[Bug rtl-optimization/105459] New: ICE: Segmentation fault (in record_operand_costs)

[Bug rtl-optimization/105459] New: ICE: Segmentation fault (in record_operand_costs)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

            Bug ID: 105459
           Summary: ICE: Segmentation fault (in record_operand_costs)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc 12.0.1 20220424 snapshot (g:6b7441a46c771aa6ecdc0c8ed96197417d036b9a) ICEs
when compiling the following testcase w/ -O1 -flto:

double m;
int n;

__attribute__ ((optimize ("-funsafe-math-optimizations"))) void
bar (int x)
{
  n = x;
  m = n;
}

__attribute__ ((flatten)) void
foo (int x)
{
  bar (x);
}

void
quux (void)
{
  ++n;
}

int
main (void)
{
  foo (0);
  quux ();

  return 0;
}

% x86_64-unknown-linux-gnu-gcc-12.0.1 -O1 -flto qnipdldf.c
during RTL pass: ira
qnipdldf.c: In function 'main':
qnipdldf.c:30:1: internal compiler error: Segmentation fault
   30 | }
      | ^
0xd95abf crash_signal
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/toplev.cc:322
0xbabeb8 record_operand_costs
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira-costs.cc:1382
0xbac464 scan_one_insn
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira-costs.cc:1507
0xbac464 process_bb_for_costs
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira-costs.cc:1632
0xba2ae1 ira_traverse_loop_tree(bool, ira_loop_tree_node*, void
(*)(ira_loop_tree_node*), void (*)(ira_loop_tree_node*))
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira-build.cc:1800
0xbad545 find_costs_and_classes
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira-costs.cc:1728
0xbae639 ira_costs()
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira-costs.cc:2276
0xba806c ira_build()
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira-build.cc:3481
0xb9dd0c ira
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira.cc:5760
0xb9dd0c execute
       
/var/tmp/portage/sys-devel/gcc-12.0.1_p20220424/work/gcc-12-20220424/gcc/ira.cc:6083
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
lto-wrapper: fatal error: x86_64-unknown-linux-gnu-gcc-12.0.1 returned 1 exit
status
compilation terminated.
/usr/lib/gcc/x86_64-unknown-linux-gnu/12.0.1/../../../../x86_64-unknown-linux-gnu/bin/ld:
fatal error: lto-wrapper failed

[Bug rtl-optimization/105459] ICE: Segmentation fault (in record_operand_costs)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
             Target|                            |x86_64-*-* i?86-*-*

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Huh.

#1  0x000000000100602f in record_operand_costs (insn=0x7ffff652d280, pref=0x0)
    at /home/rguenther/src/gcc-12-branch/gcc/ira-costs.cc:1382
1382          memcpy (op_costs[i], init_cost, struct_costs_size);
(gdb) l
1377         for any allocnos, doing it twice if some pair of operands are
1378         commutative.  */
1379      for (i = 0; i < recog_data.n_operands; i++)
1380        {
1381          rtx op_mem = extract_mem_from_operand (recog_data.operand[i]);
1382          memcpy (op_costs[i], init_cost, struct_costs_size);
1383
gdb) p this_target_ira_int->x_init_cost
$7 = (costs *) 0x0

we fail to invoke ira_init_costs for the cgraph node when we switch targets.

