[Bug target/108484] New: [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[Bug target/108484] New: [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[jsm28 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

            Bug ID: 108484
           Summary: [13 Regression] ICE building glibc for ia64 in
                    cselib_subst_to_values, at cselib.cc:2148
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jsm28 at gcc dot gnu.org
                CC: aoliva at gcc dot gnu.org
  Target Milestone: ---
            Target: ia64*-*-*

Created attachment 54319
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54319&action=edit
preprocessed source

Compile the attached file (from glibc) with -g -O2 for ia64-linux-gnu. This
produces the following ICE:

during RTL pass: mach
In file included from ../sysdeps/ia64/unwind-resume.c:18:
../sysdeps/generic/unwind-resume.c: In function '_Unwind_Resume':
../sysdeps/generic/unwind-resume.c:38:1: internal compiler error: in
cselib_subst_to_values, at cselib.cc:2148
0x5fd409 cselib_subst_to_values(rtx_def*, machine_mode)
        /scratch/jmyers/glibc/many13/src/gcc/gcc/cselib.cc:2148
0x98c873 cselib_subst_to_values(rtx_def*, machine_mode)
        /scratch/jmyers/glibc/many13/src/gcc/gcc/cselib.cc:2193
0x98f761 cselib_subst_to_values_from_insn(rtx_def*, machine_mode, rtx_insn*)
        /scratch/jmyers/glibc/many13/src/gcc/gcc/cselib.cc:2264
0x18172aa add_insn_mem_dependence
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-deps.cc:1741
0x181b230 sched_analyze_2
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-deps.cc:2688
0x181b267 sched_analyze_2
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-deps.cc:2806
0x181b9eb sched_analyze_insn
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-deps.cc:2960
0x181ddb0 deps_analyze_insn(deps_desc*, rtx_insn*)
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-deps.cc:3683
0x181e40e sched_analyze(deps_desc*, rtx_insn*, rtx_insn*)
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-deps.cc:3836
0x1821870 schedule_ebb(rtx_insn*, rtx_insn*, bool)
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-ebb.cc:505
0x1821da2 schedule_ebbs()
        /scratch/jmyers/glibc/many13/src/gcc/gcc/sched-ebb.cc:655
0x11b3346 ia64_reorg
        /scratch/jmyers/glibc/many13/src/gcc/gcc/config/ia64/ia64.cc:9862
0xdb527d execute
        /scratch/jmyers/glibc/many13/src/gcc/gcc/reorg.cc:3927
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Introduced by g:3c99493bf39a7fef9213e6f5af94b78bb15fcfdc

commit 3c99493bf39a7fef9213e6f5af94b78bb15fcfdc
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Thu Jan 19 01:09:15 2023 -0300

    [PR106746] drop cselib addr lookup in debug insn mem

    The testcase used to get scheduled differently depending on the
    presence of debug insns with MEMs.  It's not clear to me why those
    MEMs affected scheduling, but the cselib pre-canonicalization of the
    MEM address is not used at all when analyzing debug insns, so the
    memory allocation and lookup are pure waste.  Somehow, avoiding that
    waste fixes the problem, or makes it go latent.


    for  gcc/ChangeLog

            PR debug/106746
            * sched-deps.cc (sched_analyze_2): Skip cselib address lookup
            within debug insns.

    for  gcc/testsuite/ChangeLog

            PR debug/106746
            * gcc.target/i386/pr106746.c: New.

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #1 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Created attachment 54325
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54325&action=edit
Testcase for c6x

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-01-21
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Jeffrey A. Law <law at gcc dot gnu.org> ---
I'm seeing this for c6x as well building libgcc.  Testcase attached, compile
with -O2 -g.

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
See PR108463 and
https://gcc.gnu.org/pipermail/gcc-patches/2023-January/610778.html

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2023-January
                   |                            |/610778.html

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I've just verified the
https://gcc.gnu.org/pipermail/gcc-patches/2023-January/610778.html
patch fixes both the #c0 ICE on ia64-linux and #c1 ICE on tic6x-uclinux (and
without it both ICE for me).

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:465a9c51e7d5bafa7a81195b5af20f2a54f22210

commit r13-5652-g465a9c51e7d5bafa7a81195b5af20f2a54f22210
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Feb 2 13:52:45 2023 +0100

    sched-deps, cselib: Fix up some -fcompare-debug issues and regressions
[PR108463]

    On Sat, Jan 14, 2023 at 08:26:00AM -0300, Alexandre Oliva via Gcc-patches
wrote:
    > The testcase used to get scheduled differently depending on the
    > presence of debug insns with MEMs.  It's not clear to me why those
    > MEMs affected scheduling, but the cselib pre-canonicalization of the
    > MEM address is not used at all when analyzing debug insns, so the
    > memory allocation and lookup are pure waste.  Somehow, avoiding that
    > waste fixes the problem, or makes it go latent.

    Unfortunately, this patch breaks the following testcase.
    The code in sched_analyze_2 did 2 things:
    1) cselib_lookup_from_insn
    2) shallow_copy_rtx + cselib_subst_to_values_from_insn
    Now, 1) is precondition of 2), we can only subst the VALUEs if we
    have actually looked the address up, but as can be seen on that testcase,
    we are relying on at least the 1) to be done because we subst the values
    later on even on DEBUG_INSNs and actually use those when needed.
    cselib_subst_to_values_from_insn mostly just replaces stuff in the
    returned rtx, except for:
          /* This used to happen for autoincrements, but we deal with them
             properly now.  Remove the if stmt for the next release.  */
          if (! e)
            {
              /* Assign a value that doesn't match any other.  */
              e = new_cselib_val (next_uid, GET_MODE (x), x);
            }
    which is like that since 2011, I hope it is never reachable and we should
    in stage1 replace that with gcc_assert or just remove (then it will
    segfault on following
          return e->val_rtx;
    ).

    So, I (as done in the patch below) reinstalled the 1) and not 2) for
    DEBUG_INSNs.  This fixed the new testcase, but broke again the PR106746
    testcases.

    I've spent a day debugging that and found the problem is that as documented
    in a large comment in cselib.cc above n_useless_values variable definition,
    we spend quite a few effort on making sure that VALUEs created on
    DEBUG_INSNs don't affect the cselib decisions for non-DEBUG_INSNs such as
    pruning of useless values etc., but if a VALUE created that way is then
    looked up/needed from non-DEBUG_INSNs, we promote it to non-debug.

    The reason for -fcompare-debug failure is that there is one large
DEBUG_INSN
    with 16 MEMs in it mostly with addresses that so far didn't appear in the
IL
    otherwise.  Later on, we see an instruction storing into MEM destination
    and invalidate that MEM.  Unfortunately, there is a bug caused by the
    introduction of SP_DERIVED_VALUE_P where alias.cc isn't able to
disambiguate
    MEMs with sp + optional offset in address vs. MEMs with address being a
    VALUE having SP_DERIVED_VALUE_P + constant (or the SP_DERIVED_VALUE_P
    itself), which ought to be possible when REG_VALUES (REGNO
    (stack_pointer_rtx)) has SP_DERIVED_VALUE_P + constant location.  Not sure
    if I should try to fix that in stage4 or defer for stage1.
    Anyway, the cselib_invalidate_mem call because of this invalidates
basically
    all MEMs with the exception of 5 which have MEM_EXPRs that guarantee
    non-aliasing with the sp based store.
    Unfortunately, n_useless_values which in my understanding should be always
    the same between -g and -g0 compilations diverges, has 3 more useless
values
    for -g.

    Now, these were initially VALUEs created for DEBUG_INSN lookups.  As I
said,
    cselib.cc has code to promote such VALUEs (well, their location elements)
to
    non-debug if they are looked up from non-DEBUG_INSNs.  The problem is that
    when looking some completely unrelated MEM from a non-DEBUG_INSN we run
into
    a hash collision and so call cselib_hasher::equal to check if the unrelated
    MEM is equal to the one from DEBUG_INSN only element.  The equal static
    member function calls rtx_equal_for_cselib_1 and if that returns true,
    promotes the location to non-DEBUG, otherwise returns false.  So far so
    good.  But rtx_equal_for_cselib_1 internally performs various other cselib
    lookups, all done with the non-DEBUG_INSN cselib_current_insn, so they
    all promote to non-debug.  And that is wrong, because if it was -g0
    compilation, such hashtable entry wouldn't be there at all (or would be
    but wouldn't contain that locs element), so with -g0 we wouldn't call
    that rtx_equal_for_cselib_1 at all.  So, I think we need to pretend
    that such lookup which only happens with -g and not -g0 actually comes
    from some DEBUG_INSN (note, the lookups rtx_equal_for_cselib_1 does
    are always with create = 0).
    The cselib.cc part of the patch does that.

    BTW, I'm not really sure how:
              if (num_mems < param_max_cselib_memory_locations
                  && ! canon_anti_dependence (x, false, mem_rtx,
                                              GET_MODE (mem_rtx), mem_addr))
                {
                  has_mem = true;
                  num_mems++;
                  p = &(*p)->next;
                  continue;
                }
    num_mems cap can actually work correctly for -fcompare-debug,
    I'd think we would need to differentiate between num_debug_mems and
    num_mems depending on if setting_insn is non-NULL DEBUG_INSN or not.
    That was one of my suspicions on this testcase, but the number of MEMs
    was small enough for the param in either case (especially because of
    the above mentioned missed non-aliasings).  But as implemented, I think
    if we have tons of non-aliased MEMs from DEBUG_INSN setting_insns,
    we could unchain lots more non-DEBUG MEMs with -g than with -g0.

    2023-02-02  Jakub Jelinek  <jakub@redhat.com>

            PR debug/106746
            PR rtl-optimization/108463
            PR target/108484
            * cselib.cc (cselib_current_insn): Move declaration earlier.
            (cselib_hasher::equal): For debug only locs, temporarily override
            cselib_current_insn to their l->setting_insn for the
            rtx_equal_for_cselib_1 call, so that unsuccessful comparisons don't
            promote some debug locs.
            * sched-deps.cc (sched_analyze_2) <case MEM>: For MEMs in
DEBUG_INSNs
            when using cselib call cselib_lookup_from_insn on the address but
            don't substitute it.

            * gcc.dg/pr108463.c: New test.

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Should be fixed now.

[Bug target/108484] [13 Regression] ICE building glibc for ia64 in cselib_subst_to_values, at cselib.cc:2148

[sam at gentoo dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108484

--- Comment #7 from Sam James <sam at gentoo dot org> ---
Could you add 108463 to See Also? Thanks.