[Bug rtl-optimization/109676] New: [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[Bug rtl-optimization/109676] New: [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

            Bug ID: 109676
           Summary: [13/14 regression] ICE in simplify_subreg, at
                    simplify-rtx.cc:7426 when building firefox with -O2
                    -march=alderlake -g
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
  Target Milestone: ---

Originally reported downstream in Gentoo at https://bugs.gentoo.org/905262.

Unfortunately, the original reproducer is too big even compressed, so it's at
http://dev.gentoo.org/~sam/bugs/gcc/gcc-firefox-alderlake-x86/Unified_cpp_dom_fetch1.ii.xz.
I'm working on a reduction now.

```
$ g++-13 -march=alderlake -O2 -g -c Unified_cpp_dom_fetch1.ii
[...]
during RTL pass: vartrack
Unified_cpp_dom_fetch1.ii: In static member function ‘static
mozilla::Maybe<mozilla::dom::ParentToParentStream>
IPC::ParamTraits<mozilla::dom::ParentToParentStream>::Read(IPC::MessageReader*)’:
Unified_cpp_dom_fetch1.ii:183311:1: internal compiler error: in
simplify_subreg, at simplify-rtx.cc:7426
183311 | }
       | ^
0xb99b70 simplify_context::simplify_subreg(machine_mode, rtx_def*,
machine_mode, poly_int<1u, unsigned long>)
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/simplify-rtx.cc:7426
0x1f4e111 simplify_context::simplify_gen_subreg(machine_mode, rtx_def*,
machine_mode, poly_int<1u, unsigned long>)
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/simplify-rtx.cc:7715
0x20c4a01 simplify_gen_subreg(machine_mode, rtx_def*, machine_mode,
poly_int<1u, unsigned long>)
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/rtl.h:3535
0x20c4a01 vt_expand_loc_callback
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:8524
0x208b8b1 cselib_expand_value_rtx_1
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/cselib.cc:1953
0x20c3b4b vt_expand_var_loc_chain
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/cselib.cc:1836
0x20c459b vt_expand_loc_callback
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:8583
0x208b4ec cselib_expand_value_rtx_1
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/cselib.cc:1988
0x20c3b4b vt_expand_var_loc_chain
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/cselib.cc:1836
0x20c459b vt_expand_loc_callback
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:8583
0x20c3b4b vt_expand_var_loc_chain
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/cselib.cc:1836
0x20c459b vt_expand_loc_callback
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:8583
0x208b4ec cselib_expand_value_rtx_1
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/cselib.cc:1988
0x20c3b4b vt_expand_var_loc_chain
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/cselib.cc:1836
0x20c2f94 vt_expand_1pvar
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:8696
0x20c2f94 emit_note_insn_var_location(variable**, emit_note_data*)
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:8750
0x20804fc void hash_table<variable_hasher, false,
xcallocator>::traverse_noresize<emit_note_data*,
&(emit_note_insn_var_location(variable**, emit_note_data*))>(emit_note_data*)
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/hash-table.h:1173
0x20804fc void hash_table<variable_hasher, false,
xcallocator>::traverse<emit_note_data*,
&(emit_note_insn_var_location(variable**, emit_note_data*))>(emit_note_data*)
        /usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/hash-table.h:1194
0x20804fc emit_notes_for_changes
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:9110
0x207e49d emit_notes_in_bb
       
/usr/src/debug/sys-devel/gcc-13.1.0-r1/gcc-13.1.0/gcc/var-tracking.cc:9544
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
```

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.2
           Keywords|                            |ice-on-valid-code

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection,
                   |                            |needs-reduction

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, reducing it too.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
Created attachment 54955
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54955&action=edit
a-FetchTypes.ii.xz

I noticed the filename was 'Unified...' so I tried out
https://firefox-source-docs.mozilla.org/build/buildsystem/unified-builds.html
to disable unified builds and got something a *little bit* smaller
(a-FetchTypes.ii).

I'm going to try reduce this one instead, but let pinskia carry on with the
original. It might well reduce to 2 quite different things.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #3 from Sam James <sjames at gcc dot gnu.org> ---
Created attachment 54958
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54958&action=edit
small.ii

This took 14.5 hours, but we got there! Smaller reproducer attached. Interested
in if pinskia's one is going to be different...

