[Bug c++/107336] New: [10/11 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[Bug c++/107336] New: [10/11 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[andrew at ishiboo dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

            Bug ID: 107336
           Summary: [10/11 regression] ICE segfault expand_expr_real_1 on
                    sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3
           Product: gcc
           Version: 10.4.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: andrew at ishiboo dot com
  Target Milestone: ---

Created attachment 53736
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53736&action=edit
GCC 10 & 11 pre-processed source files, compressed because they are 2MB each

The ICE segfault happens when building google-benchmark 1.6.1 on
sparc-sun-solaris2.11 in 32-bit mode. I've narrowed down the command line to:

g++ -m32 -mcpu=niagara4 -O3 -c -o /dev/null output_test_helper-preprocessed.cc

  - Building -m64, the ICE does not happen
  - Building without -mcpu=niagara4, the ICE does not happen
  - Building with -O or -O2, the ICE does not happen
  - GCC 9.4.0 does not ICE
  - GCC 10.4.0 triggers ICE during RTL pass: expand
  - GCC 11.3.0 triggers ICE during GIMPLE pass: isel
  - GCC 12.1.0 does not ICE

In GCC 10.4.0, the ICE occurs here:

    during RTL pass: expand
    In file included from /usr/lib/gcc-10.4/include/c++/10.4.0/random:51,
                     from output_test_helper.cc:7:
    /usr/lib/gcc-10.4/include/c++/10.4.0/bits/random.tcc: In member function
'void std::mersenne_twister_engine<_UIntType, __w, __n, __m, __r, __a, __u,
__d, __s, __b, __t, __c, __l, __f>::_M_gen_rand() [with _UIntType = unsigned
int; unsigned int __w = 32; unsigned int __n = 624; unsigned int __m = 397;
unsigned int __r = 31; _UIntType __a = 2567483615; unsigned int __u = 11;
_UIntType __d = 4294967295; unsigned int __s = 7; _UIntType __b = 2636928640;
unsigned int __t = 15; _UIntType __c = 4022730752; unsigned int __l = 18;
_UIntType __f = 1812433253]':
    /usr/lib/gcc-10.4/include/c++/10.4.0/bits/random.tcc:405:14: internal
compiler error: Segmentation Fault
    0x162a8cf crash_signal
            ../../gcc/toplev.c:328
    0x103ce38 expand_expr_real_1(tree_node*, rtx_def*, machine_mode,
expand_modifier, rtx_def**, bool)
            ../../gcc/expr.c:10078
    0x10353af expand_expr_real(tree_node*, rtx_def*, machine_mode,
expand_modifier, rtx_def**, bool)
            ../../gcc/expr.c:8366
    0x102a24f store_expr(tree_node*, rtx_def*, int, bool, bool)
            ../../gcc/expr.c:5757
    0x1029003 expand_assignment(tree_node*, tree_node*, bool)
            ../../gcc/expr.c:5516
    0xe373f7 expand_gimple_stmt_1
            ../../gcc/cfgexpand.c:3784
    0xe3791f expand_gimple_stmt
            ../../gcc/cfgexpand.c:3880
    0xe40a17 expand_gimple_basic_block
            ../../gcc/cfgexpand.c:5929
    0xe42a23 execute
            ../../gcc/cfgexpand.c:6584

Using the same command line with GCC 11.3.0, the ICE still occurs, but changes
to become:

    during GIMPLE pass: isel
    In file included from /usr/lib/gcc-11.3/include/c++/11.3.0/random:51,
                     from output_test_helper.cc:7:
    /usr/lib/gcc-11.3/include/c++/11.3.0/bits/random.tcc: In member function
'void std::mersenne_twister_engine<_UIntType, __w, __n, __m, __r, __a, __u,
__d, __s, __b, __t, __c, __l, __f>::_M_gen_rand() [with _UIntType = unsigned
int; unsigned int __w = 32; unsigned int __n = 624; unsigned int __m = 397;
unsigned int __r = 31; _UIntType __a = 2567483615; unsigned int __u = 11;
_UIntType __d = 4294967295; unsigned int __s = 7; _UIntType __b = 2636928640;
unsigned int __t = 15; _UIntType __c = 4022730752; unsigned int __l = 18;
_UIntType __f = 1812433253]':
    /usr/lib/gcc-11.3/include/c++/11.3.0/bits/random.tcc:394:5: internal
compiler error: in gimple_expand_vec_cond_expr, at gimple-isel.cc:270
    0x1be84ff gimple_expand_vec_cond_expr
            ../../gcc/gimple-isel.cc:267
    0x1be8673 gimple_expand_vec_exprs
            ../../gcc/gimple-isel.cc:297
    0x1be8937 execute
            ../../gcc/gimple-isel.cc:350

No ICE occurs with GCC 12.1.0.

If the underlying issue was fixed (accidentally or not), are there patches that
can be applied to 10/11?

[Bug target/107336] [10/11 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Dup of bug 105312. Fixed for GCC 11.4.0 already.

*** This bug has been marked as a duplicate of bug 105312 ***

[Bug target/107336] [10/11 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
See PR 105573 for the other sparc testcase.

