[Bug rtl-optimization/103028] ICE in extract_constrain_insn, at recog.c:2670

[aoliva at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103028

Alexandre Oliva <aoliva at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Alexandre Oliva <aoliva at gcc dot gnu.org> ---
Fixed