[Bug target/113133] New: [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[Bug target/113133] New: [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

            Bug ID: 113133
           Summary: [14 Regression] ICE: SIGSEGV in
                    mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O
                    -fno-tree-ter -mavx512f -march=barcelona
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 56931
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56931&action=edit
reduced testcase

I am observing these kind of SEGSEGV, -O -fno-tree-ter -mavx512f -march="some
older amd64" seems to be the common set of flags. Up to try_split() seems to be
the common backtrace.

Compiler output:
$ x86_64-pc-linux-gnu-gcc -O -fno-tree-ter -mavx512f -march=barcelona
testcase.c -wrapper valgrind,-q
==3147== Invalid read of size 1
==3147==    at 0x1079841: mark_label_nuses(rtx_def*) (emit-rtl.cc:3896)
==3147==    by 0x10798C4: mark_label_nuses(rtx_def*) (emit-rtl.cc:3904)
==3147==    by 0x10798C4: mark_label_nuses(rtx_def*) (emit-rtl.cc:3904)
==3147==    by 0x10798C4: mark_label_nuses(rtx_def*) (emit-rtl.cc:3904)
==3147==    by 0x108057A: try_split(rtx_def*, rtx_insn*, int)
(emit-rtl.cc:4093)
==3147==    by 0x144AB28: split_insn(rtx_insn*) (recog.cc:3405)
==3147==    by 0x14519C5: split_all_insns() (recog.cc:3509)
==3147==    by 0x1451AE8: (anonymous
namespace)::pass_split_all_insns::execute(function*) (recog.cc:4433)
==3147==    by 0x13C9A6A: execute_one_pass(opt_pass*) (passes.cc:2646)
==3147==    by 0x13CA35F: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==3147==    by 0x13CA371: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==3147==    by 0x13CA371: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==3147==  Address 0x2 is not stack'd, malloc'd or (recently) free'd
==3147== 
during RTL pass: split2
testcase.c: In function 'foo0':
testcase.c:68:1: internal compiler error: Segmentation fault
   68 | }
      | ^
0x150b4af crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:316
0x1079841 mark_label_nuses
        /repo/gcc-trunk/gcc/emit-rtl.cc:3896
0x10798c4 mark_label_nuses
        /repo/gcc-trunk/gcc/emit-rtl.cc:3904
0x10798c4 mark_label_nuses
        /repo/gcc-trunk/gcc/emit-rtl.cc:3904
0x10798c4 mark_label_nuses
        /repo/gcc-trunk/gcc/emit-rtl.cc:3904
0x108057a try_split(rtx_def*, rtx_insn*, int)
        /repo/gcc-trunk/gcc/emit-rtl.cc:4093
0x144ab28 split_insn
        /repo/gcc-trunk/gcc/recog.cc:3405
0x14519c5 split_all_insns()
        /repo/gcc-trunk/gcc/recog.cc:3509
0x1451ae8 execute
        /repo/gcc-trunk/gcc/recog.cc:4433
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-6825-20231224193009-ga657c7e3518-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-6825-20231224193009-ga657c7e3518-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.0 20231224 (experimental) (GCC)

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-12-28
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
           Assignee|unassigned at gcc dot gnu.org      |ubizjak at gmail dot com

--- Comment #1 from Uroš Bizjak <ubizjak at gmail dot com> ---
Created attachment 56962
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56962&action=edit
Proposed patch

Patch in testing.

lowpart_subreg can't handle:

lowpart_subreg (V4SFmode, operands[0], DFmode);

and

lowpart_subreg (V2DFmode, operands[0], SFmode);

subreg conversions and will return NULL_RTX for these cases.

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

--- Comment #2 from Uroš Bizjak <ubizjak at gmail dot com> ---
Another testcase:

--cut here--
void
foo1 (double *d, float f)
{
  register float x __asm ("xmm16") = f;
  asm volatile ("" : "+v" (x));

  *d = x;
}

void
foo2 (float *f, double d)
{
  register double x __asm ("xmm16") = d;
  asm volatile ("" : "+v" (x));

  *f = x;
}
--cut here--

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

--- Comment #3 from Uroš Bizjak <ubizjak at gmail dot com> ---
This patch also fixes the failure:

--cut here--
diff --git a/gcc/config/i386/i386.md b/gcc/config/i386/i386.md
index ca6dbf42a6d..cdb9ddc4eb3 100644
--- a/gcc/config/i386/i386.md
+++ b/gcc/config/i386/i386.md
@@ -5210,7 +5210,7 @@ (define_split
    && optimize_insn_for_speed_p ()
    && reload_completed
    && (!EXT_REX_SSE_REG_P (operands[0])
-       || TARGET_AVX512VL || TARGET_EVEX512)"
+       || TARGET_AVX512VL)"
    [(set (match_dup 2)
         (float_extend:V2DF
           (vec_select:V2SF
--cut here--

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |haochen.jiang at intel dot com

--- Comment #4 from Uroš Bizjak <ubizjak at gmail dot com> ---
Caused by r14-4499-gc1eef66baa8dde706d7ea6921648e6016dc7c93d

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[haochen.jiang at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