[Bug target/107336] [10/11 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[andrew at ishiboo dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

--- Comment #3 from Andrew Paprocki <andrew at ishiboo dot com> ---
The linked bugs have a patch for gimple-isel.cc that appears to fix the issue
in GCC 11.3.0, but the ICE in GCC 10 is in expr.c and I don't see anything
patching that. Is there another (related?) fix floating around for the GCC 10
ICE or is it a distinct bug?

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[andrew at ishiboo dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

Andrew Paprocki <andrew at ishiboo dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|DUPLICATE                   |---
             Status|RESOLVED                    |UNCONFIRMED
            Summary|[10/11 regression] ICE      |[10 regression] ICE
                   |segfault expand_expr_real_1 |segfault expand_expr_real_1
                   |on sparc-sun-solaris2.11    |on sparc-sun-solaris2.11
                   |with -m32 -mcpu=niagara4    |with -m32 -mcpu=niagara4
                   |-O3                         |-O3

--- Comment #4 from Andrew Paprocki <andrew at ishiboo dot com> ---
Changed to reflect this is just an issue with GCC 10 at this point.

I built HEAD of the releases/gcc-10 branch and it still segfaults here with
using attached test case:

    during RTL pass: expand
    In file included from /usr/lib/gcc-10.4/include/c++/10.4.1/random:51,
                     from output_test_helper-10.cc:7:
    /usr/lib/gcc-10.4/include/c++/10.4.1/bits/random.tcc: In member function
'void std::mersenne_twister_engine<_UIntType, __w, __n, __m, __r, __a, __u,
__d, __s, __b, __t, __c, __l, __f>::_M_gen_rand() [with _UIntType = unsigned
int; unsigned int __w = 32; unsigned int __n = 624; unsigned int __m = 397;
unsigned int __r = 31; _UIntType __a = 2567483615; unsigned int __u = 11;
_UIntType __d = 4294967295; unsigned int __s = 7; _UIntType __b = 2636928640;
unsigned int __t = 15; _UIntType __c = 4022730752; unsigned int __l = 18;
_UIntType __f = 1812433253]':
    /usr/lib/gcc-10.4/include/c++/10.4.1/bits/random.tcc:405:14: internal
compiler error: Segmentation Fault
    0x162a903 crash_signal
            ../../gcc/toplev.c:328
    0x103ceac expand_expr_real_1(tree_node*, rtx_def*, machine_mode,
expand_modifier, rtx_def**, bool)
            ../../gcc/expr.c:10078
    0x1035423 expand_expr_real(tree_node*, rtx_def*, machine_mode,
expand_modifier, rtx_def**, bool)
            ../../gcc/expr.c:8366
    0x102a2c3 store_expr(tree_node*, rtx_def*, int, bool, bool)
            ../../gcc/expr.c:5757
    0x1029077 expand_assignment(tree_node*, tree_node*, bool)
            ../../gcc/expr.c:5516
    0xe3746b expand_gimple_stmt_1
            ../../gcc/cfgexpand.c:3784
    0xe37993 expand_gimple_stmt
            ../../gcc/cfgexpand.c:3880
    0xe40a8b expand_gimple_basic_block
            ../../gcc/cfgexpand.c:5929
    0xe42a97 execute
            ../../gcc/cfgexpand.c:6584

I can confirm that the patch in the above linked bug does fix GCC 11.3.0.

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-10-20
                 CC|                            |ebotcazou at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW

--- Comment #5 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
> The linked bugs have a patch for gimple-isel.cc that appears to fix the
> issue in GCC 11.3.0, but the ICE in GCC 10 is in expr.c and I don't see
> anything patching that. Is there another (related?) fix floating around for
> the GCC 10 ICE or is it a distinct bug?

There is no gimple-isel.cc in GCC 10 so expand_vec_cond_expr in optabs.c
probably needs to be patched instead.

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

--- Comment #6 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Created attachment 53739
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53739&action=edit
Tentative fix

Totally untested.

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |sparc-sun-solaris2.11
   Target Milestone|---                         |10.5

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Eric Botcazou from comment #6)
> Created attachment 53739 [details]
> Tentative fix
> 
> Totally untested.

LGTM

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[andrew at ishiboo dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

--- Comment #8 from Andrew Paprocki <andrew at ishiboo dot com> ---
(In reply to Eric Botcazou from comment #6)
> Created attachment 53739 [details]
> Tentative fix
> 
> Totally untested.

Tested, confirmed releases/gcc-10 branch with this patch fixes the issue.

Thanks Andrew, Eric, Richard for the prompt response.

-Andrew

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Eric Botcazou
<ebotcazou@gcc.gnu.org>:

https://gcc.gnu.org/g:5076eefe23b96279e34351a2a044858bae3251ae

commit r10-11052-g5076eefe23b96279e34351a2a044858bae3251ae
Author: Eric Botcazou <ebotcazou@adacore.com>
Date:   Fri Oct 21 15:46:37 2022 +0200

    Fix VCOND expansion

    Instead of only allowing the signed optab to provide EQ/NE compares, we
    allow both here since there seems to be no documented canonicalization.

    gcc/
            PR target/107336
            * optabs.c (expand_vec_cond_expr): Query both VCOND and VCONDU for
            EQ and NE.

[Bug target/107336] [10 regression] ICE segfault expand_expr_real_1 on sparc-sun-solaris2.11 with -m32 -mcpu=niagara4 -O3

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107336

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #10 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Thanks for confirming.