[Bug c/43603] New: gcc-4.4.3 ICE on ia64 with -O3

[Bug c/43603] New: gcc-4.4.3 ICE on ia64 with -O3

[mariah dot lenox at gmail dot com]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2859 bytes --]

/* 
% uname -a
Linux cleo 2.6.18-128.1.1.el5 #1 SMP Mon Jan 26 13:57:09 EST 2009 ia64 ia64
ia64 GNU/Linux
% 
% gcc -v
Using built-in specs.
Target: ia64-unknown-linux-gnu
Configured with: /usr/local/gcc-4.4.3/src/gcc-4.4.3/configure
--enable-languages=c,c++,fortran --with-gnu-as
--with-as=/usr/local/binutils-2.20/ia64-Linux-rhel-gcc-4.4.2/bin/as
--with-gnu-ld
--with-ld=/usr/local/binutils-2.20/ia64-Linux-rhel-gcc-4.4.2/bin/ld
--with-gmp=/usr/local/mpir-1.2.2/ia64-Linux-rhel-gcc-4.4.2
--with-mpfr=/usr/local/mpfr-2.4.2/ia64-Linux-rhel-mpir-1.2.2-gcc-4.4.2
--prefix=/usr/local/gcc-4.4.3/ia64-Linux-rhel
Thread model: posix
gcc version 4.4.3 (GCC) 
%
% gcc -O2 -c foo.c
%
% gcc -O3 -c foo.c
foo.c: In function ‘foo’:
foo.c:35: error: unrecognizable insn:
(insn:TI 222 209 248 19 (parallel [
            (set (reg:SI 135 f7)
                (asm_operands:SI ("xma.hu %0 = %2, %3, f0
        xma.l %1 = %2, %3, f0") ("=&f") 0 [
                        (reg:SI 136 f8)
                        (reg:SI 130 f2 [394])
                    ]
                     [
                        (asm_input:SI ("f") 0)
                        (asm_input:SI ("f") 0)
                    ] 2896))
            (set (reg/v:SI 134 f6 [orig:370 b ] [370])
                (asm_operands:SI ("xma.hu %0 = %2, %3, f0
        xma.l %1 = %2, %3, f0") ("=f") 1 [
                        (reg:SI 136 f8)
                        (reg:SI 130 f2 [394])
                    ]
                     [
                        (asm_input:SI ("f") 0)
                        (asm_input:SI ("f") 0)
                    ] 2896))
        ]) -1 (nil))
foo.c:35: internal compiler error: in get_attr_first_insn, at
config/ia64/itanium2.md:1909
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
%
*/

int 
foo( long * np, int * dp, int qn)
{
  int i;
  int n0;
  int d0;
  int a;
  int b;
  int c;
  int d;

  a = 1;
  b = 0;
  c = 1;
  d = 1;

  d0 = dp[0];

  for (i = qn; i >= 0; i--) {
    if (bar((c == 0)) && (np[1] == d0)) {
      car(np - 3, dp, 3);
    } else { 
      __asm__ ("xma.hu %0 = %2, %3, f0\n\txma.l %1 = %2, %3, f0" : "=&f" ((a)), 
"=f" (b) : "f" ((c)), "f" ((d))); 
      n0 = np[0]; 
      if (n0 < d0) 
        c = 1; 
      else 
        c = 0; 

    }
    *--np = a;
  }

  return 0;
}


-- 
           Summary: gcc-4.4.3 ICE on ia64 with -O3
           Product: gcc
           Version: 4.4.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: mariah dot lenox at gmail dot com
 GCC build triplet: ia64-unknown-linux-gnu
  GCC host triplet: ia64-unknown-linux-gnu
GCC target triplet: ia64-unknown-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43603

[Bug target/43603] gcc-4.4.3 ICE on ia64 with -O3

[wilson at gcc dot gnu dot org]

------- Comment #1 from wilson at gcc dot gnu dot org  2010-04-04 01:34 -------
This is failing due to invalid rtl unsharing.  The asm has two dests.  We end
up with a parallel with two sets, and the ASM_OPERAND_INPUT_VEC in each SET_SRC
is supposed to be the same rtl pointer.  This is checked by asm_noperands. 
This is necessary for reg-alloc to handle the asm correctly.

The invalid unsharing happens in the file sel-sched-ir.c in the function
create_copy_of_insn_rtx.  It has code
 res = create_insn_rtx_from_pattern (copy_rtx (PATTERN (insn_rtx)),
                                      NULL_RTX);
This won't work.  You can't use copy_rtx to copy an insn.  You must use
copy_insn.  See the code and comments in emit-rtl.c.

This problem can be fixed by changing the copy_rtx to copy_insn, but I'm
concerned that there may be other places in sel-sched*.c that also need fixing.
 I don't know the code well enough to be able to easily tell which copy_rtx
calls are broken.

The testcase works on mainline, but the bug appears to still be there.  This
testcase just doesn't trigger it.


-- 

wilson at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |wilson at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2010-04-04 01:34:03
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43603

[Bug target/43603] gcc-4.4.3 ICE on ia64 with -O3

[amonakov at gcc dot gnu dot org]

------- Comment #2 from amonakov at gcc dot gnu dot org  2010-04-06 17:10 -------
Thanks for the analysis.
This is reproducible on trunk with -O2 -fsel-sched-pipelining
-fselective-scheduling2 (with -O3, pressure-aware loop invariant motion
slightly changes the code, and it's not possible to disable it (not even with
-fno-ira-loop-pressure, because it's enabled unconditionally in
ia64_override_options)).
The real problem is that we are attempting to clone an instruction with asm
operands as a bookkeeping copy -- that should never happen.  Thus, I think
copy_rtx calls should stay.  We'll have to fix the scheduler to never attempt
such code motion.


-- 

amonakov at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abel at gcc dot gnu dot org,
                   |                            |amonakov at gcc dot gnu dot
                   |                            |org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43603

[Bug target/43603] gcc-4.4.3 ICE on ia64 with -O3

[abel at gcc dot gnu dot org]

------- Comment #3 from abel at gcc dot gnu dot org  2010-04-20 08:36 -------
The problem is in the remove_insns_that_need_bookkeeping function, which should
filter out all instructions that cannot be copied but yet may require
bookkeeping.  An instruction with asm operands is an example of those insns. 
In the function, we use dominated_by_p to check that the target block dominates
the source block of the instruction, but the answer we get is wrong as the
dominance information is broken at this point, and that is because we do not
maintain it.  

We need to devise a patch to update the dominance information in the scheduler
using the dominator infrastructure or to stop using it altogether and to
rewrite the function in question.  The former requires some effort as my first
attempt at this failed, the latter will likely lead to performance regressions.
 I will work further on keeping dominance info up to date.  However, the
resulting patch will probably be unsuitable for a release branch.

That said, the copy_rtx calls should be fixed nevertheless, but currently it
should not matter for the instructions we really want to clone.  That may
change of course.


-- 

abel at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |abel at gcc dot gnu dot org
                   |dot org                     |
             Status|NEW                         |ASSIGNED
   Last reconfirmed|2010-04-04 01:34:03         |2010-04-20 08:36:09
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43603

[Bug target/43603] gcc-4.4.3 ICE on ia64 with -O3

[pinskia at gcc dot gnu dot org]

------- Comment #4 from pinskia at gcc dot gnu dot org  2010-05-21 17:47 -------
*** Bug 44233 has been marked as a duplicate of this bug. ***


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at njkfrudils dot plus
                   |                            |dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43603

[Bug target/43603] gcc-4.4.3 ICE on ia64 with -O3

[abel at gcc dot gnu dot org]

------- Comment #5 from abel at gcc dot gnu dot org  2010-06-30 08:44 -------
The below patch implements keeping dominance info up to date in the scheduler. 
After discussions with Alexander, I think that it will be better to leave the
copy_rtx calls as is, so that if we'll see this problem once again, we fail
immediately instead of silently miscompiling code.  The patch fixes both this
testcase and PR 44233's testcase.

(Also, Zdenek kindly provided a patch for the dominator tree infrastructure
that eases the development by failing immediately when the dominator data
structures become inconsistent, and I've made a cleanup patch in the scheduler.
 I will also submit both of those patches.)

 gcc/haifa-sched.c  |    2 +
 gcc/sel-sched-ir.c |   53 +++++++++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/gcc/haifa-sched.c b/gcc/haifa-sched.c
index 8d7149f..6bf526e 100644
--- a/gcc/haifa-sched.c
+++ b/gcc/haifa-sched.c
@@ -4452,6 +4452,8 @@ sched_create_recovery_edges (basic_block first_bb,
basic_block rec,
     edge_flags = 0;

   make_single_succ_edge (rec, second_bb, edge_flags);
+  if (dom_info_available_p (CDI_DOMINATORS))
+    set_immediate_dominator (CDI_DOMINATORS, rec, first_bb);
 }

 /* This function creates recovery code for INSN.  If MUTATE_P is nonzero,
diff --git a/gcc/sel-sched-ir.c b/gcc/sel-sched-ir.c
index 3146a26..f2be2df 100644
--- a/gcc/sel-sched-ir.c
+++ b/gcc/sel-sched-ir.c
@@ -3544,6 +3544,7 @@ static bool
 maybe_tidy_empty_bb (basic_block bb, bool recompute_toporder_p)
 {
   basic_block succ_bb, pred_bb;
+  VEC (basic_block, heap) *dom_bbs;
   edge e;
   edge_iterator ei;
   bool rescan_p;
@@ -3579,6 +3580,7 @@ maybe_tidy_empty_bb (basic_block bb, bool
recompute_toporder_p)
   succ_bb = single_succ (bb);
   rescan_p = true;
   pred_bb = NULL;
+  dom_bbs = NULL;

   /* Redirect all non-fallthru edges to the next bb.  */
   while (rescan_p)
@@ -3591,6 +3593,12 @@ maybe_tidy_empty_bb (basic_block bb, bool
recompute_toporder_p)

           if (!(e->flags & EDGE_FALLTHRU))
             {
+              /* We will update dominators here only when we'll get
+                 an unreachable block when redirecting, otherwise
+                 sel_redirect_edge_and_branch will take care of it.  */
+              if (e->dest != bb
+                  && single_pred_p (e->dest))
+                VEC_safe_push (basic_block, heap, dom_bbs, e->dest);
               recompute_toporder_p |= sel_redirect_edge_and_branch (e,
succ_bb);
               rescan_p = true;
               break;
@@ -3610,11 +3618,20 @@ maybe_tidy_empty_bb (basic_block bb, bool
recompute_toporder_p)
       remove_empty_bb (bb, true);
     }

+
+  if (!VEC_empty (basic_block, dom_bbs))
+    {
+      VEC_safe_push (basic_block, heap, dom_bbs, succ_bb);
+      iterate_fix_dominators (CDI_DOMINATORS, dom_bbs, false);
+      VEC_free (basic_block, heap, dom_bbs);
+    }
+
   if (recompute_toporder_p)
     sel_recompute_toporder ();

 #ifdef ENABLE_CHECKING
   verify_backedges ();
+  verify_dominators (CDI_DOMINATORS);
 #endif

   return true;
@@ -5026,7 +5043,12 @@ sel_remove_bb (basic_block bb, bool remove_from_cfg_p)
   bitmap_clear_bit (blocks_to_reschedule, idx);

   if (remove_from_cfg_p)
-    delete_and_free_basic_block (bb);
+    {
+      basic_block succ = single_succ (bb);
+      delete_and_free_basic_block (bb);
+      set_immediate_dominator (CDI_DOMINATORS, succ,
+                               recompute_dominator (CDI_DOMINATORS, succ));
+    }

   rgn_setup_region (CONTAINING_RGN (idx));
 }
@@ -5361,12 +5383,15 @@ sel_merge_blocks (basic_block a, basic_block b)
 void
 sel_redirect_edge_and_branch_force (edge e, basic_block to)
 {
-  basic_block jump_bb, src;
+  basic_block jump_bb, src, orig_dest = e->dest;
   int prev_max_uid;
   rtx jump;

-  gcc_assert (!sel_bb_empty_p (e->src));
-
+  /* This function is now used only for bookkeeping code creation, where
+     we'll never get the single pred of orig_dest block and thus will not
+     hit unreachable blocks when updating dominator info.  */
+  gcc_assert (!sel_bb_empty_p (e->src)
+              && !single_pred_p (orig_dest));
   src = e->src;
   prev_max_uid = get_max_uid ();
   jump_bb = redirect_edge_and_branch_force (e, to);
@@ -5383,6 +5408,10 @@ sel_redirect_edge_and_branch_force (edge e, basic_block
to)
   jump = find_new_jump (src, jump_bb, prev_max_uid);
   if (jump)
     sel_init_new_insn (jump, INSN_INIT_TODO_LUID | INSN_INIT_TODO_SIMPLEJUMP);
+  set_immediate_dominator (CDI_DOMINATORS, orig_dest,
+                          recompute_dominator (CDI_DOMINATORS, orig_dest));
+  set_immediate_dominator (CDI_DOMINATORS, to,
+                          recompute_dominator (CDI_DOMINATORS, to));
 }

 /* A wrapper for redirect_edge_and_branch.  Return TRUE if blocks connected by
@@ -5391,11 +5420,12 @@ bool
 sel_redirect_edge_and_branch (edge e, basic_block to)
 {
   bool latch_edge_p;
-  basic_block src;
+  basic_block src, orig_dest = e->dest;
   int prev_max_uid;
   rtx jump;
   edge redirected;
   bool recompute_toporder_p = false;
+  bool maybe_unreachable = single_pred_p (orig_dest);

   latch_edge_p = (pipelining_p
                   && current_loop_nest
@@ -5426,6 +5456,15 @@ sel_redirect_edge_and_branch (edge e, basic_block to)
   if (jump)
     sel_init_new_insn (jump, INSN_INIT_TODO_LUID | INSN_INIT_TODO_SIMPLEJUMP);

+  /* Only update dominator info when we don't have unreachable blocks.
+     Otherwise we'll update in maybe_tidy_empty_bb.  */
+  if (!maybe_unreachable)
+    {
+      set_immediate_dominator (CDI_DOMINATORS, orig_dest,
+                               recompute_dominator (CDI_DOMINATORS,
orig_dest));
+      set_immediate_dominator (CDI_DOMINATORS, to,
+                               recompute_dominator (CDI_DOMINATORS, to));
+    }
   return recompute_toporder_p;
 }

@@ -6155,6 +6194,10 @@ sel_remove_loop_preheader (void)
                   if (BB_END (prev_bb) == bb_note (prev_bb))
                     free_data_sets (prev_bb);
                 }
+
+              set_immediate_dominator (CDI_DOMINATORS, next_bb,
+                                       recompute_dominator (CDI_DOMINATORS,
+                                                            next_bb));
             }
         }
       VEC_free (basic_block, heap, preheader_blocks);


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43603