[Bug target/112989] New: GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[Bug target/112989] New: GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

            Bug ID: 112989
           Summary: GC ICE with C++, `#include <arm_sve.h>` and
                    `-fsanitize=address`
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: GC, ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: pinskia at gcc dot gnu.org
  Target Milestone: ---
            Target: aarch64-linux-gnu

Just a simple:
```
#pragma GCC aarch64 "arm_sve.h"
```

Causes an ICE:
```
ubuntu@ubuntu:~/src/upstream-gcc-aarch64\#
/bajas/pinskia/src/upstream-gcc-aarch64/gcc/objdir/stage1-gcc/cc1plus t.cc
-quiet -march=armv8.6-a+sve  -fsanitize=address
t.cc:1:32: internal compiler error: Segmentation fault
    1 | #pragma GCC aarch64 "arm_sve.h"
      |                                ^
0x1d150ff crash_signal
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/toplev.cc:316
0x12fb314 c_tree_chain_next(tree_node*)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/c-family/c-common.h:1347
0x12eeda3 gt_ggc_mx_lang_tree_node(void*)
        ./gt-cp-tree.h:108
0x240ca7f gt_ggc_mx_registered_function(void*)
        ./gt-aarch64-sve-builtins.h:29
0x240cb23 gt_ggc_mx(aarch64_sve::registered_function*&)
        ./gt-aarch64-sve-builtins.h:47
0x240ea3f void
gt_ggc_mx<aarch64_sve::registered_function*>(vec<aarch64_sve::registered_function*,
va_gc, vl_embed>*)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/vec.h:1449
0x240caef gt_ggc_mx_vec_registered_function__va_gc_(void*)
        ./gt-aarch64-sve-builtins.h:39
0x17a1237 ggc_mark_root_tab
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/ggc-common.cc:75
0x17a13a7 ggc_mark_roots()
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/ggc-common.cc:104
0x146d183 ggc_collect(ggc_collect)
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/ggc-page.cc:2227
0xfd0567 c_parse_final_cleanups()
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/decl2.cc:5064
0x140a413 c_common_parse_file()
        /home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/c-family/c-opts.cc:1319
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

```

I have not debugged this but I can't reproduce with a cross though, only a
native build (but stage1)

[Bug target/112989] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-12-12
     Ever confirmed|0                           |1
                 CC|                            |mpolacek at gcc dot gnu.org

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed (but I can't reproduce it with a cross, either).

[Bug target/112989] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
#1  0x00000000012eeda4 in gt_ggc_mx_lang_tree_node (x_p=0xfffff6bd4900) at
./gt-cp-tree.h:108
108        xlimit = ((union lang_tree_node *) c_tree_chain_next
(&(*xlimit).generic));
(gdb) up
#2  0x000000000240ca80 in gt_ggc_mx_registered_function (x_p=0xfffff6b854f0) at
./gt-aarch64-sve-builtins.h:29
29            gt_ggc_m_9tree_node ((*x).decl);
(gdb) p x
$8 = (aarch64_sve::registered_function * const) 0xfffff6b854f0
(gdb) p *x
$9 = {instance = {base_name = 0x3c08b80 "svmla", base = 0x3c21cb8
<aarch64_sve::(anonymous namespace)::svmla_za_obj>, shape = 0x3c165a0
<aarch64_sve::binary_za_slice_opt_single_obj>, mode_suffix_id =
aarch64_sve::MODE_single, type_suffix_ids = {aarch64_sve::TYPE_SUFFIX_za64,
aarch64_sve::TYPE_SUFFIX_s16},
    group_suffix_id = aarch64_sve::GROUP_vg4x1, pred = aarch64_sve::PRED_none},
decl = 0xfffff6bd4900, required_extensions = 5497558138885, overloaded_p =
false}
(gdb) p x->decl
$10 = (tree) 0xfffff6bd4900
(gdb) p debug_tree(x->decl)
 <ggc_freed 0xfffff6bd4900>

