[Bug c/115009] New: [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[Bug c/115009] New: [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[manuel.lauss at googlemail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

            Bug ID: 115009
           Summary: [15 regression] AVR: ICE in alloc, at
                    value-range-storage.cc:598
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: manuel.lauss at googlemail dot com
  Target Milestone: ---

Created attachment 58146
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58146&action=edit
unreduced testcase

Building avr-libc-2.1.0/avr/lib/avr2/strftime.c with latest gcc-15 snapshot:

avr-gcc -c strftime-avr.i -Os
during GIMPLE pass: evrp
../../../libc/time/strftime.c: In function ‘pgm_copystring’:
../../../libc/time/strftime.c:322:1: internal compiler error: in alloc, at
value-range-storage.cc:598
  322 | }
      | ^

-Os is essential to trigger it.

# gcc -v
Reading specs from /usr/lib/gcc/avr/15/device-specs/specs-avr2
COLLECT_GCC=avr-gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/avr/15/lto-wrapper
Target: avr
Configured with:
/tmp-ram/portage/cross-avr/gcc-15.0.9999/work/gcc-15.0.9999/configure
--host=x86_64-pc-linux-gnu --target=avr --build=x86_64-pc-linux-gnu
--prefix=/usr --bindir=/usr/x86_64-pc-linux-gnu/avr/gcc-bin/15
--includedir=/usr/lib/gcc/avr/15/include --datadir=/usr/share/gcc-data/avr/15
--mandir=/usr/share/gcc-data/avr/15/man
--infodir=/usr/share/gcc-data/avr/15/info
--with-gxx-include-dir=/usr/lib/gcc/avr/15/include/g++-v15
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/avr/15/python --enable-languages=c
--enable-obsolete --enable-secureplt --disable-werror --with-system-zlib
--enable-nls --without-included-gettext --disable-libunwind-exceptions
--enable-checking=yes,extra --with-bugurl=https://bugs.gentoo.org/
--with-pkgversion='Gentoo 15.0.9999 p, commit
f525de00d17a460aebb382c0d34529ddc383fb9d' --with-gcc-major-version-only
--enable-lto --disable-libstdcxx-pch --enable-poison-system-directories
--enable-shared --disable-threads --disable-gcov --disable-bootstrap
--enable-multilib --disable-fixed-point --disable-libgomp --disable-libssp
--disable-libada --disable-systemtap --disable-valgrind-annotations
--disable-vtable-verify --disable-libvtv --with-zstd --without-isl
--disable-libsanitizer --disable-default-pie --enable-host-pie
--disable-host-bind-now --disable-default-ssp --disable-fixincludes
Thread model: single
Supported LTO compression algorithms: zlib zstd
gcc version 15.0.0 20240509 (experimental)
2790195500ec523cad9c7292816540e2fc19f456

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu.org
   Target Milestone|---                         |15.0
           Keywords|                            |ice-on-valid-code
          Component|c                           |tree-optimization

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-05-09
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I can reproduce it using a cross to avr.

Let me try to reduce it.

[apinski@xeond2 gcc]$ ./cc1 t.c -quiet -Os
during GIMPLE pass: evrp
../../../libc/time/strftime.c: In function ‘pgm_copystring’:
../../../libc/time/strftime.c:322:1: internal compiler error: in alloc, at
value-range-storage.cc:598
0x198d71c prange_storage::alloc(vrange_internal_alloc&, prange const&)
        ../../gcc/value-range-storage.cc:598
0x198bf3d vrange_storage::alloc(vrange_internal_alloc&, vrange const&)
        ../../gcc/value-range-storage.cc:149
0x198bc77 vrange_allocator::clone(vrange const&)
        ../../gcc/value-range-storage.cc:113
0x22f3f05 ssa_cache::set_range(tree_node*, vrange const&)
        ../../gcc/gimple-range-cache.cc:610
0x22f5146 ranger_cache::get_global_range(vrange&, tree_node*, bool&)
        ../../gcc/gimple-range-cache.cc:1058
0x22ee341 gimple_ranger::range_of_stmt(vrange&, gimple*, tree_node*)
        ../../gcc/gimple-range.cc:323
0x22ed98b gimple_ranger::range_on_entry(vrange&, basic_block_def*, tree_node*)
        ../../gcc/gimple-range.cc:171
0x22edbb7 gimple_ranger::range_on_exit(vrange&, basic_block_def*, tree_node*)
        ../../gcc/gimple-range.cc:208
0x22edefa gimple_ranger::range_on_edge(vrange&, edge_def*, tree_node*)
        ../../gcc/gimple-range.cc:253
0x1971da8 range_query::value_on_edge(edge_def*, tree_node*)
        ../../gcc/value-query.cc:105
0x191c5d1 rvrp_folder::value_on_edge(edge_def*, tree_node*)
        ../../gcc/tree-vrp.cc:990
0x17c2e47 substitute_and_fold_engine::propagate_into_phi_args(basic_block_def*)
        ../../gcc/tree-ssa-propagate.cc:746
0x17c39e7 substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/tree-ssa-propagate.cc:954
0x227890c dom_walker::walk(basic_block_def*)
        ../../gcc/domwalk.cc:311
0x17c3aff substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
        ../../gcc/tree-ssa-propagate.cc:999
0x191b419 execute_ranger_vrp(function*, bool, bool)
        ../../gcc/tree-vrp.cc:1066
0x191bcf9 execute
        ../../gcc/tree-vrp.cc:1309
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:
```
void
pgm_copystring(const char __memx * p)
{
    unsigned char c;
    c = *p;
}

```

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |blocker
                 CC|                            |aldyh at gcc dot gnu.org

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
596       // Assume all pointers are the same size.

