[Bug c/112494] New: GCC: 14: internal compiler error: in ix86_cc_mode, at config/i386/i386.cc:16477

[Bug c/112494] New: GCC: 14: internal compiler error: in ix86_cc_mode, at config/i386/i386.cc:16477

[141242068 at smail dot nju.edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

            Bug ID: 112494
           Summary: GCC: 14: internal compiler error: in ix86_cc_mode, at
                    config/i386/i386.cc:16477
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: 141242068 at smail dot nju.edu.cn
  Target Milestone: ---

Compiler Explorer: https://gcc.godbolt.org/z/cPPxenx7q

When compile this program with `-Og  -fno-tree-copy-prop -fno-tree-fre
-fno-tree-ccp -fno-tree-forwprop`, gcc crashes:
```
#include <x86intrin.h>

#ifdef __x86_64__
#  define EFLAGS_TYPE unsigned long long int
#else
#  define EFLAGS_TYPE unsigned int
#endif

int main() {
  EFLAGS_TYPE flags = 0xD7;
  __writeeflags(0xD7);
  flags && !__readeflags();
  if ((flags && (!__readeflags())) != 0xD7);
  return 0;
}
```

There are some intriguing observations about this crash.
1. Removing the `flags &&` portion at the point of the first __readeflags()
call eliminates the crash, even though it appears that `flags &&` has no
effect.
2. Removing the `!= 0xD7` portion at the point of the second __readeflags()
call also eliminates the crash.


The crash output:
```
during RTL pass: combine
<source>: In function 'main':
<source>:15:1: internal compiler error: in ix86_cc_mode, at
config/i386/i386.cc:16477
   15 | }
      | ^
0x238b15e internal_error(char const*, ...)
        ???:0
0xa11270 fancy_abort(char const*, int, char const*)
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1
```

[Bug rtl-optimization/112494] GCC: 14: internal compiler error: in ix86_cc_mode, at config/i386/i386.cc:16477

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-11-12
     Ever confirmed|0                           |1
          Component|target                      |rtl-optimization
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Uroš Bizjak <ubizjak at gmail dot com> ---
Combine pass is trying to combine:

Trying 5 -> 8:
    5: r98:DI=0xd7
    8: flags:CCZ=cmp(r98:DI,0)
      REG_EQUAL cmp(0xd7,0)

where:

(insn 5 2 6 2 (set (reg/v:DI 98 [ flags ])
        (const_int 215 [0xd7])) "pr112494.c":10:26 84 {*movdi_internal}
     (nil))

(insn 8 7 11 2 (set (reg:CCZ 17 flags)
        (compare:CCZ (reg/v:DI 98 [ flags ])
            (const_int 0 [0]))) "pr112494.c":12:9 8 {*cmpdi_ccno_1}
     (expr_list:REG_EQUAL (compare:CCZ (const_int 215 [0xd7])
            (const_int 0 [0]))
        (nil)))


and calls ix86_cc_mode with:

Breakpoint 1, ix86_cc_mode (code=code@entry=SET, op0=0x7fffe3e37680,
op1=0x7fffea209490)

code = SET will trigger gcc_unreachable() at the end of the ix86_cc_mode
function.

Confirmed as a generic RTL optimization problem.

[Bug rtl-optimization/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
It has failed since __writeeflags/__readeflags was added in 4.9.0.

[Bug rtl-optimization/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I almost want to say this is a bug in the x86 back-end where it pushes the
flags onto the stack.

That is:
(insn 11 8 12 2 (set (mem:DI (pre_dec:DI (reg/f:DI 7 sp)) [0  S8 A8])
        (reg:DI 17 flags))
"/opt/compiler-explorer/gcc-trunk-20231112/lib/gcc/x86_64-linux-gnu/14.0.0/include/ia32intrin.h":262:10
70 {*pushfldi2}
     (expr_list:REG_DEAD (reg:DI 17 flags)
        (nil)))
(insn 12 11 20 2 (set (reg:DI 102)
        (mem:DI (post_inc:DI (reg/f:DI 7 sp)) [0  S8 A8]))
"/opt/compiler-explorer/gcc-trunk-20231112/lib/gcc/x86_64-linux-gnu/14.0.0/include/ia32intrin.h":262:10
66 {*popdi1}
     (expr_list:REG_UNUSED (reg:DI 102)
        (nil)))
(insn 20 12 21 2 (set (reg:CCZ 17 flags)
        (compare:CCZ (reg/v:DI 98 [ flags1D.40416 ])
            (const_int 0 [0]))) "/app/example.cpp":14:15 8 {*cmpdi_ccno_1}
     (expr_list:REG_EQUAL (compare:CCZ (const_int 215 [0xd7])
            (const_int 0 [0]))
        (expr_list:REG_DEAD (reg/v:DI 98 [ flags1D.40416 ])
            (nil))))