[Bug target/112989] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
```
Breakpoint 1, ggc_free (p=0xfffff6bd4900) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/ggc-page.cc:1612
1612      if (in_gc)
(gdb) bt
#0  ggc_free (p=0xfffff6bd4900) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/ggc-page.cc:1612
#1  0x0000000000f59a48 in duplicate_decls (newdecl=0xfffff6bd4900,
olddecl=0xfffff6bd3d00, hiding=false, was_hidden=false) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/decl.cc:3312
#2  0x00000000010f57a0 in pushdecl (decl=0xfffff6bd4900, hiding=false) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/name-lookup.cc:3920
#3  0x0000000000f62300 in cxx_simulate_builtin_function_decl
(decl=0xfffff6bd4900) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/decl.cc:5239
#4  0x0000000001a0c5c8 in simulate_builtin_function_decl (location=255050,
name=0x48b5200 "svmla_za64_vg4x1", type=0xfffff6b1cb70, function_code=31409,
library_name=0x0, attrs=0xfffff6bced80) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/langhooks.cc:774
#5  0x00000000023ff6b0 in aarch64_sve::function_builder::add_function
(this=0xfffffffff490, instance=..., name=0x48b5200 "svmla_za64_vg4x1",
fntype=0xfffff6b1cb70, attrs=0xfffff6bced80, required_extensions=5497558138885,
overloaded_p=false, placeholder_p=false)
    at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-sve-builtins.cc:1490
#6  0x00000000023ff8e8 in aarch64_sve::function_builder::add_unique_function
(this=0xfffffffff490, instance=..., return_type=0xfffff5b30f18,
argument_types=..., required_extensions=5497558138885,
force_direct_overloads=false)
    at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-sve-builtins.cc:1542
#7  0x0000000002411fe8 in aarch64_sve::build_one (b=..., signature=0x3c16590
"_,su32,t1,v1", group=..., mode_suffix_id=aarch64_sve::MODE_single, ti=0, gi=0,
pi=0, force_direct_overloads=false) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-sve-builtins-shapes.cc:331
#8  0x0000000002412508 in aarch64_sve::build_all (b=..., signature=0x3c16590
"_,su32,t1,v1", group=..., mode_suffix_id=aarch64_sve::MODE_single,
force_direct_overloads=false) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-sve-builtins-shapes.cc:470
#9  0x0000000002415418 in aarch64_sve::binary_za_slice_opt_single_def::build
(this=0x3c165a0 <aarch64_sve::binary_za_slice_opt_single_obj>, b=...,
group=...) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-sve-builtins-shapes.cc:1896
#10 0x00000000023fffec in
aarch64_sve::function_builder::register_function_group (this=0xfffffffff490,
group=...) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-sve-builtins.cc:1637
#11 0x000000000240b0bc in aarch64_sve::handle_arm_sve_h () at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-sve-builtins.cc:4588
#12 0x0000000001460b1c in aarch64_pragma_aarch64 () at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/config/aarch64/aarch64-c.cc:347
#13 0x0000000001412ebc in c_invoke_pragma_handler (id=14) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/c-family/c-pragma.cc:1741
#14 0x0000000001199f8c in cp_parser_pragma (parser=0xfffff5e54e18,
context=pragma_external, if_p=0x0) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/parser.cc:50751
#15 0x0000000001137730 in cp_parser_toplevel_declaration
(parser=0xfffff5e54e18) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/parser.cc:15392
#16 0x000000000111f240 in cp_parser_translation_unit (parser=0xfffff5e54e18) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/parser.cc:5273
#17 0x000000000119a354 in c_parse_file () at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/cp/parser.cc:50845
#18 0x000000000140a314 in c_common_parse_file () at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/c-family/c-opts.cc:1301
#19 0x0000000001d156a4 in compile_file () at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/toplev.cc:446
#20 0x0000000001d1989c in do_compile () at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/toplev.cc:2150
#21 0x0000000001d19dd4 in toplev::main (this=0xfffffffff8d0, argc=5,
argv=0xfffffffffa18) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/toplev.cc:2306
#22 0x000000000358944c in main (argc=5, argv=0xfffffffffa18) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/main.cc:39
```

