[Bug middle-end/111845] New: [14 regression] ICE when building pycryptodome

[Bug middle-end/111845] New: [14 regression] ICE when building pycryptodome

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

            Bug ID: 111845
           Summary: [14 regression] ICE when building pycryptodome
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
  Target Milestone: ---

Created attachment 56125
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56125&action=edit
mont.i.xz

Hit this when building pycryptodome on x86_64 (recently started testing that
plaform w/ 14). This package seems to be a good smoke test - see PR110271 from
a few months ago.

```
# x86_64-pc-linux-gnu-gcc -O2 -pipe -march=native -fdiagnostics-color=always
-frecord-gcc-switches -DNDEBUG -fPIC -DHAVE_STDINT_H -DPYCRYPTO_LITTLE_ENDIAN
-DSYS_BITS=64 -DLTC_NO_ASM -DHAVE_UINT128 -DHAVE_CPUID_H -DHAVE_POSIX_MEMALIGN
-DHAVE_X86INTRIN_H -DUSE_SSE2 -Isrc/ -I/usr/include/pypy3.10 -c src/mont.c -o
/var/tmp/portage/dev-python/pycryptodome-3.18.0/work/pycryptodome-3.18.0-pypy3/build/temp.linux-x86_64-pypy310/src/mont.o
-msse2
In file included from src/mont.c:43:
src/multiply_64.c: In function ‘addmul128’:
src/multiply_64.c:62:6: error: missing definition
   62 | void addmul128(uint64_t *t, uint64_t *scratchpad, const uint64_t *a,
uint64_t b0, uint64_t b1, size_t t_words, size_t a_nw)
      |      ^~~~~~~~~
for SSA_NAME: c_81 in statement:
_106 = c_81 + _87;
during GIMPLE pass: widening_mul
src/multiply_64.c:62:6: internal compiler error: verify_ssa failed
0x55e4233d3d77 verify_ssa(bool, bool) [clone .constprop.0]
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231015/gcc-14-20231015/gcc/tree-ssa.cc:1203
0x55e42478d6ca execute_function_todo
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231015/gcc-14-20231015/gcc/passes.cc:2095
0x55e4246deaa1 do_per_function
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231015/gcc-14-20231015/gcc/passes.cc:1687
0x55e4246deaa1 execute_todo
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231015/gcc-14-20231015/gcc/passes.cc:2142
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
``

`x86_64-pc-linux-gnu-gcc -O2 -c mont.i -march=znver2` seems to be enough for me
to reproduce.