Aldy, that is definitely not true on some targets, especially with named
address space.

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 115017 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|avr                         |avr, rl78

--- Comment #5 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Looks like rl78 is also affected. gcc.target/rl78/test_addm3.c with -O2.

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
rl78 has __far which is a 32bit pointer (the normal ptr size there is 16bit).

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
For rl78:
static scalar_int_mode
rl78_addr_space_address_mode (addr_space_t addrspace)
{
  switch (addrspace)
    {
    case ADDR_SPACE_GENERIC:
      return HImode;
    case ADDR_SPACE_NEAR:
      return HImode;
    case ADDR_SPACE_FAR:
      return SImode;
    default:
      gcc_unreachable ();
    }
}

So yes it is obvious that address space can have different sizes for pointers
...

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #8 from Jeffrey A. Law <law at gcc dot gnu.org> ---
And on msp430-elf we're getting a codegen correctness issue on msp430-elf. 
gcc.dg/pr66444.c fails in the simulator.  The -O2 code difference looks like:

*** good.s      Thu May  9 20:41:37 2024
--- bad.s       Thu May  9 20:41:44 2024
*************** baz:
*** 73,81 ****
  ; saved regs:(none)
        ; start of prologue
        ; end of prologue
!       MOV.W   #2062, R12
        CALL    #fn1
!       MOV.W   #2062, R12
        CALL    #fn2
        MOV.B   #0, R12
        ; start of epilogue
--- 73,81 ----
  ; saved regs:(none)
        ; start of prologue
        ; end of prologue
!       MOV.B   #0, R12
        CALL    #fn1
!       MOV.B   #0, R12
        CALL    #fn2
        MOV.B   #0, R12
        ; start of epilogue


We're mucking up the pointer that baz() passes down to fn1 and fn2 I think.

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |aldyh at gcc dot gnu.org

--- Comment #9 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Created attachment 58155
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58155&action=edit
untested patch

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #10 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #7)
> For rl78:
> static scalar_int_mode
> rl78_addr_space_address_mode (addr_space_t addrspace)
> {
>   switch (addrspace)
>     {
>     case ADDR_SPACE_GENERIC:
>       return HImode;
>     case ADDR_SPACE_NEAR:
>       return HImode;
>     case ADDR_SPACE_FAR:
>       return SImode;
>     default:
>       gcc_unreachable ();
>     }
> }
> 
> So yes it is obvious that address space can have different sizes for
> pointers ...

I can test my proposed patch on a cross for avr, but for this testcase on
rl78-none and rl78-elf, I get:

a.c:1:8: error: unknown type name ‘scalar_int_mode’
    1 | static scalar_int_mode
      |        ^~~~~~~~~~~~~~~
a.c:2:31: error: unknown type name ‘addr_space_t’
    2 | rl78_addr_space_address_mode (addr_space_t addrspace)
      |                               ^~~~~~~~~~~~

Either way...could someone be so kind as to test on avr and rl78 to see if this
fixes the problem?

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #11 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Jeffrey A. Law from comment #8)
> And on msp430-elf we're getting a codegen correctness issue on msp430-elf. 
> gcc.dg/pr66444.c fails in the simulator.  The -O2 code difference looks like:
> 
> *** good.s      Thu May  9 20:41:37 2024
> --- bad.s       Thu May  9 20:41:44 2024
> *************** baz:
> *** 73,81 ****
>   ; saved regs:(none)
>         ; start of prologue
>         ; end of prologue
> !       MOV.W   #2062, R12
>         CALL    #fn1
> !       MOV.W   #2062, R12
>         CALL    #fn2
>         MOV.B   #0, R12
>         ; start of epilogue
> --- 73,81 ----
>   ; saved regs:(none)
>         ; start of prologue
>         ; end of prologue
> !       MOV.B   #0, R12
>         CALL    #fn1
> !       MOV.B   #0, R12
>         CALL    #fn2
>         MOV.B   #0, R12
>         ; start of epilogue
> 
> 
> We're mucking up the pointer that baz() passes down to fn1 and fn2 I think.

Hmmm, this may be something different.  I can look at it tomorrow.

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Aldy Hernandez from comment #10)
> I can test my proposed patch on a cross for avr, but for this testcase on
> rl78-none and rl78-elf, I get:

That was not a testcase but rather a copy of the function from rl78.cc which
describes the named address modes :).

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

--- Comment #13 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:ac255c7afeb8a558bd6224ff77277eebcd849d6e

commit r15-357-gac255c7afeb8a558bd6224ff77277eebcd849d6e
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Thu May 9 23:37:30 2024 +0200

    [prange] Do not assume all pointers are the same size [PR115009]

    In a world with same sized pointers we can always reuse the storage
    slots, but since this is not always the case, we need to be more
    careful.  However, we can always store an undefined, because that
    requires no extra storage.

    gcc/ChangeLog:

            PR tree-optimization/115009
            * value-range-storage.cc (prange_storage::alloc): Do not assume
            all pointers are the same size.
            (prange_storage::prange_storage): Same.
            (prange_storage::fits_p): Same.

[Bug tree-optimization/115009] [15 regression] AVR: ICE in alloc, at value-range-storage.cc:598

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115009

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #14 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
The pushed patch fixes the problem with different sized pointers.