[Bug target/112989] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
```
simulate_builtin_function_decl (location=255050, name=0x48b5200
"svmla_za64_vg4x1", type=0xfffff6b1cb70, function_code=31409, library_name=0x0,
attrs=0xfffff6bced80) at
/home/ubuntu/src/upstream-gcc-aarch64/gcc/gcc/langhooks.cc:781
781       if (TREE_CODE (new_decl) == FUNCTION_DECL
(gdb)
782           && fndecl_built_in_p (new_decl, function_code, BUILT_IN_MD))
(gdb)
781       if (TREE_CODE (new_decl) == FUNCTION_DECL
(gdb)
785       return decl;
(gdb) p debug_tree(new_decl)
 <function_decl 0xfffff6bd3d00 svmla_za64_vg4x1
    type <function_type 0xfffff6b1ccc0
        type <void_type 0xfffff5b30f18 void VOID
            align:8 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0xfffff5b30f18
            pointer_to_this <pointer_type 0xfffff5b30fc0>>
        SI
        size <integer_cst 0xfffff5a113b0 constant 32>
        unit-size <integer_cst 0xfffff5a113c8 constant 4>
        align:32 warn_if_not_align:0 symtab:0 alias-set -1 structural-equality
        attributes <tree_list 0xfffff6b2af78
            purpose <tree_list 0xfffff6b2af50
                purpose <identifier_node 0xfffff5e74cc0 arm
                    normal local bindings <(nil)>>
                value <identifier_node 0xfffff5e74d00 streaming
                    normal local bindings <(nil)>>>
            chain <tree_list 0xfffff6b2af28
                purpose <tree_list 0xfffff6b2af00 purpose <identifier_node
0xfffff5e74cc0 arm>
                    value <identifier_node 0xfffff5a73280 inout
                        normal local bindings <(nil)>>>
                value <tree_list 0xfffff6b2ade8
                    value <string_cst 0xfffff69934f8 constant "za\000">>>>
        arg-types <tree_list 0xfffff6b2ad70 value <integer_type 0xfffff5b30690
unsigned int>
            chain <tree_list 0xfffff6b2ad48 value <vector_type 0xfffff5e57620
svint16_t>
                chain <tree_list 0xfffff6b2ad20 value <vector_type
0xfffff5e57620 svint16_t>
                    chain <tree_list 0xfffff5aa0988 value <void_type
0xfffff5b30f18 void>>>>>>
    nothrow public external built-in DI t.cc:1:21
    align:32 warn_if_not_align:0 built-in: BUILT_IN_MD:31385 context
<translation_unit_decl 0xfffff5b20000 t.cc>
    attributes <tree_list 0xfffff6bcd2a0
        purpose <identifier_node 0xfffff5a76780 nothrow
            normal local bindings <(nil)>>
        chain <tree_list 0xfffff6bcd278
            purpose <identifier_node 0xfffff5a767c0 leaf
                normal local bindings <(nil)>>>>
    full-name "void svmla_za64_vg4x1(unsigned int, svint16_t, svint16_t)" chain
<function_decl 0xfffff6bd3c00 svmla_za64_s16_vg4x1>>
$2 = void
(gdb) p function_code
$3 = 31409
```


There seems like there are 2 builtins for svmla_za64_vg4x1 ....

[Bug target/112989] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rsandifo at gcc dot gnu.org

