[Bug target/113062] New: [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[Bug target/113062] New: [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[mjires at suse dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113062

            Bug ID: 113062
           Summary: [14 Regression][aarch64] ICE in fuse_pair, at
                    config/aarch64/aarch64-ldp-fusion.cc:1456 since
                    r14-6605-gc0911c6b357ba9
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: mjires at suse dot cz
                CC: acoplan at gcc dot gnu.org
  Target Milestone: ---
            Target: aarch64

Compiling reduced testcase gcc.dg/compat/struct-return-10_x.c results in ICE
since r14-6605-gc0911c6b357ba9.

$ cat struct-return-10_x.c
long double foo;
double bar;
void abort();
void check() {
  if (foo == bar)
    abort();
}


$ aarch64-linux-gnu-gcc struct-return-10_x.c -Oz -fharden-conditional-branches
during RTL pass: ldp_fusion
struct-return-10_x.c: In function ‘check’:
struct-return-10_x.c:7:1: internal compiler error: in fuse_pair, at
config/aarch64/aarch64-ldp-fusion.cc:1456
    7 | }
      | ^
0x1e2c0c8 ldp_bb_info::fuse_pair(bool, unsigned int, int, rtl_ssa::insn_info*,
rtl_ssa::insn_info*, base_cand&, rtl_ssa::insn_range_info const&)
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:1456
0x1e2da97 ldp_bb_info::try_fuse_pair(bool, unsigned int, rtl_ssa::insn_info*,
rtl_ssa::insn_info*)
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2217
0x1e2de0f ldp_bb_info::merge_pairs(std::__cxx11::list<rtl_ssa::insn_info*,
std::allocator<rtl_ssa::insn_info*> >&, std::__cxx11::list<rtl_ssa::insn_info*,
std::allocator<rtl_ssa::insn_info*> >&, bool, unsigned int)
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2306
0x1e2e034 ldp_bb_info::transform_for_base(int, access_group&)
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2339
0x1e306c8 void
ldp_bb_info::traverse_base_map<ordered_hash_map<pair_hash<tree_operand_hash,
int_hash<int, -1, -2> >, access_group,
simple_hashmap_traits<default_hash_traits<pair_hash<tree_operand_hash,
int_hash<int, -1, -2> > >, access_group> >
>(ordered_hash_map<pair_hash<tree_operand_hash, int_hash<int, -1, -2> >,
access_group,
simple_hashmap_traits<default_hash_traits<pair_hash<tree_operand_hash,
int_hash<int, -1, -2> > >, access_group> >&)
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2398
0x1e2e27c ldp_bb_info::transform()
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2405
0x1e2968c ldp_fusion_bb(rtl_ssa::bb_info*)
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2634
0x1e29716 ldp_fusion()
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2643
0x1e29828 execute
       
/home/mjires/git/GCC/master/gcc/config/aarch64/aarch64-ldp-fusion.cc:2693
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


$ aarch64-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=aarch64-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/home/mjires/built/master/libexec/gcc/aarch64-linux-gnu/14.0.0/lto-wrapper
Target: aarch64-linux-gnu
Configured with: /home/mjires/git/GCC/master/configure
--prefix=/home/mjires/built/master --target=aarch64-linux-gnu
--disable-bootstrap --enable-languages=c,c++,fortran --disable-multilib
--disable-libsanitizer --enable-checking
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.0 20231218 (experimental) (GCC)

[Bug target/113062] [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113062

Alex Coplan <acoplan at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2023-12-18
           Assignee|unassigned at gcc dot gnu.org      |acoplan at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Confirmed, thanks for the report, I'll take a look.

[Bug target/113062] [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113062

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

[Bug target/113062] [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113062

--- Comment #2 from Alex Coplan <acoplan at gcc dot gnu.org> ---
So we try to combine these two insns:

(insn 14 82 16 2 (set (mem/c:TF (plus:DI (reg/f:DI 31 sp)
                (const_int 32 [0x20])) [3 %sfp+-32 S16 A128])
        (asm_operands:TF ("") ("=g") 0 [
                (mem/c:TF (plus:DI (reg/f:DI 31 sp)
                        (const_int 32 [0x20])) [3 %sfp+-32 S16 A128])
            ]
             [
                (asm_input:TF ("0") t.c:5)
            ]
             [] t.c:5)) "t.c":5:6 -1
     (nil))
(insn 16 14 19 2 (set (mem/c:TF (plus:DI (reg/f:DI 31 sp)
                (const_int 48 [0x30])) [3 %sfp+-16 S16 A128])
        (asm_operands:TF ("") ("=g") 0 [
                (mem/c:TF (plus:DI (reg/f:DI 31 sp)
                        (const_int 48 [0x30])) [3 %sfp+-16 S16 A128])
            ]
             [
                (asm_input:TF ("0") t.c:5)
            ]
             [] t.c:5)) "t.c":5:6 -1
     (nil))

I think we aren't expecting to see memory operands in the RHS of the stores, I
think the pass needs to reject invalid operands earlier before we even start
tracking them.

Testing a patch.

[Bug target/113062] [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113062

Alex Coplan <acoplan at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #3 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Candidate fix:
https://gcc.gnu.org/pipermail/gcc-patches/2023-December/640957.html

[Bug target/113062] [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113062

--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Alex Coplan <acoplan@gcc.gnu.org>:

https://gcc.gnu.org/g:f5213759a7e0efc4ca7bbb484bab94ca19bc1b5d

commit r14-6740-gf5213759a7e0efc4ca7bbb484bab94ca19bc1b5d
Author: Alex Coplan <alex.coplan@arm.com>
Date:   Wed Dec 20 09:39:29 2023 +0000

    aarch64: Validate register operands early in ldp fusion pass [PR113062]

    We were missing validation of the candidate register operands in the
    ldp/stp pass.  I was relying on recog rejecting such cases when we
    formed the final pair insn, but the testcase shows that with
    -fharden-conditionals we attempt to combine two insns with asm_operands,
    both containing mem rtxes.  This then trips the assert:

    gcc_assert (change->new_uses.is_valid ());

    in the stp case as we aren't expecting to have (distinct) uses of mem in
    the candidate stores.

    While doing this I noticed that it seems more natural to have the
    initial definition of mem_size closer to its first use in track_access,
    so I moved that down.

    gcc/ChangeLog:

            PR target/113062
            * config/aarch64/aarch64-ldp-fusion.cc
            (ldp_bb_info::track_access): Punt on accesses with invalid
            register operands, move definition of mem_size closer to its
            first use.

    gcc/testsuite/ChangeLog:

            PR target/113062
            * gcc.dg/pr113062.c: New test.

[Bug target/113062] [14 Regression][aarch64] ICE in fuse_pair, at config/aarch64/aarch64-ldp-fusion.cc:1456 since r14-6605-gc0911c6b357ba9

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113062

Alex Coplan <acoplan at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Should be fixed, thanks again for the report.