Maybe it should be represented as:
(set (mem:DI (pre_dec:DI (reg/f:DI 7 sp)) [0  S8 A8])
        (unspec (reg:CC 17 flags) GET_EFLAGS))

Likewise for poping:
(set (reg:DI 17 flags)
        (mem:DI (post_inc:DI (reg/f:DI 7 sp)) [0  S8 A8]))
     (nil)

Should really be:
(set (reg:CC 17 flags)
        (unspec:CC (mem:DI (post_inc:DI (reg/f:DI 7 sp)) [0  S8 A8]))
SET_EFLAGS))

[Bug rtl-optimization/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #4 from Uroš Bizjak <ubizjak at gmail dot com> ---
(In reply to Andrew Pinski from comment #3)
> I almost want to say this is a bug in the x86 back-end where it pushes the
> flags onto the stack.

Yes, could be - let me look into this a bit more.

[Bug target/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|rtl-optimization            |target
             Status|NEW                         |ASSIGNED

[Bug target/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #5 from Uroš Bizjak <ubizjak at gmail dot com> ---
Created attachment 56567
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56567&action=edit
Proposed patch

Nope, even with the above patch the compiler ICEs at the same place:

0x1956968 ix86_cc_mode(rtx_code, rtx_def*, rtx_def*)
        ../../git/gcc/gcc/config/i386/i386.cc:16508
0x286a3a9 try_combine
        ../../git/gcc/gcc/combine.cc:3207
0x2864cbf combine_instructions
        ../../git/gcc/gcc/combine.cc:1264


Trying 5 -> 8:
    5: r98:DI=0xd7
    8: flags:CCZ=cmp(r98:DI,0)
      REG_EQUAL cmp(0xd7,0)


(insn 5 2 6 2 (set (reg/v:DI 98 [ flags ])
        (const_int 215 [0xd7])) "pr112494.c":10:15 84 {*movdi_internal}
     (nil))
(insn 6 5 7 2 (set (mem:DI (pre_dec:DI (reg/f:DI 7 sp)) [0  S8 A8])
        (const_int 215 [0xd7]))
"/hdd/uros/gcc-build-fast/gcc/include/ia32intrin.h":270:3 58 {*pushdi2_rex64}
     (nil))
(insn 7 6 8 2 (set (reg:CC 17 flags)
        (unspec:CC [
                (mem:DI (post_inc:DI (reg/f:DI 7 sp)) [0  S8 A8])
            ] UNSPEC_SET_FLAGS))
"/hdd/uros/gcc-build-fast/gcc/include/ia32intrin.h":270:3 72 {*popfldi1}
     (expr_list:REG_UNUSED (reg:CC 17 flags)
        (nil)))
(insn 8 7 11 2 (set (reg:CCZ 17 flags)
        (compare:CCZ (reg/v:DI 98 [ flags ])
            (const_int 0 [0]))) "pr112494.c":12:9 8 {*cmpdi_ccno_1}
     (expr_list:REG_EQUAL (compare:CCZ (const_int 215 [0xd7])
            (const_int 0 [0]))
        (nil)))
(insn 11 8 12 2 (set (mem:DI (pre_dec:DI (reg/f:DI 7 sp)) [0  S8 A8])
        (unspec:DI [
                (reg:CC 17 flags)
            ] UNSPEC_GET_FLAGS))
"/hdd/uros/gcc-build-fast/gcc/include/ia32intrin.h":262:10 70 {*pushfldi2}
     (expr_list:REG_DEAD (reg:CC 17 flags)
        (nil)))

There is nothing suspicious in target code anymore (IMO, the above patch should
be applied nevertheless, the register modes are now fully correct)

[Bug target/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #6 from Uroš Bizjak <ubizjak at gmail dot com> ---
Now we have:

#1  0x000000000286a3aa in try_combine (i3=0x7fffe3c18100, i2=0x7fffe3c18000,
i1=0x0, i0=0x0, new_direct_jump_p=0x7fffffffd8eb, 
    last_combined_insn=0x7fffe3c18100) at ../../git/gcc/gcc/combine.cc:3207
3207                    = SELECT_CC_MODE (compare_code, op0, op1);
(gdb) p compare_code
$1 = UNSPEC

compare_code = UNSPEC won't fly...

