[Bug rtl-optimization/114137] New: ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[Bug rtl-optimization/114137] New: ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114137

            Bug ID: 114137
           Summary: ICE when building lua-5.4.6 with
                    -fharden-control-flow-redundancy on x86 (error:
                    invalid rtl sharing found in the insn)
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
                CC: aoliva at gcc dot gnu.org
  Target Milestone: ---

```
libtool: compile:  i686-pc-linux-gnu-gcc -DPACKAGE_NAME=\"lua5.4\"
-DPACKAGE_TARNAME=\"lua\" -DPACKAGE_VERSION=\"5.4.6\"
"-DPACKAGE_STRING=\"lua5.4 5.4.6\""
-DPACKAGE_BUGREPORT=\"https://bugs.gentoo.org/\"
-DPACKAGE_URL=\"http://www.lua.org\" -DPACKAGE=\"lua\" -DVERSION=\"5.4.6\"
-DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_INTTYPES_H=1
-DHAVE_STDINT_H=1 -DHAVE_STRINGS_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_SYS_TYPES_H=1
-DHAVE_UNISTD_H=1 -DSTDC_HEADERS=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\"
-DLUA_USE_READLINE=1 -DLUA_USE_LINUX=1 -I. -I./src -DLUA_COMPAT_5_3 -Wall -O3
-pipe -march=i686 -fdiagnostics-color=always -mfpmath=sse -msse -msse2
-fno-vect-cost-model -fharden-control-flow-redundancy -fpermissive -c src/lvm.c
 -fPIC -DPIC -o src/.libs/lvm.o
src/lvm.c: In function 'luaV_execute':
src/lvm.c:1899:1: error: invalid rtl sharing found in the insn
 1899 | }
      | ^
(insn 13766 3884 3886 347 (set (reg:SI 5300)
        (reg:SI 7643)) "src/lvm.c":1432:9 discrim 3 -1
     (expr_list:REG_EQUAL (plus:SI (reg:SI 98)
            (const:SI (unspec:SI [
                        (mem/c:BLK (plus:SI (reg/f:SI 19 frame)
                                (const_int -140 [0xffffffffffffff74])) [14
.cfrvisited.1003+0 S136 A32])
                    ] UNSPEC_GOTOFF)))
        (nil)))
src/lvm.c:1899:1: error: shared rtx
(mem/c:BLK (plus:SI (reg/f:SI 19 frame)
        (const_int -140 [0xffffffffffffff74])) [14 .cfrvisited.1003+0 S136
A32])
during RTL pass: rtl pre
src/lvm.c:1899:1: internal compiler error: internal consistency failure
0x56ebaa07 verify_rtx_sharing
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3046
0x5873fc59 verify_rtx_sharing
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3079
0x5873fbac verify_rtx_sharing
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3061
0x5873fbac verify_rtx_sharing
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3061
0x5873fbac verify_rtx_sharing
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3061
0x5873bd69 verify_insn_sharing
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3132
0x5873bd69 verify_rtl_sharing()
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3154
0x5837fa6c execute_function_todo
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2109
0x5837fa6c do_per_function
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:1687
0x5837fa6c execute_todo
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2142
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
make[1]: *** [Makefile:731: src/lvm.lo] Error 1
make[1]: Leaving directory '/var/tmp/portage/dev-lang/lua-5.4.6/work/lua-5.4.6'
make: *** [Makefile:484: all] Error 2
```

```
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/i686-pc-linux-gnu/14/lto-wrapper
Target: i686-pc-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-14.0.9999/work/gcc-14.0.9999/configure
--host=i686-pc-linux-gnu --build=i686-pc-linux-gnu --prefix=/usr
--bindir=/usr/i686-pc-linux-gnu/gcc-bin/14
--includedir=/usr/lib/gcc/i686-pc-linux-gnu/14/include
--datadir=/usr/share/gcc-data/i686-pc-linux-gnu/14
--mandir=/usr/share/gcc-data/i686-pc-linux-gnu/14/man
--infodir=/usr/share/gcc-data/i686-pc-linux-gnu/14/info
--with-gxx-include-dir=/usr/lib/gcc/i686-pc-linux-gnu/14/include/g++-v14
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/i686-pc-linux-gnu/14/python
--enable-languages=c,c++,fortran --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--disable-libunwind-exceptions --enable-checking=yes,extra,rtl,df
--with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo 14.0.9999 p,
commit e54a7fbca63053b5753fd9ba543c27ef392d3084' --with-gcc-major-version-only
--enable-libstdcxx-time --enable-lto --disable-libstdcxx-pch --enable-shared
--enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu
--disable-multilib --disable-fixed-point --with-arch=i686 --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --disable-cet
--disable-systemtap --disable-valgrind-annotations --disable-vtable-verify
--disable-libvtv --with-zstd --without-isl --enable-default-pie
--enable-host-pie --disable-host-bind-now --enable-default-ssp
--disable-fixincludes --with-build-config='bootstrap-O3 bootstrap-lto'
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240226 (experimental)
96773ce7d667452a50b0456681f415b47c22960a (Gentoo 14.0.9999 p, commit
e54a7fbca63053b5753fd9ba543c27ef392d3084)
```

