[Bug target/103622] New: ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[Bug target/103622] New: ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

            Bug ID: 103622
           Summary: ICE: Segmentation fault (in
                    altivec_resolve_new_overloaded_builtin)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: error-recovery
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---
            Target: powerpc-*-linux-gnu

gcc 12.0.0 20211205 snapshot (g:c9419faef0bfaf31e6a6f744baa064892e0d105c) ICEs
when compiling the following testcase, extracted from
gcc/testsuite/gcc.target/powerpc/float128-hw4.c, for a target older than
power9:

unsigned int
get_float128_exponent (long double a)
{
  return __builtin_vec_scalar_extract_exp (a);
}

% powerpc-e300c3-linux-gnu-gcc-12.0.0 -c ntldzv7v.c
ntldzv7v.c: In function 'get_float128_exponent':
ntldzv7v.c:4:3: internal compiler error: Segmentation fault
    4 |   return __builtin_vec_scalar_extract_exp (a);
      |   ^~~~~~
0xe90b56 crash_signal
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/toplev.c:322
0x93bbc9 tree_check2(tree_node*, char const*, int, char const*, tree_code,
tree_code)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/tree.h:3459
0x93bbc9 altivec_resolve_new_overloaded_builtin
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/config/rs6000/rs6000-c.c:2947
0x860aa4 c_build_function_call_vec(unsigned int, vec<unsigned int, va_heap,
vl_ptr> const&, tree_node*, vec<tree_node*, va_gc, vl_embed>*, vec<tree_node*,
va_gc, vl_embed>*)
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-typeck.c:3268
0x881e00 c_parser_postfix_expression_after_primary
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:10555
0x879284 c_parser_postfix_expression
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:10228
0x87d80a c_parser_unary_expression
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:8254
0x87ed57 c_parser_cast_expression
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:8096
0x87ef94 c_parser_binary_expression
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:7899
0x880481 c_parser_conditional_expression
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:7599
0x880d91 c_parser_expr_no_commas
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:7514
0x8810cd c_parser_expression
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:10691
0x877e5f c_parser_expression_conv
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:10730
0x877e5f c_parser_statement_after_labels
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:6166
0x878f1a c_parser_compound_statement_nostart
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:5793
0x89707d c_parser_compound_statement
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:5602
0x8988f3 c_parser_declaration_or_fndef
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:2544
0x8a030b c_parser_external_declaration
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:1779
0x8a0b8b c_parser_translation_unit
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:1652
0x8a0b8b c_parse_file()
       
/var/tmp/portage/cross-powerpc-e300c3-linux-gnu/gcc-12.0.0_p20211205/work/gcc-12-20211205/gcc/c/c-parser.c:23279

[Bug target/103622] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

Kewen Lin <linkw at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bergner at gcc dot gnu.org,
                   |                            |linkw at gcc dot gnu.org,
                   |                            |segher at gcc dot gnu.org,
                   |                            |wschmidt at gcc dot gnu.org

--- Comment #1 from Kewen Lin <linkw at gcc dot gnu.org> ---
Confirmed, this requires one e300c3 cross build to reproduce:

2944│         for (; instance != NULL; instance = instance->next)
2945│           {
2946│             bool mismatch = false;
2947├───────────> tree nextparm = TYPE_ARG_TYPES (instance->fntype);
2948│
2949│             for (unsigned int arg_i = 0;

(gdb) p instance->fntype
$1 = <tree 0x0>

The overloaded bif fntype for RS6000_INST_VSEEQP relies on type usi_ftype_tf.

  rs6000_instance_info[RS6000_INST_VSEEQP].fntype
    = usi_ftype_tf;

  if (float128_type_node)
    usi_ftype_tf
    = build_function_type_list (  unsigned_intSI_type_node,
                                  float128_type_node,
                                NULL_TREE)

But on e300c3 there is no float128 type support (float128_type_node is NULL).

One thought seems to check instance->fntype first and take (skip) it as
mismatch if it's NULL.

[Bug target/103622] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #2 from Kewen Lin <linkw at gcc dot gnu.org> ---
Got exposed from r12-5752, r12-5751 we got the error msg like:

test.c: In function ‘get_float128_exponent’:
test.c:6:5: note: builtin ‘__builtin_vec_scalar_extract_exp’ requires builtin
‘__builtin_vsx_scalar_extract_expq’
    6 |     return __builtin_vec_scalar_extract_exp (a);
      |     ^~~~~~
test.c:6:12: error: ‘__builtin_vsx_scalar_extract_expq’ requires ISA 3.0 IEEE
128-bit floating point
    6 |     return __builtin_vec_scalar_extract_exp (a);
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Bug target/103622] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #3 from Kewen Lin <linkw at gcc dot gnu.org> ---

> One thought seems to check instance->fntype first and take (skip) it as
> mismatch if it's NULL.

This looks like a bad idea, to use long double as the type instead of float128
when type float128 isn't supported might be better.