--- Comment #5 from Haochen Jiang <haochen.jiang at intel dot com> ---
(In reply to Uroš Bizjak from comment #3)
> This patch also fixes the failure:
> 
> --cut here--
> diff --git a/gcc/config/i386/i386.md b/gcc/config/i386/i386.md
> index ca6dbf42a6d..cdb9ddc4eb3 100644
> --- a/gcc/config/i386/i386.md
> +++ b/gcc/config/i386/i386.md
> @@ -5210,7 +5210,7 @@ (define_split
>     && optimize_insn_for_speed_p ()
>     && reload_completed
>     && (!EXT_REX_SSE_REG_P (operands[0])
> -       || TARGET_AVX512VL || TARGET_EVEX512)"
> +       || TARGET_AVX512VL)"
>     [(set (match_dup 2)
>          (float_extend:V2DF
>            (vec_select:V2SF
> --cut here--

Hmm, it looks weird I added EVEX512 near AVX512VL, checking why I am doing
that.

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[haochen.jiang at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

--- Comment #6 from Haochen Jiang <haochen.jiang at intel dot com> ---
Aha, I see what happened. x/ymm16+ are usable for AVX512F w/o AVX512VL and that
is why I added that to allow them.

Let me find a way to see if we can fix this.

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[haochen.jiang at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

--- Comment #7 from Haochen Jiang <haochen.jiang at intel dot com> ---
(In reply to Uroš Bizjak from comment #1)
> Created attachment 56962 [details]
> Proposed patch
> 
> Patch in testing.
> 
> lowpart_subreg can't handle:
> 
> lowpart_subreg (V4SFmode, operands[0], DFmode);
> 
> and
> 
> lowpart_subreg (V2DFmode, operands[0], SFmode);
> 
> subreg conversions and will return NULL_RTX for these cases.

I suppose the patch here is ok at least from my initial test.

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

--- Comment #8 from Uroš Bizjak <ubizjak at gmail dot com> ---
(In reply to Haochen Jiang from comment #6)
> Aha, I see what happened. x/ymm16+ are usable for AVX512F w/o AVX512VL and
> that is why I added that to allow them.
> 
> Let me find a way to see if we can fix this.

It looks to me that ix86_hard_regno_mode_ok should be fixed to allow x/ymm16+
also with EVEX512. Currently we have:

      /* TODO check for QI/HI scalars.  */
      /* AVX512VL allows sse regs16+ for 128/256 bit modes.  */
      if (TARGET_AVX512VL
          && (VALID_AVX256_REG_OR_OI_MODE (mode)
              || VALID_AVX512VL_128_REG_MODE (mode)))
        return true;

so the compiler is unable to change some of the modes of the xmm16 to 128-bit
mode using lowpart_subreg, e.g. DFmode to V4SFmode.

Please also note that your original patch missed to add TARGET_EVEX512 to the
splitter that handles float_truncate with TARGET_USE_VECTOR_FP_CONVERTS.

I propose to proceed with the minimal fix from Comment #3 as a hotfix to
unbreak the testcase in this PR. The real, but more involved fix is to fix
ix86_hard_regno_mode_ok, which I'll leave to you.

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Uros Bizjak <uros@gcc.gnu.org>:

https://gcc.gnu.org/g:1e7f9abb892443719c82bb17910caa8fb5eeec15

commit r14-6862-g1e7f9abb892443719c82bb17910caa8fb5eeec15
Author: Uros Bizjak <ubizjak@gmail.com>
Date:   Fri Dec 29 09:47:43 2023 +0100

    i386: Fix TARGET_USE_VECTOR_FP_CONVERTS SF->DF float_extend splitter
[PR113133]

    The post-reload splitter currently allows xmm16+ registers with
TARGET_EVEX512.
    The splitter changes SFmode of the output operand to V4SFmode, but the
vector
    mode is currently unsupported in xmm16+ without TARGET_AVX512VL.
lowpart_subreg
    returns NULL_RTX in this case and the compilation fails with invalid RTX.

    The patch removes support for x/ymm16+ registers with TARGET_EVEX512.  The
    support should be restored once ix86_hard_regno_mode_ok is fixed to allow
    16-byte modes in x/ymm16+ with TARGET_EVEX512.

            PR target/113133

    gcc/ChangeLog:

            * config/i386/i386.md
            (TARGET_USE_VECTOR_FP_CONVERTS SF->DF float_extend splitter):
            Do not handle xmm16+ with TARGET_EVEX512.

    gcc/testsuite/ChangeLog:

            * gcc.target/i386/pr113133-1.c: New test.
            * gcc.target/i386/pr113133-2.c: New test.

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #10 from Uroš Bizjak <ubizjak at gmail dot com> ---
Fixed by a partial revert of
r14-4499-gc1eef66baa8dde706d7ea6921648e6016dc7c93d.

[Bug target/113133] [14 Regression] ICE: SIGSEGV in mark_label_nuses(rtx_def*) (emit-rtl.cc:3896) with -O -fno-tree-ter -mavx512f -march=barcelona

[haochen.jiang at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113133

--- Comment #11 from Haochen Jiang <haochen.jiang at intel dot com> ---
I just checked the code and pattern. I suppose the simple remove is reasonable
here. We should only allow x/ymm16+ for scalar instructions, but not this
pattern.