[Bug rtl-optimization/114137] ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114137

--- Comment #1 from Sam James <sjames at gcc dot gnu.org> ---
Created attachment 57553
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57553&action=edit
lvm.i

[Bug target/114137] ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114137

--- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
The bug is very reproducible with the original command, but...

I can't reproduce it with the preprocessed source or with -save-temps on the
original command line, but pinskia suggested I try --param=ggc-min-expand=1
--param=ggc-min-heapsize=1 which fixes the original crash...

[Bug target/114137] ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114137

--- Comment #3 from Sam James <sjames at gcc dot gnu.org> ---
==16482== Command: /usr/libexec/gcc/i686-pc-linux-gnu/14/cc1 -quiet -I . -I
./src -D PACKAGE_NAME="lua5.4" -D PACKAGE_TARNAME="lua" -D
PACKAGE_VERSION="5.4.6" -D PACKAGE_STRING="lua5.4\ 5.4.6" -D
PACKAGE_BUGREPORT="https://bugs.gentoo.org/" -D
PACKAGE_URL="http://www.lua.org" -D PACKAGE="lua" -D VERSION="5.4.6" -D
HAVE_STDIO_H=1 -D HAVE_STDLIB_H=1 -D HAVE_STRING_H=1 -D HAVE_INTTYPES_H=1 -D
HAVE_STDINT_H=1 -D HAVE_STRINGS_H=1 -D HAVE_SYS_STAT_H=1 -D HAVE_SYS_TYPES_H=1
-D HAVE_UNISTD_H=1 -D STDC_HEADERS=1 -D HAVE_DLFCN_H=1 -D LT_OBJDIR=".libs/" -D
LUA_USE_READLINE=1 -D LUA_USE_LINUX=1 -D LUA_COMPAT_5_3 -D PIC src/lvm.c -quiet
-dumpdir src/.libs/ -dumpbase lvm.c -dumpbase-ext .c -march=i686 -mfpmath=sse
-msse -msse2 -O3 -Wall -fdiagnostics-color=always -fvect-cost-model=unlimited
-fharden-control-flow-redundancy -fpermissive -fPIC -o -
==16482==
==16482== Conditional jump or move depends on uninitialised value(s)
==16482==    at 0x232FE2A: UnknownInlinedFun (sparseset.h:146)
==16482==    by 0x232FE2A: mark_pseudo_regno_live(int) (ira-lives.cc:327)
==16482==    by 0x2324AE3: UnknownInlinedFun (ira-lives.cc:411)
==16482==    by 0x2324AE3: UnknownInlinedFun (ira-lives.cc:425)
==16482==    by 0x2324AE3: process_bb_node_lives(ira_loop_tree_node*)
(ira-lives.cc:1404)
==16482==    by 0x2305DF9: ira_traverse_loop_tree(bool, ira_loop_tree_node*,
void (*)(ira_loop_tree_node*), void (*)(ira_loop_tree_node*))
(ira-build.cc:1809)
==16482==    by 0x26CAB8B: ira_create_allocno_live_ranges() (ira-lives.cc:1818)
==16482==    by 0x22FFD84: ira_build() (ira-build.cc:3491)
==16482==    by 0x26AFBC9: UnknownInlinedFun (ira.cc:5793)
==16482==    by 0x26AFBC9: (anonymous namespace)::pass_ira::execute(function*)
[clone .lto_priv.0] (ira.cc:6117)
==16482==    by 0x1EA53B7: execute_one_pass(opt_pass*) (passes.cc:2646)
==16482==    by 0x1F716AB: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==16482==    by 0x1F716C8: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==16482==    by 0x1F713E8: execute_pass_list(function*, opt_pass*)
(passes.cc:2766)
==16482==    by 0x25CC292: cgraph_node::expand() (cgraphunit.cc:1845)