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 54959
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54959&action=edit
Sam's reduced testcase reduced slightly more

Just slightly more reduced ...

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-04-29
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #54959|0                           |1
        is obsolete|                            |

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 54960
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54960&action=edit
Slightly more reduced

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---

102: (value/u:V1TI 24:24 @0x49b13d8/0x49a15f0) is at (mem/c:V1TI (value/u:DI
13:4290 @0x49b1328/0x49a1438) [0 p+0 S16 A128])
102: (reg:V1TI 20 xmm0 [orig:91 p ] [91]) evaluates to (value/u/f:V1TI 24:24
@0x49b13d8/0x49a15f0)


It is this which is causing the ICE:
(insn 102 110 106 6 (set (reg:V1TI 20 xmm0 [orig:91 p ] [91])
        (mem/c:V1TI (plus:DI (reg/f:DI 7 sp)
                (const_int 32 [0x20])) [0 p+0 S16 A128]))
"/app/example.cpp":26:12 1838 {movv1ti_internal}
     (nil))
(debug_insn 106 102 107 6 (var_location:QI D#3 (mem/c:QI (plus:DI (reg/f:DI 7
sp)
            (const_int 48 [0x30])) [0 p.mIsSome+0 S1 A128]))
"/app/example.cpp":26:12 -1
     (nil))
(debug_insn 107 106 108 6 (var_location:QI tmp$mIsSome (debug_expr:QI D#3))
"/app/example.cpp":26:12 -1
     (nil))

I suspect it is doing a subreg for QI mode of a V1TI reg and simplify_subreg is
ICEing out.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I suspect it was r13-1607-gc3ed9e0d6e96d8697e4bab994 which might have exposed
this latent issue ...

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Sam James from comment #3)
> Created attachment 54958 [details]
> small.ii
> 
> This took 14.5 hours, but we got there! Smaller reproducer attached.
> Interested in if pinskia's one is going to be different...

Looks like it is going to be reduced to a very similar code. That is the code
like ParamTraitsRead is definitely the function where the ICE happens in my
reduced version.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |
            Summary|[13/14 regression] ICE in   |[13/14 regression] ICE in
                   |simplify_subreg, at         |simplify_subreg, at
                   |simplify-rtx.cc:7426 when   |simplify-rtx.cc:7426 when
                   |building firefox with -O2   |building firefox with -O2
                   |-march=alderlake -g         |-march=alderlake -g since
                   |                            |r13-3378-gf6c168f8c06047
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #10 from Sam James <sjames at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #8)
> I suspect it was r13-1607-gc3ed9e0d6e96d8697e4bab994 which might have
> exposed this latent issue ...

Bisect says r13-3378-gf6c168f8c06047 and a revert on trunk works but probably
latent still

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
This looks like a STV bug to me.  Before the stv pass, we have correct
(debug_insn 114 47 51 8 (var_location:TI D#3 (reg:TI 91 [ p ])) -1
     (nil))
but stv changes that to invalid
(debug_insn 114 47 51 8 (var_location:TI D#3 (reg:V1TI 91 [ p ])) -1
     (nil))
where the modes no longer match.  Will have a look...

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The mode is changed in:
1637        case REG:
1638          PUT_MODE (src, V1TImode);
1639          /* Call fix_debug_reg_uses only if SRC is never defined.  */
1640          if (!DF_REG_DEF_CHAIN (REGNO (src)))
1641            fix_debug_reg_uses (src);
but because DF_REG_DEF_CHAIN (REGNO (src)) - it contains the
(insn 97 96 98 9 (set (reg:V1TI 91 [ p ])
        (mem/c:TI (plus:DI (reg/f:DI 19 frame)
                (const_int -32 [0xffffffffffffffe0])) [0 p+0 S16 A128]))
"pr109676.C":26:12 87 {*movti_internal}
     (nil))
insn which sets it, fix_debug_reg_uses isn't called.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 54963
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54963&action=edit
gcc14-pr109676.patch