diff --git a/gcc/config/rs6000/rs6000-gen-builtins.c
b/gcc/config/rs6000/rs6000-gen-builtins.c
index d2e9c4ce547..2b87eef1412 100644
--- a/gcc/config/rs6000/rs6000-gen-builtins.c
+++ b/gcc/config/rs6000/rs6000-gen-builtins.c
@@ -2473,6 +2473,39 @@ write_fntype_init (char *str)
       fprintf (init_file, ",\n\t\t\t\t");
     }
   fprintf (init_file, "NULL_TREE);\n");
+
+  /* Use long_double_type_node instead if float128_type_node isn't
+     supported, it's to avoid unexpected function types.  */
+  if (tf_found)
+    {
+      char *buf1 = strdup (str);
+      fprintf (init_file, "  else\n  ");
+      fprintf (init_file, "  %s\n    = build_function_type_list (", buf1);
+      tok = strtok (buf1, "_");
+      if (!strcmp ("tf", tok))
+       write_type_node ("ld", true);
+      else
+       write_type_node (tok, true);
+      tok = strtok (0, "_");
+      tok = strtok (0, "_");
+      if (tok)
+       fprintf (init_file, ",\n\t\t\t\t");
+
+      /* Note:  A function with no arguments ends with '_ftype_v'.  */
+      while (tok && strcmp (tok, "v"))
+       {
+         if (!strcmp ("tf", tok))
+           write_type_node ("ld", true);
+         else
+           write_type_node (tok, true);
+         tok = strtok (0, "_");
+         fprintf (init_file, ",\n\t\t\t\t");
+       }
+      fprintf (init_file, "NULL_TREE);\n");
+
+      free (buf1);
+    }
+
   free (buf);
 }

The above hacking make the segfault gone and it will emit:

test.c: In function ‘get_float128_exponent’:
test.c:6:5: error: ‘__builtin_vsx_scalar_extract_expq’ requires ISA 3.0 IEEE
128-bit floating point
    6 |     return __builtin_vec_scalar_extract_exp (a);
      |     ^~~~~~
test.c:6:5: note: overloaded builtin ‘__builtin_vec_scalar_extract_exp’ is
implemented by builtin ‘__builtin_vsx_scalar_extract_expq’

[Bug target/103622] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[wschmidt at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

Bill Schmidt <wschmidt at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |wschmidt at gcc dot gnu.org
   Target Milestone|---                         |12.0

--- Comment #4 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
I'll have a look.

[Bug target/103622] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[wschmidt at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #5 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Expected behavior is:

pr103622.c: In function 'get_float128_exponent':
pr103622.c:4:3: error: invalid parameter combination for AltiVec intrinsic
'__builtin_vec_scalar_extract_exp'
    4 |   return __builtin_vec_scalar_extract_exp (a);
      |   ^~~~~~

[Bug target/103622] [12 Regression] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[wschmidt at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

Bill Schmidt <wschmidt at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-12-12

--- Comment #6 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Confirmed.

[Bug target/103622] [12 Regression] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[wschmidt at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #7 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
It seems to me the problem is that long double was resolved to _Float128 when
there is no _Float128 support on the target.  There is no specific overloaded
interface that accepts "long double," so there must have been type coercion
involved here.

[Bug target/103622] [12 Regression] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[wschmidt at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #8 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Hm, no, it's probably just that it's iterating looking for long double and runs
across this instance with an uninitialized function type.  So this patch solves
the problem:

diff --git a/gcc/config/rs6000/rs6000-c.c b/gcc/config/rs6000/rs6000-c.c
index 8e83d97e72f..fc4cc929884 100644
--- a/gcc/config/rs6000/rs6000-c.c
+++ b/gcc/config/rs6000/rs6000-c.c
@@ -2943,6 +2943,12 @@ altivec_resolve_new_overloaded_builtin (location_t loc,
tree fndecl,

        for (; instance != NULL; instance = instance->next)
          {
+           /* It is possible for an instance to require a data type that isn't
+              defined on this target, in which case instance->fntype will be
+              NULL.  */
+           if (!instance->fntype)
+             continue;
+
            bool mismatch = false;
            tree nextparm = TYPE_ARG_TYPES (instance->fntype);

[Bug target/103622] [12 Regression] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[wschmidt at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #9 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Patch posted here:  

https://gcc.gnu.org/pipermail/gcc-patches/2021-December/586715.html

[Bug target/103622] [12 Regression] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #10 from Kewen Lin <linkw at gcc dot gnu.org> ---
> test.c: In function ‘get_float128_exponent’:
> test.c:4:5: note: overloaded builtin ‘__builtin_vec_scalar_extract_exp’ is
> implemented by builtin ‘__builtin_vsx_scalar_extract_expq’
>    4 |     return __builtin_vec_scalar_extract_exp (a);
>      |     ^~~~~~
> test.c:4:12: error: ‘__builtin_vsx_scalar_extract_expq’ requires ISA 3.0 IEEE > 128-bit floating point
>     4 |     return __builtin_vec_scalar_extract_exp (a);
>       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Just a record to avoid confusion, the above message was the previously emitted
message before r12-5752 for powerpc-e300c3 cross since it doesn't support ieee
float128. The message is also the same as what I saw on P8 BE with
-mabi=ieeelongdouble, but we will get the message what Bill put if specifying
with -mabi=ibmlongdouble there (that is "invalid parameter combination").

I just noticed that our built-in documents actually note the type should be
"__ieee128", it makes more sense to emit "invalid parameter combination"
instead, so Bill's proposed fix is the best.

[Bug target/103622] [12 Regression] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by William Schmidt <wschmidt@gcc.gnu.org>:

https://gcc.gnu.org/g:4ec62dbafe0cb3b79cc635dfb964ef6a7ccc2d40

commit r12-6275-g4ec62dbafe0cb3b79cc635dfb964ef6a7ccc2d40
Author: Bill Schmidt <wschmidt@linux.ibm.com>
Date:   Wed Jan 5 16:53:29 2022 -0600

    rs6000: Skip overload instances with uninitialized fntype (PR103622)

    2022-01-05  Bill Schmidt  <wschmidt@linux.ibm.com>

    gcc/
            PR target/103622
            * config/rs6000/rs6000-c.c (altivec_resolve_overloaded_builtin):
            Skip over instances with undefined function types.

[Bug target/103622] [12 Regression] ICE: Segmentation fault (in altivec_resolve_new_overloaded_builtin)

[wschmidt at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103622

Bill Schmidt <wschmidt at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #12 from Bill Schmidt <wschmidt at gcc dot gnu.org> ---
Fixed now.