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Here is where the 2 builtins are added:
```
Breakpoint 1, aarch64_sve::function_builder::add_function (this=0x7fffffffd980,
instance=..., name=0x31d4ca0 "svmla_za64_vg4x1", fntype=0x7ffff7434930,
attrs=0x0, required_extensions=5497558138885, overloaded_p=true,
placeholder_p=true) at ../../gcc/config/aarch64/aarch64-sve-builtins.cc:1478
1478        if (t != 0)
(gdb) bt
#0  aarch64_sve::function_builder::add_function (this=0x7fffffffd980,
instance=..., name=0x31d4ca0 "svmla_za64_vg4x1", fntype=0x7ffff7434930,
attrs=0x0, required_extensions=5497558138885, overloaded_p=true,
placeholder_p=true) at ../../gcc/config/aarch64/aarch64-sve-builtins.cc:1478
#1  0x00000000017ddeb5 in
aarch64_sve::function_builder::add_overloaded_function (this=0x7fffffffd980,
instance=..., required_extensions=5497558138885) at
../../gcc/config/aarch64/aarch64-sve-builtins.cc:1581
#2  0x00000000017ddf7d in operator() (__closure=0x7fffffffd900, types=...,
group_suffix_id=aarch64_sve::GROUP_vg4x1, pi=0) at
../../gcc/config/aarch64/aarch64-sve-builtins.cc:1604
#3  0x00000000017de087 in operator() (__closure=0x7fffffffd8d0,
group_suffix_id=aarch64_sve::GROUP_vg4x1, pi=0) at
../../gcc/config/aarch64/aarch64-sve-builtins.cc:1628
#4  0x00000000017de1c4 in
aarch64_sve::function_builder::add_overloaded_functions (this=0x7fffffffd980,
group=..., mode=aarch64_sve::MODE_none) at
../../gcc/config/aarch64/aarch64-sve-builtins.cc:1635
#5  0x00000000017f483d in aarch64_sve::binary_za_slice_opt_single_def::build
(this=<optimized out>, b=..., group=...) at
../../gcc/config/aarch64/aarch64-sve-builtins-shapes.cc:1894
#6  0x00000000017de25d in
aarch64_sve::function_builder::register_function_group (this=0x7fffffffd980,
group=...) at ../../gcc/config/aarch64/aarch64-sve-builtins.cc:1644
#7  0x00000000017e771b in aarch64_sve::handle_arm_sve_h () at
../../gcc/config/aarch64/aarch64-sve-builtins.cc:4595
#8  0x0000000000da3d75 in aarch64_pragma_aarch64 () at
../../gcc/config/aarch64/aarch64-c.cc:347
#9  0x0000000000bf022f in cp_parser_pragma (parser=0x7ffff73409d8,
context=pragma_external, if_p=0x0) at ../../gcc/cp/parser.cc:50751
#10 0x0000000000c2c2ac in cp_parser_toplevel_declaration
(parser=0x7ffff73409d8) at ../../gcc/cp/parser.cc:15392
#11 cp_parser_toplevel_declaration (parser=0x7ffff73409d8) at
../../gcc/cp/parser.cc:15383
#12 cp_parser_translation_unit (parser=0x7ffff73409d8) at
../../gcc/cp/parser.cc:5273
#13 c_parse_file () at ../../gcc/cp/parser.cc:50845
#14 0x0000000000d741d2 in c_common_parse_file () at
../../gcc/c-family/c-opts.cc:1301
#15 0x000000000133917e in compile_file () at ../../gcc/toplev.cc:446
#16 0x0000000000a4b151 in do_compile () at ../../gcc/toplev.cc:2150
#17 toplev::main (this=this@entry=0x7fffffffdd5e, argc=<optimized out>,
argc@entry=4, argv=<optimized out>, argv@entry=0x7fffffffde88) at
../../gcc/toplev.cc:2306
#18 0x0000000000a4d1ef in main (argc=4, argv=0x7fffffffde88) at
../../gcc/main.cc:39
(gdb) c
Continuing.

Breakpoint 1, aarch64_sve::function_builder::add_function (this=0x7fffffffd980,
instance=..., name=0x31d4d20 "svmla_za64_vg4x1", fntype=0x7ffff640fe70,
attrs=0x7ffff64c4aa0, required_extensions=5497558138885, overloaded_p=false,
placeholder_p=false) at ../../gcc/config/aarch64/aarch64-sve-builtins.cc:1478
1478        if (t != 0)
(gdb) bt
#0  aarch64_sve::function_builder::add_function (this=0x7fffffffd980,
instance=..., name=0x31d4d20 "svmla_za64_vg4x1", fntype=0x7ffff640fe70,
attrs=0x7ffff64c4aa0, required_extensions=5497558138885, overloaded_p=false,
placeholder_p=false) at ../../gcc/config/aarch64/aarch64-sve-builtins.cc:1478
#1  0x00000000017ddd0a in aarch64_sve::function_builder::add_unique_function
(this=0x7fffffffd980, instance=..., return_type=0x7ffff7421f18,
argument_types=..., required_extensions=5497558138885,
force_direct_overloads=false) at
../../gcc/config/aarch64/aarch64-sve-builtins.cc:1549
#2  0x00000000017ef6da in aarch64_sve::build_one (b=..., signature=<optimized
out>, group=..., mode_suffix_id=<optimized out>, ti=<optimized out>,
gi=<optimized out>, pi=0, force_direct_overloads=false) at
../../gcc/config/aarch64/aarch64-sve-builtins-shapes.cc:331
#3  0x00000000017ef7f9 in aarch64_sve::build_all (b=...,
signature=signature@entry=0x263bcd7 "_,su32,t1,t1", group=...,
mode_suffix_id=mode_suffix_id@entry=aarch64_sve::MODE_none,
force_direct_overloads=force_direct_overloads@entry=false) at
../../gcc/config/aarch64/aarch64-sve-builtins-shapes.cc:470
#4  0x00000000017f4855 in aarch64_sve::binary_za_slice_opt_single_def::build
(this=<optimized out>, b=..., group=...) at
../../gcc/config/aarch64/aarch64-sve-builtins-shapes.cc:1895
#5  0x00000000017de25d in
aarch64_sve::function_builder::register_function_group (this=0x7fffffffd980,
group=...) at ../../gcc/config/aarch64/aarch64-sve-builtins.cc:1644
#6  0x00000000017e771b in aarch64_sve::handle_arm_sve_h () at
../../gcc/config/aarch64/aarch64-sve-builtins.cc:4595
#7  0x0000000000da3d75 in aarch64_pragma_aarch64 () at
../../gcc/config/aarch64/aarch64-c.cc:347
#8  0x0000000000bf022f in cp_parser_pragma (parser=0x7ffff73409d8,
context=pragma_external, if_p=0x0) at ../../gcc/cp/parser.cc:50751
#9  0x0000000000c2c2ac in cp_parser_toplevel_declaration
(parser=0x7ffff73409d8) at ../../gcc/cp/parser.cc:15392
#10 cp_parser_toplevel_declaration (parser=0x7ffff73409d8) at
../../gcc/cp/parser.cc:15383
#11 cp_parser_translation_unit (parser=0x7ffff73409d8) at
../../gcc/cp/parser.cc:5273
#12 c_parse_file () at ../../gcc/cp/parser.cc:50845
#13 0x0000000000d741d2 in c_common_parse_file () at
../../gcc/c-family/c-opts.cc:1301
#14 0x000000000133917e in compile_file () at ../../gcc/toplev.cc:446
#15 0x0000000000a4b151 in do_compile () at ../../gcc/toplev.cc:2150
#16 toplev::main (this=this@entry=0x7fffffffdd5e, argc=<optimized out>,
argc@entry=4, argv=<optimized out>, argv@entry=0x7fffffffde88) at
../../gcc/toplev.cc:2306
#17 0x0000000000a4d1ef in main (argc=4, argv=0x7fffffffde88) at
../../gcc/main.cc:39