==16482==    by 0x1E9FF59: UnknownInlinedFun (cgraphunit.cc:2028)
==16482==    by 0x1E9FF59: symbol_table::compile() (cgraphunit.cc:2402)
==16482==
==16482== Conditional jump or move depends on uninitialised value(s)
==16482==    at 0x232FF24: UnknownInlinedFun (sparseset.h:146)
==16482==    by 0x232FF24: UnknownInlinedFun (sparseset.h:165)
==16482==    by 0x232FF24: UnknownInlinedFun (ira-lives.cc:127)
==16482==    by 0x232FF24: mark_pseudo_regno_live(int) (ira-lives.cc:331)
==16482==    by 0x2324AE3: UnknownInlinedFun (ira-lives.cc:411)
==16482==    by 0x2324AE3: UnknownInlinedFun (ira-lives.cc:425)
==16482==    by 0x2324AE3: process_bb_node_lives(ira_loop_tree_node*)
(ira-lives.cc:1404)
==16482==    by 0x2305DF9: ira_traverse_loop_tree(bool, ira_loop_tree_node*,
void (*)(ira_loop_tree_node*), void (*)(ira_loop_tree_node*))
(ira-build.cc:1809)
==16482==    by 0x26CAB8B: ira_create_allocno_live_ranges() (ira-lives.cc:1818)
==16482==    by 0x22FFD84: ira_build() (ira-build.cc:3491)
==16482==    by 0x26AFBC9: UnknownInlinedFun (ira.cc:5793)
==16482==    by 0x26AFBC9: (anonymous namespace)::pass_ira::execute(function*)
[clone .lto_priv.0] (ira.cc:6117)
==16482==    by 0x1EA53B7: execute_one_pass(opt_pass*) (passes.cc:2646)
==16482==    by 0x1F716AB: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==16482==    by 0x1F716C8: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==16482==    by 0x1F713E8: execute_pass_list(function*, opt_pass*)
(passes.cc:2766)
==16482==    by 0x25CC292: cgraph_node::expand() (cgraphunit.cc:1845)
==16482==    by 0x1E9FF59: UnknownInlinedFun (cgraphunit.cc:2028)
==16482==    by 0x1E9FF59: symbol_table::compile() (cgraphunit.cc:2402)
[...]
==16482== Use of uninitialised value of size 4
==16482==    at 0x238D41A: UnknownInlinedFun (sparseset.h:146)
==16482==    by 0x238D41A: UnknownInlinedFun (sparseset.h:165)
==16482==    by 0x238D41A: make_hard_regno_live(int) (lra-lives.cc:288)
==16482==    by 0x23885B7: process_bb_lives(basic_block_def*, int&, bool)
(lra-lives.cc:960)
==16482==    by 0x2386343: lra_create_live_ranges_1(bool, bool)
(lra-lives.cc:1416)
==16482==    by 0x2385EF0: lra_create_live_ranges(bool, bool)
(lra-lives.cc:1486)
==16482==    by 0x234E372: lra(_IO_FILE*, int) (lra.cc:2482)
==16482==    by 0x26D1D2F: UnknownInlinedFun (ira.cc:5973)
==16482==    by 0x26D1D2F: (anonymous
namespace)::pass_reload::execute(function*) [clone .lto_priv.0] (ira.cc:6161)
==16482==    by 0x1EA53B7: execute_one_pass(opt_pass*) (passes.cc:2646)
==16482==    by 0x1F716AB: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==16482==    by 0x1F716C8: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==16482==    by 0x1F713E8: execute_pass_list(function*, opt_pass*)
(passes.cc:2766)
==16482==    by 0x25CC292: cgraph_node::expand() (cgraphunit.cc:1845)
==16482==    by 0x1E9FF59: UnknownInlinedFun (cgraphunit.cc:2028)
==16482==    by 0x1E9FF59: symbol_table::compile() (cgraphunit.cc:2402)
[...]