[Bug target/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #7 from Uroš Bizjak <ubizjak at gmail dot com> ---
It looks to me that gcc_unreachable is problematic in SELECT_CC_MODE. We should
simply return CCmode for all unrecognised RTX:

diff --git a/gcc/config/i386/i386.cc b/gcc/config/i386/i386.cc
index 2c80fd8ebf3..5b87361e2e1 100644
--- a/gcc/config/i386/i386.cc
+++ b/gcc/config/i386/i386.cc
@@ -16469,12 +16504,9 @@ ix86_cc_mode (enum rtx_code code, rtx op0, rtx op1)
        return CCNOmode;
       else
        return CCGCmode;
-      /* strcmp pattern do (use flags) and combine may ask us for proper
-        mode.  */
-    case USE:
-      return CCmode;
     default:
-      gcc_unreachable ();
+      /* CCmode should be used in all other cases.  */
+      return CCmode;
     }
 }


Using the above patch, we can also define cmpstrnqi_1 to what it really does:

@@ -22954,9 +22958,8 @@ (define_expand "cmpstrnqi_1"
                                     (const_int 0))
                  (compare:CC (match_operand 4 "memory_operand")
                              (match_operand 5 "memory_operand"))
-                 (const_int 0)))
+                 (reg:CC FLAGS_REG)))
              (use (match_operand:SI 3 "immediate_operand"))
-             (use (reg:CC FLAGS_REG))
              (clobber (match_operand 0 "register_operand"))
              (clobber (match_operand 1 "register_operand"))
              (clobber (match_dup 2))])]

[Bug target/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Uros Bizjak <uros@gcc.gnu.org>:

https://gcc.gnu.org/g:c75bab7274fe60fb2def8acf06ee9f4f856ce1ac

commit r14-5419-gc75bab7274fe60fb2def8acf06ee9f4f856ce1ac
Author: Uros Bizjak <ubizjak@gmail.com>
Date:   Mon Nov 13 22:45:55 2023 +0100

    i386: Return CCmode from ix86_cc_mode for unknown RTX code [PR112494]

    Combine wants to combine following instructions into an insn that can
    perform both an (arithmetic) operation and set the condition code.  During
    the conversion a new RTX is created, and combine passes the RTX code of the
    innermost RTX expression of the CC use insn in which CC reg is used to
    SELECT_CC_MODE, to determine the new mode of the comparison:

    Trying 5 -> 8:
        5: r98:DI=0xd7
        8: flags:CCZ=cmp(r98:DI,0)
          REG_EQUAL cmp(0xd7,0)
    Failed to match this instruction:
    (parallel [
            (set (reg:CC 17 flags)
                (compare:CC (const_int 215 [0xd7])
                    (const_int 0 [0])))
            (set (reg/v:DI 98 [ flags ])
                (const_int 215 [0xd7]))
        ])

    where:

    (insn 5 2 6 2 (set (reg/v:DI 98 [ flags ])
            (const_int 215 [0xd7])) "pr112494.c":8:8 84 {*movdi_internal}
         (nil))

    (insn 8 7 11 2 (set (reg:CCZ 17 flags)
            (compare:CCZ (reg/v:DI 98 [ flags ])
                (const_int 0 [0]))) "pr112494.c":11:9 8 {*cmpdi_ccno_1}
         (expr_list:REG_EQUAL (compare:CCZ (const_int 215 [0xd7])
                (const_int 0 [0]))
            (nil)))

    x86_cc_mode (AKA SELECT_CC_MODE) is not prepared to handle random RTX
    codes and triggers gcc_unreachable() when SET RTX code is passed to it.
    The patch removes gcc_unreachable() and returns CCmode for unknown
    RTX codes, so combine can try various combinations involving CC reg
    without triggering ICE.

    Please note that x86 MOV instructions do not set flags, so the above
    combination is not recognized as a valid x86 instruction.

            PR target/112494

    gcc/ChangeLog:

            * config/i386/i386.cc (ix86_cc_mode) [default]: Return CCmode.

    gcc/testsuite/ChangeLog:

            * gcc.target/i386/pr112494.c: New test.

[Bug target/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Uros Bizjak <uros@gcc.gnu.org>:

https://gcc.gnu.org/g:99db2ce2419245e40808a9fad45113315496a907

commit r14-5933-g99db2ce2419245e40808a9fad45113315496a907
Author: Uros Bizjak <ubizjak@gmail.com>
Date:   Tue Nov 28 16:56:29 2023 +0100

    i386: Improve cmpstrnqi_1 insn pattern [PR112494]

    REPZ CMPSB instruction does not update FLAGS register when %ecx register
    equals zero.  Improve cmpstrnqi_1 insn pattern to set FLAGS_REG to its
    previous value instead of (const_int 0) when operand 2 equals zero.

            PR target/112494

    gcc/ChangeLog:

            * config/i386/i386.md (cmpstrnqi_1): Set FLAGS_REG to its previous
            value when operand 2 equals zero.
            (*cmpstrnqi_1): Ditto.
            (*cmpstrnqi_1 peephole2): Ditto.

[Bug target/112494] ICE in ix86_cc_mode, at config/i386/i386.cc:16477

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112494

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
   Target Milestone|---                         |14.0
         Resolution|---                         |FIXED

--- Comment #10 from Uroš Bizjak <ubizjak at gmail dot com> ---
Fixed for 14.0.