#0  restore_target_globals (g=0x7ffff6523cf0)
    at /home/rguenther/src/gcc-12-branch/gcc/target-globals.h:88
#1  0x0000000002987161 in save_target_globals ()
    at /home/rguenther/src/gcc-12-branch/gcc/target-globals.cc:87
#2  0x00000000029871e8 in save_target_globals_default_opts ()
    at /home/rguenther/src/gcc-12-branch/gcc/target-globals.cc:113
#3  0x0000000001910882 in ix86_set_current_function (fndecl=
    <function_decl 0x7ffff6346600 main>)
    at /home/rguenther/src/gcc-12-branch/gcc/config/i386/i386-options.cc:3241
#4  0x0000000000df8000 in invoke_set_current_function_hook (
    fndecl=<function_decl 0x7ffff6346600 main>)
    at /home/rguenther/src/gcc-12-branch/gcc/function.cc:4702
#5  0x0000000000df8374 in allocate_struct_function (
    fndecl=<function_decl 0x7ffff6346600 main>, abstract_p=false)
    at /home/rguenther/src/gcc-12-branch/gcc/function.cc:4825
#6  0x0000000000df867b in push_struct_function (
    fndecl=<function_decl 0x7ffff6346600 main>)
    at /home/rguenther/src/gcc-12-branch/gcc/function.cc:4891
#7  0x00000000010905d0 in input_function (
    fn_decl=<function_decl 0x7ffff6346600 main>, data_in=0x3f36e50, 
    ib=0x7fffffffd920, ib_cfg=0x7fffffffd900, 
    node=<cgraph_node * 0x7ffff6349000 "main"/5>)
    at /home/rguenther/src/gcc-12-branch/gcc/lto-streamer-in.cc:1386

not sure when we are supposed to initialize costs here?

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |linkw at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
            Summary|ICE: Segmentation fault (in |[12/13 Regression] ICE:
                   |record_operand_costs)       |Segmentation fault (in
                   |                            |record_operand_costs) since
                   |                            |r12-3721-g63c6446f77b9001d
   Last reconfirmed|                            |2022-05-03
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-3721-g63c6446f77b9001d.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
But it's likely older as the revision revealed wrong streaming in of
info->fp_expressions.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Kewen Lin <linkw at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |linkw at gcc dot gnu.org

--- Comment #4 from Kewen Lin <linkw at gcc dot gnu.org> ---
Thanks for the reporting, triaging and bisection! I'll have a look first.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.0                        |12.2

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 12.1 is being released, retargeting bugs to GCC 12.2.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Kewen Lin <linkw at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #6 from Kewen Lin <linkw at gcc dot gnu.org> ---
The r12-3721 makes it get the exact fp_expression info and more optimization
chance then exposes this issue.

Some diff from a.wpa.085i.inline between the good and bad:

-IPA function summary for bar/2 inlinable
+IPA function summary for bar/2 inlinable fp_expression

+Copying FP flags from bar/2 to foo/3
...
+Copying FP flags from foo/3 to main/5
...

-IPA function summary for main/5 inlinable
+IPA function summary for main/5 inlinable fp_expression

When we are expand node for function main, we create the target global for its
target option node, later init_function_start -> initialize_rtl ->
backend_init_target -> ira_init -> ira_init_costs initialize the init_cost.
Then it comes to handle ipa_transforms like:

if (ipa_transforms_to_apply.exists ())
    execute_all_ipa_transforms (false);

try to call input_function for callees. In this case, function quux share the
same target option node with main, when switching back to main, it hits the
condition in 

  else if (flag_unsafe_math_optimizations
           != TREE_TARGET_OPTION (new_tree)->x_ix86_unsafe_math_optimizations
           || (flag_excess_precision
               != TREE_TARGET_OPTION (new_tree)->x_ix86_excess_precision))
    {
      cl_target_option_restore (&global_options, &global_options_set,
                                TREE_TARGET_OPTION (new_tree));
      ix86_excess_precision = flag_excess_precision;
      ix86_unsafe_math_optimizations = flag_unsafe_math_optimizations;
      DECL_FUNCTION_SPECIFIC_TARGET (fndecl) = new_tree
        = build_target_option_node (&global_options, &global_options_set);
      if (TREE_TARGET_GLOBALS (new_tree))
        restore_target_globals (TREE_TARGET_GLOBALS (new_tree));
      else if (new_tree == target_option_default_node)
        restore_target_globals (&default_target_globals);
      else
        TREE_TARGET_GLOBALS (new_tree) = save_target_globals_default_opts ();
    }

it calls save_target_globals_default_opts for new target globals. Note that the
previous ira_int in target global has been initialized by backend_init_target,
while this new created target global doesn't, it's associated to the target
node newly created for main. There is no other places to initialize ira_int, so
it gets ICE during ira pass.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #7 from Kewen Lin <linkw at gcc dot gnu.org> ---
I wonder if it's fine to move init_function_start downward after
execute_all_ipa_transforms call? the testing is ongoing.