```

I used this small patch to debug it:
```
diff --git a/gcc/config/aarch64/aarch64-sve-builtins.cc
b/gcc/config/aarch64/aarch64-sve-builtins.cc
index 15fa5907de5..4f285f47750 100644
--- a/gcc/config/aarch64/aarch64-sve-builtins.cc
+++ b/gcc/config/aarch64/aarch64-sve-builtins.cc
@@ -1472,6 +1472,13 @@ function_builder::add_function (const function_instance
&instance,
 {
   unsigned int code = vec_safe_length (registered_functions);
   code = (code << AARCH64_BUILTIN_SHIFT) | AARCH64_BUILTIN_SVE;
+  if (strcmp (name, "svmla_za64_vg4x1") == 0)
+  {
+    static int t = 0;
+    if (t != 0)
+      gcc_unreachable();
+    t++;
+  }

   /* We need to be able to generate placeholders to enusre that we have a
      consistent numbering scheme for function codes between the C and C++

```

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0
            Summary|GC ICE with C++, `#include  |[14 Regression] GC ICE with
                   |<arm_sve.h>` and            |C++, `#include <arm_sve.h>`
                   |`-fsanitize=address`        |and `-fsanitize=address`

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #5)
> I used this small patch to debug it:

I applied this patch to GCC 13 and we didn't get any duplicate registeration
going on.