Untested fix.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |13.1.0
           Priority|P3                          |P2

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #14 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:3a715d3e136fc4dfdc42cb6a3ee1a7df3e2a171a

commit r14-468-g3a715d3e136fc4dfdc42cb6a3ee1a7df3e2a171a
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu May 4 09:36:05 2023 +0200

    i386: Fix up handling of debug insns in STV [PR109676]

    The following testcase ICEs because STV replaces there
    (debug_insn 114 47 51 8 (var_location:TI D#3 (reg:TI 91 [ p ])) -1
         (nil))
    with
    (debug_insn 114 47 51 8 (var_location:TI D#3 (reg:V1TI 91 [ p ])) -1
         (nil))
    which is invalid because of the mode mismatch.
    STV has fix_debug_reg_uses function which is supposed to fix this up
    and adjust such debug insns into
    (debug_insn 114 47 51 8 (var_location:TI D#3 (subreg:TI (reg:V1TI 91 [ p ])
0)) -1
         (nil))
    but it doesn't trigger here.
    The IL before stv1 has:
    (debug_insn 114 47 51 8 (var_location:TI D#3 (reg:TI 91 [ p ])) -1
         (nil))
    ...
    (insn 63 62 64 8 (set (mem/c:TI (reg/f:DI 89 [ .result_ptr ]) [0
<retval>.mStorage+0 S16 A32])
            (reg:TI 91 [ p ])) "pr109676.C":4:48 87 {*movti_internal}
         (expr_list:REG_DEAD (reg:TI 91 [ p ])
            (nil)))
    in bb 8 and
    (insn 97 96 98 9 (set (reg:TI 91 [ p ])
            (mem/c:TI (plus:DI (reg/f:DI 19 frame)
                    (const_int -32 [0xffffffffffffffe0])) [0 p+0 S16 A128]))
"pr109676.C":26:12 87 {*movti_internal}
         (nil))
    (insn 98 97 99 9 (set (mem/c:TI (plus:DI (reg/f:DI 19 frame)
                    (const_int -64 [0xffffffffffffffc0])) [0 tmp+0 S16 A128])
            (reg:TI 91 [ p ])) "pr109676.C":26:12 87 {*movti_internal}
         (nil))
    in bb9.
    PUT_MODE on a REG is done in two spots in
timode_scalar_chain::convert_insn,
    one is:
      switch (GET_CODE (dst))
        {
        case REG:
          if (GET_MODE (dst) == TImode)
            {
              PUT_MODE (dst, V1TImode);
              fix_debug_reg_uses (dst);
            }
          if (GET_MODE (dst) == V1TImode)
    when seeing the REG in SET_DEST and another one the hunk the patch adjusts.
    Because bb 8 comes first in the order the pass walks the bbs, we first
    notice the TImode pseudo on insn 63 where it is SET_SRC, use PUT_MODE there
    unconditionally, so for a shared REG it changes all other uses in the IL,
    and then don't call fix_debug_reg_uses because DF_REG_DEF_CHAIN (REGNO
(src))
    is non-NULL - the REG is set in insn 97 but we haven't processed it yet.
    Later on we process insn 97, but because the REG in SET_DEST already has
    V1TImode, we don't do anything, even when the src handling code earlier
    relied on it being done.

    The following patch fixes this by using similar code for both dst and src,
    in particular calling fix_debug_reg_uses once when we actually change REG
    mode from TImode to V1TImode, and not later on.

    2023-05-04  Jakub Jelinek  <jakub@redhat.com>

            PR debug/109676
            * config/i386/i386-features.cc (timode_scalar_chain::convert_insn):
            If src is REG, change its mode to V1TImode and call
fix_debug_reg_uses
            for it only if it still has TImode.  Don't decide whether to call
            fix_debug_reg_uses based on whether SRC is ever set or not.