--- a/gcc/cgraphunit.cc
+++ b/gcc/cgraphunit.cc
@@ -1817,7 +1817,6 @@ cgraph_node::expand (void)

   gcc_assert (DECL_STRUCT_FUNCTION (decl));
   push_cfun (DECL_STRUCT_FUNCTION (decl));
-  init_function_start (decl);

   gimple_register_cfg_hooks ();

@@ -1827,6 +1826,8 @@ cgraph_node::expand (void)
   if (ipa_transforms_to_apply.exists ())
     execute_all_ipa_transforms (false);

+  init_function_start (decl);
+
   /* Perform all tree transforms and optimizations.  */

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #8 from Kewen Lin <linkw at gcc dot gnu.org> ---
(In reply to Kewen Lin from comment #7)
> I wonder if it's fine to move init_function_start downward after
> execute_all_ipa_transforms call? the testing is ongoing.

This proposed patch was bootstrapped and regress-tested. I think it's
reasonable as it can avoid uninitialized target global issue (on secondary
members) exposed by this bug.

But this issue also exposes another problem. The main function shares the
target option node as function quux, after the inlining succeeds, the
flag_unsafe_math_optimizations of main function is updated by copying the flag
from callee bar/foo (see function inline_call). At this time, main shouldn't
share the target option with quux any more, since IIUC once one function
changes the flag_unsafe_math_optimizations, it should sync with the
x_ix86_unsafe_math_optimizations used for target part and should rebuild target
option? It seems there are no such hooks which can be used for this kind of
update.

Hi Jakub, it's related to r11-5855, do you have any thoughts on this?

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #9 from Kewen Lin <linkw at gcc dot gnu.org> ---
inline_call will force reload global optimization.

  /* Reload global optimization flags.  */
  if (reload_optimization_node && DECL_STRUCT_FUNCTION (to->decl) == cfun)
    set_cfun (cfun, true);

It looks that ix86_set_current_function can create one new target option node
even if fndecl == ix86_previous_fndecl but flag_unsafe_math_optimizations (or
flag_excess_precision) != the corresponding values in the associated target
node.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #10 from Kewen Lin <linkw at gcc dot gnu.org> ---
(In reply to Kewen Lin from comment #8)
> (In reply to Kewen Lin from comment #7)
> > I wonder if it's fine to move init_function_start downward after
> > execute_all_ipa_transforms call? the testing is ongoing.
> 
> This proposed patch was bootstrapped and regress-tested. I think it's
> reasonable as it can avoid uninitialized target global issue (on secondary
> members) exposed by this bug.
> 

Just noticed that in execute_pass_list (cfun, g->get_passes ()->all_passes),
it's still possible in theory to change the cfun and cause the possible target
global creation (call save_target_globals_default_opts for a totally new target
option node, I think it wants copying actually) in target hook. Although the
proposed fix can make the ICE gone, this issue gets exposed is due to the
special handlings introduced by r11-5855 which creates target globals again.