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I narrored down to 2 commits which introduced this:
r14-6177-g724a873b145d20 works
r14-6179-gc1c267dfcdccd5 fails

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #7)
> I narrored down to 2 commits which introduced this:
> r14-6177-g724a873b145d20 works
> r14-6179-gc1c267dfcdccd5 fails

I am 99% sure it was introduced by r14-6179-gc1c267dfcdccd5 even.

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
r10-4188-g740785381ec9944c861dcc29b420c96aa933f040 looks weird with its
+  /* Give the front end a chance to create a new decl if necessary,
+     but if the front end discards the decl in favour of a conflicting
+     (erroneous) previous definition, return the decl that we tried but
+     failed to add.  This allows the caller to process the returned decl
+     normally, even though the source code won't be able to use it.  */
+  if (TREE_CODE (new_decl) == FUNCTION_DECL
+      && fndecl_built_in_p (new_decl, function_code, BUILT_IN_MD))
+    return new_decl;

If the above condition isn't true, returning decl; looks wrong, both the C and
C++ FEs
have ggc_freed it already, so e.g. with GC checking it isn't a FUNCTION_DECL
anymore, but 0xa5a5 code and nothing from it can be used reliably.

So, if you want something that be usable at least in a limited extent, it needs
to
build_builtin_function again but not call
lang_hooks.simulate_builtin_function_decl
on it anymore.

Of course, another question is why the builtins (in my case svmla_za32_vg2x1,
svmla_za32_vg4x1) is registered again and again.
What I did in a cross is just
b aarch64_sve::handle_arm_sve_h
b ggc_free if ((tree)p)->base.code == FUNCTION_DECL

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

Richard Sandiford <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rsandifo at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #10 from Richard Sandiford <rsandifo at gcc dot gnu.org> ---
Mine.

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
BTW, the registration alternates on
svmla_za32_vg2x1
svmla_za32_f16_vg2x1
svmla_za32_vg2x1
svmla_za32_f16_vg2x1
etc.
So, that is one thing that should be fixed, this being registered just once,
and another is try
#pragma GCC aarch64 "arm_sve.h"
after a couple of intentional declarations of the SVE builtins with
non-standard return/argument types and make sure that while it emits some
errors, it doesn't try to use ggc_freed decls in registered tables.

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #12 from Richard Sandiford <rsandifo at gcc dot gnu.org> ---
> another is try
> #pragma GCC aarch64 "arm_sve.h"
> after a couple of intentional declarations of the SVE builtins with
> non-standard return/argument types and make sure that while it emits some
> errors, it doesn't try to use ggc_freed decls in registered tables.
FWIW, this is what the g*.target/aarch64/sve/acle/general*/func_redef_*
tests are supposed to test (although not specifically targeting ggc_free).

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #13 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:d76651d9170099de4d3bc3cbc3811d499018910b

commit r14-7184-gd76651d9170099de4d3bc3cbc3811d499018910b
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Fri Jan 12 12:29:22 2024 +0000

    aarch64: Use a separate group for SME builtins [PR112989]

    The PR shows that we were registering the same overloaded SVE
    builtins twice.  This was supposed to be prevented by
    function_builder::add_overloaded_function, which uses a map
    to detect whether a function of the same name has already been
    registered.  add_overloaded_function then had some asserts to
    check for consistency.

    However, the map that add_overloaded_function uses was a member of
    function_builder itself.  That made sense when there was just one
    header file, arm_sve.h, since it meant that the memory could be
    reclaimed once arm_sve.h had been processed.  But now we have three
    header files, and in principle, it's possible for arm_sme.h to include
    overloads of things that arm_sve.h also defines.  We therefore need
    to use a global map instead.

    However, doing that meant that the consistency checks in
    add_overloaded_function fired as expected, which showed some
    latent issues.  This preliminary patch deals with those by adding
    AARCH64_FL_SME to things that require AARCH64_FL_SME2.

    This inconsistency led to another problem: functions were selected
    for arm_sme.h over arm_sve.h based on whether they had AARCH64_FL_SME.
    So some SME2-only things were actually defined in arm_sve.h, whereas
    similar SME things were defined in arm_sme.h.

