[Bug target/114059] New: ICE in extract_insn, at recog.cc:2812 | sme2 vs -fsanitize=address -mtrack-speculation -fharden-control-flow-redundancy

[Bug target/114059] New: ICE in extract_insn, at recog.cc:2812 | sme2 vs -fsanitize=address -mtrack-speculation -fharden-control-flow-redundancy

[mjires at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114059

            Bug ID: 114059
           Summary: ICE in extract_insn, at recog.cc:2812 | sme2 vs
                    -fsanitize=address -mtrack-speculation
                    -fharden-control-flow-redundancy
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: mjires at gcc dot gnu.org
                CC: rsandifo at gcc dot gnu.org
  Target Milestone: ---

Compiling reduced testcase gcc.target/aarch64/sme/sibcall_9.c results in ICE,
since sme2 was introduced in r14-6175-g3b58b2205ffdce.

$ cat sibcall_9.c
#pragma GCC target "+sme2"
void caller_preserves() __arm_inout("za") {}


$ aarch64-linux-gnu-gcc sibcall_9.c -fsanitize=address -mtrack-speculation
-fharden-control-flow-redundancy
sibcall_9.c: In function ‘caller_preserves’:
sibcall_9.c:2:44: error: unrecognizable insn:
    2 | void caller_preserves() __arm_inout("za") {}
      |                                            ^
(jump_insn 156 155 157 (set (pc)
        (if_then_else (ne (reg:DI 16 x16)
                (const_int 0 [0]))
            (label_ref 160)
            (pc))) -1
     (int_list:REG_BR_PROB 1073204964 (nil))
 -> 160)
during RTL pass: split5
sibcall_9.c:2:44: internal compiler error: in extract_insn, at recog.cc:2812
0x16f34de _fatal_insn(char const*, rtx_def const*, char const*, int, char
const*)
        /home/mjires/git/GCC/master/gcc/rtl-error.cc:108
0x16f351f _fatal_insn_not_found(rtx_def const*, char const*, int, char const*)
        /home/mjires/git/GCC/master/gcc/rtl-error.cc:116
0x16a4044 extract_insn(rtx_insn*)
        /home/mjires/git/GCC/master/gcc/recog.cc:2812
0x16a3d03 extract_insn_cached(rtx_insn*)
        /home/mjires/git/GCC/master/gcc/recog.cc:2701
0x1203628 cleanup_subreg_operands(rtx_insn*)
        /home/mjires/git/GCC/master/gcc/final.cc:3053
0x16a581d split_insn
        /home/mjires/git/GCC/master/gcc/recog.cc:3441
0x16a5b01 split_all_insns_noflow()
        /home/mjires/git/GCC/master/gcc/recog.cc:3567
0x16a7b40 execute
        /home/mjires/git/GCC/master/gcc/recog.cc:4641
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


$ aarch64-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=aarch64-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/home/mjires/built/master/libexec/gcc/aarch64-linux-gnu/14.0.1/lto-wrapper
Target: aarch64-linux-gnu
Configured with: /home/mjires/git/GCC/master/configure
--prefix=/home/mjires/built/master --target=aarch64-linux-gnu
--disable-bootstrap --enable-languages=c,c++,fortran --disable-multilib
--disable-libsanitizer --enable-checking : (reconfigured)
/home/mjires/git/GCC/master/configure --prefix=/home/mjires/built/master
--target=aarch64-linux-gnu --disable-bootstrap --enable-languages=c,c++,fortran
--disable-multilib --disable-libsanitizer --enable-checking
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240222 (experimental) (GCC)

[Bug target/114059] ICE in extract_insn, at recog.cc:2812 | sme2 vs -fsanitize=address -mtrack-speculation -fharden-control-flow-redundancy

[aoliva at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114059

--- Comment #1 from Alexandre Oliva <aoliva at gcc dot gnu.org> ---
ISTM that -fharden-control-flow-redundancy is only instrumental to trigger the
latent problem, but the real problem is in the back end: aarch64_restore_za
emits a aarch64_cbnedi1 unconditionally, but insn aarch64_cb<optab><mode>1 is
disabled on aarch64_track_speculation, which the test uses.

[Bug target/114059] ICE in extract_insn, at recog.cc:2812 | sme2 vs -fsanitize=address -mtrack-speculation -fharden-control-flow-redundancy

[pheeck at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114059

Filip Kastl <pheeck at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pheeck at gcc dot gnu.org

--- Comment #2 from Filip Kastl <pheeck at gcc dot gnu.org> ---
I've just seen this ICE triggered also with -mtrack-speculation
-fharden-control-flow-redundancy -fnon-call-exceptions (also on sibcall_9.c).