Technically speaking we can create one new target option node and with a new
target globals in set_current_function hook without any restricted conditions,
then this issue can be exposed easily. Not sure this kind of need would become
popular or not, if yes, we probably need to add one deep copy interface for
target globals when its previous target global having
this_target_rtl->target_specific_initialized true.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #11 from Kewen Lin <linkw at gcc dot gnu.org> ---
(In reply to Kewen Lin from comment #9)
> inline_call will force reload global optimization.
> 
>   /* Reload global optimization flags.  */
>   if (reload_optimization_node && DECL_STRUCT_FUNCTION (to->decl) == cfun)
>     set_cfun (cfun, true);
> 
> It looks that ix86_set_current_function can create one new target option
> node even if fndecl == ix86_previous_fndecl but
> flag_unsafe_math_optimizations (or flag_excess_precision) != the
> corresponding values in the associated target node.

We can't do this during the target hook ix86_set_current_function since at that
time (WPA phase) the cfun is NULL, even if we want to update the target option
node for to->decl, but the passed down fndecl is NULL.

I made a patch to rebuild the target option node for to->decl DECL once
reload_optimization_node is true. For this failure case, the
opts.x_flag_unsafe_math_optimizations has changed, we have to sync it to
x_ix86_unsafe_math_optimizations and rebuild.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[linkw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #12 from Kewen Lin <linkw at gcc dot gnu.org> ---
Created attachment 53068
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53068&action=edit
tested patch

Once the optimization node of the caller has changed, we need to rebuild the
target node in the context of new optimization node, and update the target node
if it changes as well.

[Bug rtl-optimization/105459] [12/13 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:4c94382a132a4b2b9d020806549a006fa6764d1b

commit r13-1600-g4c94382a132a4b2b9d020806549a006fa6764d1b
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Jul 1 14:11:35 2022 +0200

    target/105459 - allow delayed target option node fixup

    The following avoids the need to massage the target optimization
    node at WPA time when we fixup the optimization node, copying
    FP related flags from callee to caller.  The target is already
    set up to fixup, but that only works when not switching between
    functions.  After fixing that the fixup is then done at LTRANS
    time when materializing the function.

    2022-07-01  Richard Biener  <rguenthert@suse.de>

            PR target/105459
            * config/i386/i386-options.cc (ix86_set_current_function):
            Rebuild the target optimization node whenever necessary,
            not only when the optimization node didn't change.

            * gcc.dg/lto/pr105459_0.c: New testcase.

[Bug rtl-optimization/105459] [12 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|linkw at gcc dot gnu.org           |rguenth at gcc dot gnu.org
      Known to work|                            |13.0
            Summary|[12/13 Regression] ICE:     |[12 Regression] ICE:
                   |Segmentation fault (in      |Segmentation fault (in
                   |record_operand_costs) since |record_operand_costs) since
                   |r12-3721-g63c6446f77b9001d  |r12-3721-g63c6446f77b9001d

--- Comment #14 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk, mine for backporting.

[Bug rtl-optimization/105459] [12 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

--- Comment #15 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:4ed850a568e4d27a2df566f13843714ca80d437e

commit r12-8576-g4ed850a568e4d27a2df566f13843714ca80d437e
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Jul 1 14:11:35 2022 +0200

    target/105459 - allow delayed target option node fixup

    The following avoids the need to massage the target optimization
    node at WPA time when we fixup the optimization node, copying
    FP related flags from callee to caller.  The target is already
    set up to fixup, but that only works when not switching between
    functions.  After fixing that the fixup is then done at LTRANS
    time when materializing the function.

    2022-07-01  Richard Biener  <rguenthert@suse.de>

            PR target/105459
            * config/i386/i386-options.cc (ix86_set_current_function):
            Rebuild the target optimization node whenever necessary,
            not only when the optimization node didn't change.

            * gcc.dg/lto/pr105459_0.c: New testcase.

    (cherry picked from commit 4c94382a132a4b2b9d020806549a006fa6764d1b)

[Bug rtl-optimization/105459] [12 Regression] ICE: Segmentation fault (in record_operand_costs) since r12-3721-g63c6446f77b9001d

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105459

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to work|                            |12.1.1
         Resolution|---                         |FIXED
      Known to fail|                            |12.1.0

--- Comment #16 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.