    Choosing based on flags was an early get-started crutch that I forgot
    to clean up later :(  This patch goes for the more direct approach of
    having a separate table of SME builtins, as for arm_neon_sve_bridge.h.

    aarch64-sve-builtins-sve2.def contains several intrinsics that are
    currently SME-only but that operate entirely on vector registers.
    Many of these will be extended to SVE2.1 once SVE2.1 support is added,
    so the patch front-loads that by keeping the current division between
    aarch64-sve-builtins-sve2.def (whose functions now go in arm_sve.h)
    and aarch64-sve-builtins-sme.def (whose functions now go in arm_sme.h).

    gcc/
            PR target/112989
            * config/aarch64/aarch64-sve-builtins.def: Don't include
            aarch64-sve-builtins-sme.def.
            (DEF_SME_ZA_FUNCTION_GS, DEF_SME_ZA_FUNCTION): Move to...
            * config/aarch64/aarch64-sve-builtins-sme.def: ...here.
            (DEF_SME_FUNCTION): New macro.  Use it and DEF_SME_FUNCTION_GS
            instead of DEF_SVE_*.  Add AARCH64_FL_SME to anything that
            requires AARCH64_FL_SME2.
            * config/aarch64/aarch64-sve-builtins-sve2.def: Make same
            AARCH64_FL_SME adjustment here.
            * config/aarch64/aarch64-sve-builtins.cc (function_groups): Don't
            include SME intrinsics.
            (sme_function_groups): New array.
            (handle_arm_sve_h): Remove check for AARCH64_FL_SME.
            (handle_arm_sme_h): Use sme_function_groups instead of
function_groups.

    gcc/testsuite/
            PR target/112989
            * gcc.target/aarch64/sve/acle/general-c/clamp_1.c: Remove bogus
            error test.

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #14 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:81d309168b2a058d4c8ad5430abb56cfe1f82188

commit r14-7185-g81d309168b2a058d4c8ad5430abb56cfe1f82188
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Fri Jan 12 12:29:22 2024 +0000

    aarch64: Use a global map to detect duplicated overloads [PR112989]

    As explained in the covering note to the previous patch,
    the fact that aarch64-sve-* is now used for multiple header
    files means that function_builder::add_overloaded_function
    now needs to use a global map to detect duplicated overload
    functions, instead of the member variable that it used previously.

    gcc/
            PR target/112989
            * config/aarch64/aarch64-sve-builtins.h
            (function_builder::m_overload_names): Replace with...
            * config/aarch64/aarch64-sve-builtins.cc (overload_names): ...this
            new global.
            (add_overloaded_function): Update accordingly, using get_identifier
            to get a GGC-friendly record of the name.

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

Richard Sandiford <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #15 from Richard Sandiford <rsandifo at gcc dot gnu.org> ---
I didn't manage to reproduce the PR in the originally reported form, but FWIW,
the patches mean that a gcc_unreachable above:

  return decl;

in simulate_builtin_function_decl no longer fires for arm_sve.h or arm_sme.h. 
Please reopen if there are still some lingering issues.

[Bug target/112989] [14 Regression] GC ICE with C++, `#include <arm_sve.h>` and `-fsanitize=address`

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112989

--- Comment #16 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:659a5a908edd84894c2aa7f6f89468217d6894ca

commit r14-8354-g659a5a908edd84894c2aa7f6f89468217d6894ca
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Tue Jan 23 11:10:41 2024 +0000

    aarch64: Avoid registering duplicate C++ overloads [PR112989]

    In the original fix for this PR, I'd made sure that
    including <arm_sme.h> didn't reach the final return in
    simulate_builtin_function_decl (which would indicate duplicate
    function definitions).  But it seems I forgot to do the same
    thing for C++, which defines all of its overloads directly.

    This patch fixes a case where we still recorded duplicate
    functions for C++.  Thanks to Iain for reporting the resulting
    GC ICE and for help with reproducing it.

    gcc/
            PR target/112989
            * config/aarch64/aarch64-sve-builtins-shapes.cc (build_one): Skip
            MODE_single variants of functions that don't take tuple arguments.