[Bug target/114137] ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114137

--- Comment #4 from Sam James <sjames at gcc dot gnu.org> ---
I have another testcase where it works with -save-temps or the GC params.

bibtexu-3.71_p20210325:

```
# i686-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I.   -DUNIX -DKPATHSEA
-DU_DISABLE_RENAMING=1 -I/usr/include  -DUTF_8  -Wimplicit -Wreturn-type -O3
-pipe -march=i686 -fdiagnostics-color=always -mfpmath=sse -msse -msse2
-fno-vect-cost-model -fharden-control-flow-redundancy -fpermissive -c -o
bibtexu-bibtex-4.o bibtex-4.c -fharden-control-flow-redundancy
during RTL pass: rtl pre
In file included from bibtex-4.c:130:
bibtex-4.c: In function ‘x_format_name’:
sysdep.h:210:37: internal compiler error: Segmentation fault
  210 | #define END                         }
      |                                     ^
bibtex-4.c:1303:1: note: in expansion of macro ‘END’
 1303 | END
      | ^~~
0x579d3dc9 crash_signal
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/toplev.cc:319
0x586e7ff0 mark_used_flags
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3364
0x586e6638 mark_used_flags
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3416
0x586e6638 mark_used_flags
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3411
0x586e6638 mark_used_flags
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3411
0x586e6638 reset_used_flags(rtx_def*)
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3428
0x586e6638 reset_insn_used_flags
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3094
0x586e6638 reset_all_used_flags
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3111
0x586e4737 verify_rtl_sharing()
       
/usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/emit-rtl.cc:3147
0x5832756c execute_function_todo
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2109
0x5832756c do_per_function
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:1687
0x5832756c execute_todo
        /usr/src/debug/sys-devel/gcc-14.0.9999/gcc-14.0.9999/gcc/passes.cc:2142
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
```

For both test cases, -fno-harden-control-flow-redundancy also suppresses the
ICE.

[Bug target/114137] ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114137

--- Comment #5 from Sam James <sjames at gcc dot gnu.org> ---
I also now believe I've seen this on sparc with ncurses with
-fharden-control-flow-redundancy...

[Bug target/114137] ICE when building lua-5.4.6 with -fharden-control-flow-redundancy on x86 (error: invalid rtl sharing found in the insn)

[aoliva at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114137

--- Comment #6 from Alexandre Oliva <aoliva at gcc dot gnu.org> ---
Thanks for the report.

Something's very rotten here.  cfrvisited is an automatic variable, why oh why
would we have GOTOFF unspecs for it?!?

I'd be interested in a preprocessed testcase that will trigger the problem.

Failing that, I suppose I could try to drive a remote debug session if you're
up for it.  If it is indeed something related with GC as suggested (and it
sounds plausible), the exact details of when it hits will depend on local
hardware details and not necessarily carry over to other machines.