[Bug target/107540] New: [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[Bug target/107540] New: [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107540

            Bug ID: 107540
           Summary: [13 Regression] ICE: SIGSEGV in
                    memory_operand(rtx_def*, machine_mode) (recog.cc:1834)
                    with -flive-range-shrinkage
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 53838
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53838&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -flive-range-shrinkage -mavx testcase.c -wrapper
valgrind,-q
==15852== Invalid read of size 2
==15852==    at 0x1328AAA: memory_operand(rtx_def*, machine_mode)
(recog.cc:1834)
==15852==    by 0x1C0A905: get_attr_memory(rtx_insn*) (i386.md:5270)
==15852==    by 0x202F5B7: insn_default_latency_generic(rtx_insn*)
(i386.md:19121)
==15852==    by 0x2485921: insn_sched_cost(rtx_insn*) (haifa-sched.cc:1421)
==15852==    by 0x2489FE2: dep_cost_1(_dep*, unsigned int)
(haifa-sched.cc:1474)
==15852==    by 0x248BCD1: dep_cost (haifa-sched.cc:1510)
==15852==    by 0x248BCD1: priority(rtx_insn*, bool) [clone .part.0]
(haifa-sched.cc:1661)
==15852==    by 0x248C5D2: priority (haifa-sched.cc:1593)
==15852==    by 0x248C5D2: set_priorities(rtx_insn*, rtx_insn*)
(haifa-sched.cc:7166)
==15852==    by 0x137D6A2: compute_priorities() (sched-rgn.cc:3025)
==15852==    by 0x13803D5: schedule_region (sched-rgn.cc:3139)
==15852==    by 0x13803D5: schedule_insns() [clone .part.0] (sched-rgn.cc:3527)
==15852==    by 0x13809FB: schedule_insns (sched-rgn.cc:3513)
==15852==    by 0x13809FB: rest_of_handle_live_range_shrinkage
(sched-rgn.cc:3715)
==15852==    by 0x13809FB: (anonymous
namespace)::pass_live_range_shrinkage::execute(function*) (sched-rgn.cc:3802)
==15852==    by 0x12D855A: execute_one_pass(opt_pass*) (passes.cc:2644)
==15852==    by 0x12D8E3F: execute_pass_list_1(opt_pass*) (passes.cc:2753)
==15852==  Address 0xabababababababab is not stack'd, malloc'd or (recently)
free'd
==15852== 
during RTL pass: lr_shrinkage
testcase.c: In function 'foo':
testcase.c:9:1: internal compiler error: Segmentation fault
    9 | }
      | ^
0x13e1bbf crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:314
0x1328aaa memory_operand(rtx_def*, machine_mode)
        /repo/gcc-trunk/gcc/recog.cc:1834
0x1c0a905 get_attr_memory(rtx_insn*)
        /repo/gcc-trunk/gcc/config/i386/i386.md:5270
0x202f5b7 insn_default_latency_generic(rtx_insn*)
        /repo/gcc-trunk/gcc/config/i386/i386.md:19121
0x2485921 insn_sched_cost(rtx_insn*)
        /repo/gcc-trunk/gcc/haifa-sched.cc:1421
0x2489fe2 dep_cost_1(_dep*, unsigned int)
        /repo/gcc-trunk/gcc/haifa-sched.cc:1474
0x248bcd1 dep_cost(_dep*)
        /repo/gcc-trunk/gcc/haifa-sched.cc:1510
0x248bcd1 priority
        /repo/gcc-trunk/gcc/haifa-sched.cc:1661
0x248c5d2 priority
        /repo/gcc-trunk/gcc/haifa-sched.cc:1593
0x248c5d2 set_priorities(rtx_insn*, rtx_insn*)
        /repo/gcc-trunk/gcc/haifa-sched.cc:7166
0x137d6a2 compute_priorities()
        /repo/gcc-trunk/gcc/sched-rgn.cc:3025
0x13803d5 schedule_region
        /repo/gcc-trunk/gcc/sched-rgn.cc:3139
0x13803d5 schedule_insns()
        /repo/gcc-trunk/gcc/sched-rgn.cc:3527
0x13809fb schedule_insns()
        /repo/gcc-trunk/gcc/sched-rgn.cc:3513
0x13809fb rest_of_handle_live_range_shrinkage
        /repo/gcc-trunk/gcc/sched-rgn.cc:3715
0x13809fb execute
        /repo/gcc-trunk/gcc/sched-rgn.cc:3802
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r13-3702-20221106155652-g3628025ac60-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r13-3702-20221106155652-g3628025ac60-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.0 20221104 (experimental) (GCC)

[Bug target/107540] [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107540

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0

[Bug target/107540] [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[crazylht at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107540

Hongtao.liu <crazylht at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |crazylht at gmail dot com

--- Comment #1 from Hongtao.liu <crazylht at gmail dot com> ---
Guess hit some insn attribute automatical detection assert. I'll take a look.

[Bug target/107540] [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[crazylht at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107540

--- Comment #2 from Hongtao.liu <crazylht at gmail dot com> ---
diff --git a/gcc/config/i386/sse.md b/gcc/config/i386/sse.md
index fa93ae7bf21..4e8463addc3 100644
--- a/gcc/config/i386/sse.md
+++ b/gcc/config/i386/sse.md
@@ -12203,7 +12203,7 @@ (define_insn "avx512f_movddup512<mask_name>"
                     (const_int 6) (const_int 14)])))]
   "TARGET_AVX512F"
   "vmovddup\t{%1, %0<mask_operand2>|%0<mask_operand2>, %1}"
-  [(set_attr "type" "sselog")
+  [(set_attr "type" "sselog1")
    (set_attr "prefix" "evex")
    (set_attr "mode" "V8DF")])

@@ -12234,7 +12234,7 @@ (define_insn "avx_movddup256<mask_name>"
                     (const_int 2) (const_int 6)])))]
   "TARGET_AVX && <mask_avx512vl_condition>"
   "vmovddup\t{%1, %0<mask_operand2>|%0<mask_operand2>, %1}"
-  [(set_attr "type" "sselog")
+  [(set_attr "type" "sselog1")
    (set_attr "prefix" "<mask_prefix>")
    (set_attr "mode" "V4DF")])



Testing.

[Bug target/107540] [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107540

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by hongtao Liu <liuhongt@gcc.gnu.org>:

https://gcc.gnu.org/g:916bec9a05ea522c81381e0c93590d46965d9c7b

commit r13-3821-g916bec9a05ea522c81381e0c93590d46965d9c7b
Author: liuhongt <hongtao.liu@intel.com>
Date:   Mon Nov 7 09:55:25 2022 +0800

    Fix incorrect insn type to avoid ICE in memory attr auto-detection.

    Memory attribute auto detection will check operand 2 for type sselog,
    and check operand 1 for type sselog1. For below 2 insns, there's no
    operand 2. Change type to sselog1.

    gcc/ChangeLog:

            PR target/107540
            * config/i386/sse.md (avx512f_movddup512<mask_name>): Change
            type from sselog to sselog1.
            (avx_movddup256<mask_name>): Ditto.

    gcc/testsuite/ChangeLog:

            * gcc.target/i386/pr107540.c: New test.

[Bug target/107540] [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[crazylht at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107540

--- Comment #4 from Hongtao.liu <crazylht at gmail dot com> ---
Fixed in GCC13.

[Bug target/107540] [13 Regression] ICE: SIGSEGV in memory_operand(rtx_def*, machine_mode) (recog.cc:1834) with -flive-range-shrinkage

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107540

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Then fixed.