```
$ gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-pc-linux-gnu/14/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-14.0.0_pre20231015/work/gcc-14-20231015/configure
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/14
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include/g++-v14
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/14/python
--enable-languages=c,c++,fortran,rust --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--disable-libunwind-exceptions --enable-checking=yes,extra,rtl
--with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened
14.0.0_pre20231015 p4' --with-gcc-major-version-only --enable-libstdcxx-time
--enable-lto --disable-libstdcxx-pch --enable-shared --enable-threads=posix
--enable-__cxa_atexit --enable-clocale=gnu --enable-multilib
--with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --enable-cet
--disable-systemtap --enable-valgrind-annotations --disable-vtable-verify
--disable-libvtv --with-zstd --with-isl --disable-isl-version-check
--enable-default-pie --enable-host-pie --enable-host-bind-now
--enable-default-ssp --with-build-config='bootstrap-lto bootstrap-cet'
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.0 20231015 (experimental) (Gentoo Hardened 14.0.0_pre20231015
p4)
```

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |14.0

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 56126
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56126&action=edit
Reduced testcase

I am not a fan of this reduced testcase since it depends on uninitialized
variables.

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-10-17

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

It is .UADDC production somehow but I am not sure what is being tried here
since there are almost no detail dumps from widening_mul either.

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

--- Comment #3 from Sam James <sjames at gcc dot gnu.org> ---
Created attachment 56127
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56127&action=edit
reduced.ii

I've attached what cvise gave me but it also relies on uninitialised vars (not
tried to fix it yet)

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #56127|0                           |1
        is obsolete|                            |

--- Comment #4 from Sam James <sjames at gcc dot gnu.org> ---
Created attachment 56128
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56128&action=edit
reduced.i

how about that?

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 56129
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56129&action=edit
no uninitialized variable in this testcase

This slightly changed testcase from Sam's testcase which removes the
uninitialized variable (just made it an argument)

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Same with renamed vars, so that the long variable names don't make it
unreadable:

int a, b;
unsigned int c, d, e;

void
foo (int x)
{
  b += d;
  c += b < d;
  b += e = a < x;
  c += b;
  c += b < e;
}

I believe the above is equivalent to:
  e = a < x;
  unsigned c1;
  b = __builtin_addc (b, d, e, &c1);
  c = __builtin_addc (c, b, c1, &c1);
i.e. b is set to b + d + e where e is in [0, 1] range and c is set to c + b +
carry-out
from the b + d + e additions.

match_uaddc_usubc is called on the _17 = _30 + _31; addition in:
b.0_1 = b;
b.1_2 = (unsigned int) b.0_1;
d.2_3 = d;
_8 = .ADD_OVERFLOW (b.1_2, d.2_3);
_4 = REALPART_EXPR <_8>;
_14 = IMAGPART_EXPR <_8>;
_5 = _14 != 0;
_6 = (unsigned int) _5;
c.6_7 = c;
_31 = _6 + c.6_7;
a.7_9 = a;
_10 = a.7_9 < x_19(D);
_11 = (unsigned int) _10;
e = _11;
_29 = .ADD_OVERFLOW (_4, _11);
_12 = REALPART_EXPR <_29>;
_28 = IMAGPART_EXPR <_29>;
_13 = (int) _12;
b = _13;
_15 = _28 != 0;
_16 = (unsigned int) _15;
_30 = _12 + _16;
_17 = _30 + _31;
c = _17;
return;
and changes it:
@@ -12,14 +12,14 @@ a.7_9 = a;
 _10 = a.7_9 < x_19(D);
 _11 = (unsigned int) _10;
 e = _11;
+_27 = .UADDC (b.1_2, d.2_3, _11);
 _29 = .ADD_OVERFLOW (_4, _11);
-_12 = REALPART_EXPR <_29>;
-_28 = IMAGPART_EXPR <_29>;
+_12 = REALPART_EXPR <_27>;
 _13 = (int) _12;
 b = _13;
-_15 = _28 != 0;
-_16 = (unsigned int) _15;
 _30 = _12 + _16;
-_17 = _30 + _31;
+_26 = IMAGPART_EXPR <_27>;
+_25 = .UADDC (c.6_7, _12, _26);
+_17 = REALPART_EXPR <_25>;
 c = _17;
 return;
That again looks correct to me, except that the dead _30 = _12 + _16 statement
should have been removed as well but wasn't.  The bb contains still other dead
statements
but the _30 = _12 + _16; is the only problematic one, as it refers to released
SSA_NAME.  After a fast DCE I think the bb would turn into:
b.0_1 = b;
b.1_2 = (unsigned int) b.0_1;
d.2_3 = d;
c.6_7 = c;
a.7_9 = a;
_10 = a.7_9 < x_19(D);
_11 = (unsigned int) _10;
e = _11;
_27 = .UADDC (b.1_2, d.2_3, _11);
_12 = REALPART_EXPR <_27>;
_13 = (int) _12;
b = _13;
_26 = IMAGPART_EXPR <_27>;
_25 = .UADDC (c.6_7, _12, _26);
_17 = REALPART_EXPR <_25>;
c = _17;
return;

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome since r14-1837-g43a3252c42af12

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[14 regression] ICE when    |[14 regression] ICE when
                   |building pycryptodome       |building pycryptodome since
                   |                            |r14-1837-g43a3252c42af12

--- Comment #7 from Sam James <sjames at gcc dot gnu.org> ---
Bisect indicates:

43a3252c42af12ad90082e4088ea58eecd0bf582 is the first bad commit
commit 43a3252c42af12ad90082e4088ea58eecd0bf582
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Jun 15 09:12:40 2023 +0200

    middle-end, i386: Pattern recognize add/subtract with carry [PR79173]

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome since r14-1837-g43a3252c42af12

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 56133
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56133&action=edit
gcc14-pr111845.patch

Untested fix.

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome since r14-1837-g43a3252c42af12

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:f1744dd50bb1661c98b694ff907cb0a1be4f6134

commit r14-4719-gf1744dd50bb1661c98b694ff907cb0a1be4f6134
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Oct 18 12:37:40 2023 +0200

    tree-ssa-math-opts: Fix up match_uaddc_usubc [PR111845]

    GCC ICEs on the first testcase.  Successful match_uaddc_usubc ends up with
    some dead stmts which DCE will remove (hopefully) later all.
    The ICE is because one of the dead stmts refers to a freed SSA_NAME.
    The code already gsi_removes a couple of stmts in the
      /* Remove some statements which can't be kept in the IL because they
         use SSA_NAME whose setter is going to be removed too.  */
    section for the same reason (the reason for the freed SSA_NAMEs is that
    we don't really have a replacement for those cases - all we have after
    a match is combined overflow from the addition/subtraction of 2 operands +
a
    [0, 1] carry in, but not the individual overflows from the former 2
    additions), but for the last (most significant) limb case, where we try
    to match x = op1 + op2 + carry1 + carry2; or
    x = op1 - op2 - carry1 - carry2; we just gsi_replace the final stmt, but
    left around the 2 temporary stmts as dead; if we were unlucky enough that
    those referenced the carry flag that went away, it ICEs.

    So, the following patch remembers those temporary statements (rather than
    trying to rediscover them more expensively) and removes them before the
    final one is replaced.

    While working on it, I've noticed we didn't support all the reassociated
    possibilities of writing the addition of 4 operands or subtracting 3
    operands from one, we supported e.g.
    x = ((op1 + op2) + op3) + op4;
    x = op1 + ((op2 + op3) + op4);
    but not
    x = (op1 + (op2 + op3)) + op4;
    x = op1 + (op2 + (op3 + op4));
    Fixed by the change to inspect also rhs[2] when rhs[1] didn't yield what
    we were searching for (if non-NULL) - rhs[0] is inspected in the first
    loop and has different handling for the MINUS_EXPR case.

    2023-10-18  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/111845
            * tree-ssa-math-opts.cc (match_uaddc_usubc): Remember temporary
            statements for the 4 operand addition or subtraction of 3 operands
            from 1 operand cases and remove them when successful.  Look for
            nested additions even from rhs[2], not just rhs[1].

            * gcc.dg/pr111845.c: New test.
            * gcc.target/i386/pr111845.c: New test.

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome since r14-1837-g43a3252c42af12

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Should be fixed now, sorry for introducing this.

[Bug middle-end/111845] [14 regression] ICE when building pycryptodome since r14-1837-g43a3252c42af12

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111845

--- Comment #11 from Sam James <sjames at gcc dot gnu.org> ---
Thank you for the quick fix!