            * g++.target/i386/pr109676.C: New test.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

--- Comment #15 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:05bc529829f25aacdaa567ef488b353bf2746c5b

commit r13-7292-g05bc529829f25aacdaa567ef488b353bf2746c5b
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu May 4 09:36:05 2023 +0200

    i386: Fix up handling of debug insns in STV [PR109676]

    The following testcase ICEs because STV replaces there
    (debug_insn 114 47 51 8 (var_location:TI D#3 (reg:TI 91 [ p ])) -1
         (nil))
    with
    (debug_insn 114 47 51 8 (var_location:TI D#3 (reg:V1TI 91 [ p ])) -1
         (nil))
    which is invalid because of the mode mismatch.
    STV has fix_debug_reg_uses function which is supposed to fix this up
    and adjust such debug insns into
    (debug_insn 114 47 51 8 (var_location:TI D#3 (subreg:TI (reg:V1TI 91 [ p ])
0)) -1
         (nil))
    but it doesn't trigger here.
    The IL before stv1 has:
    (debug_insn 114 47 51 8 (var_location:TI D#3 (reg:TI 91 [ p ])) -1
         (nil))
    ...
    (insn 63 62 64 8 (set (mem/c:TI (reg/f:DI 89 [ .result_ptr ]) [0
<retval>.mStorage+0 S16 A32])
            (reg:TI 91 [ p ])) "pr109676.C":4:48 87 {*movti_internal}
         (expr_list:REG_DEAD (reg:TI 91 [ p ])
            (nil)))
    in bb 8 and
    (insn 97 96 98 9 (set (reg:TI 91 [ p ])
            (mem/c:TI (plus:DI (reg/f:DI 19 frame)
                    (const_int -32 [0xffffffffffffffe0])) [0 p+0 S16 A128]))
"pr109676.C":26:12 87 {*movti_internal}
         (nil))
    (insn 98 97 99 9 (set (mem/c:TI (plus:DI (reg/f:DI 19 frame)
                    (const_int -64 [0xffffffffffffffc0])) [0 tmp+0 S16 A128])
            (reg:TI 91 [ p ])) "pr109676.C":26:12 87 {*movti_internal}
         (nil))
    in bb9.
    PUT_MODE on a REG is done in two spots in
timode_scalar_chain::convert_insn,
    one is:
      switch (GET_CODE (dst))
        {
        case REG:
          if (GET_MODE (dst) == TImode)
            {
              PUT_MODE (dst, V1TImode);
              fix_debug_reg_uses (dst);
            }
          if (GET_MODE (dst) == V1TImode)
    when seeing the REG in SET_DEST and another one the hunk the patch adjusts.
    Because bb 8 comes first in the order the pass walks the bbs, we first
    notice the TImode pseudo on insn 63 where it is SET_SRC, use PUT_MODE there
    unconditionally, so for a shared REG it changes all other uses in the IL,
    and then don't call fix_debug_reg_uses because DF_REG_DEF_CHAIN (REGNO
(src))
    is non-NULL - the REG is set in insn 97 but we haven't processed it yet.
    Later on we process insn 97, but because the REG in SET_DEST already has
    V1TImode, we don't do anything, even when the src handling code earlier
    relied on it being done.

    The following patch fixes this by using similar code for both dst and src,
    in particular calling fix_debug_reg_uses once when we actually change REG
    mode from TImode to V1TImode, and not later on.

    2023-05-04  Jakub Jelinek  <jakub@redhat.com>

            PR debug/109676
            * config/i386/i386-features.cc (timode_scalar_chain::convert_insn):
            If src is REG, change its mode to V1TImode and call
fix_debug_reg_uses
            for it only if it still has TImode.  Don't decide whether to call
            fix_debug_reg_uses based on whether SRC is ever set or not.

            * g++.target/i386/pr109676.C: New test.

    (cherry picked from commit 3a715d3e136fc4dfdc42cb6a3ee1a7df3e2a171a)

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|13.2                        |13.3

--- Comment #16 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 13.2 is being released, retargeting bugs to GCC 13.3.

[Bug debug/109676] [13/14 regression] ICE in simplify_subreg, at simplify-rtx.cc:7426 when building firefox with -O2 -march=alderlake -g since r13-3378-gf6c168f8c06047

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109676

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
   Target Milestone|13.3                        |13.2
         Resolution|---                         |FIXED

--- Comment #17 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed.