[Bug rtl-optimization/51505] New: [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[Bug rtl-optimization/51505] New: [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

             Bug #: 51505
           Summary: [4.5/4.6/4.7 Regression] ICE: in form_sum, at
                    reload.c:5349 with -O --param max-cse-insns=1
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 26050
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26050
reduced testcase

Compiler output:
$ gcc -O --param max-cse-insns=1 testcase.c
testcase.c: In function 'foo':
testcase.c:16:1: internal compiler error: in form_sum, at reload.c:5345
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

(gdb) list
5340    form_sum (enum machine_mode mode, rtx x, rtx y)
5341    {
5342      rtx tem;
5343
5344      gcc_assert (GET_MODE (x) == mode || GET_MODE (x) == VOIDmode);
5345      gcc_assert (GET_MODE (y) == mode || GET_MODE (y) == VOIDmode);
5346
5347      if (CONST_INT_P (x))
5348        return plus_constant (y, INTVAL (x));
5349      else if (CONST_INT_P (y))
(gdb) bt
#0  fancy_abort (file=0x12886d0 "/mnt/svn/gcc-trunk/gcc/reload.c", line=5345,
function=0x1289340 "form_sum")
    at /mnt/svn/gcc-trunk/gcc/diagnostic.c:898
#1  0x0000000000942b5e in form_sum (mode=DImode, x=<value optimized out>,
y=<value optimized out>) at /mnt/svn/gcc-trunk/gcc/reload.c:5345
#2  0x000000000095a94e in eliminate_regs_1 (x=0x7ffff569ae70, mem_mode=QImode,
insn=0x7ffff569ade0, may_use_invariant=Unhandled dwarf expression opcode 0xf3
)
    at /mnt/svn/gcc-trunk/gcc/reload1.c:2685
#3  0x000000000095a898 in eliminate_regs_1 (x=0x7ffff569ae58, mem_mode=QImode,
insn=0x7ffff569ade0, may_use_invariant=Unhandled dwarf expression opcode 0xf3
)
    at /mnt/svn/gcc-trunk/gcc/reload1.c:2663
#4  0x000000000095ac85 in eliminate_regs_1 (x=0x7ffff569ae40,
mem_mode=VOIDmode, insn=0x7ffff569ade0, may_use_invariant=Unhandled dwarf
expression opcode 0xf3
)
    at /mnt/svn/gcc-trunk/gcc/reload1.c:2886
#5  0x000000000095aab2 in eliminate_regs_1 (x=0x7ffff569ae28,
mem_mode=VOIDmode, insn=0x7ffff569ade0, may_use_invariant=Unhandled dwarf
expression opcode 0xf3
)
    at /mnt/svn/gcc-trunk/gcc/reload1.c:2743
#6  0x000000000095b2da in eliminate_regs_1 (x=0x7ffff569ae10,
mem_mode=VOIDmode, insn=0x7ffff569ade0, may_use_invariant=Unhandled dwarf
expression opcode 0xf3
)
    at /mnt/svn/gcc-trunk/gcc/reload1.c:2755
#7  0x000000000095b1e3 in eliminate_regs_1 (x=0x7ffff569adf8,
mem_mode=VOIDmode, insn=0x7ffff569ade0, may_use_invariant=Unhandled dwarf
expression opcode 0xf3
)
    at /mnt/svn/gcc-trunk/gcc/reload1.c:2780
#8  0x000000000095b1e3 in eliminate_regs_1 (x=0x7ffff569ade0,
mem_mode=VOIDmode, insn=0x7ffff569ade0, may_use_invariant=Unhandled dwarf
expression opcode 0xf3
)
    at /mnt/svn/gcc-trunk/gcc/reload1.c:2780
#9  0x0000000000966965 in eliminate_regs_in_insn (insn=0x7ffff555bdc8,
replace=0) at /mnt/svn/gcc-trunk/gcc/reload1.c:3623
#10 0x0000000000967ddd in calculate_needs_all_insns (global=1) at
/mnt/svn/gcc-trunk/gcc/reload1.c:1523
#11 0x0000000000968c85 in reload (first=0x7ffff5693340, global=1) at
/mnt/svn/gcc-trunk/gcc/reload1.c:945
#12 0x000000000087c670 in ira () at /mnt/svn/gcc-trunk/gcc/ira.c:3725
#13 rest_of_handle_ira () at /mnt/svn/gcc-trunk/gcc/ira.c:3798
#14 0x00000000008f8ac5 in execute_one_pass (pass=0x17be800) at
/mnt/svn/gcc-trunk/gcc/passes.c:2079
#15 0x00000000008f8e65 in execute_pass_list (pass=0x17be800) at
/mnt/svn/gcc-trunk/gcc/passes.c:2134
#16 0x00000000008f8e77 in execute_pass_list (pass=0x17beee0) at
/mnt/svn/gcc-trunk/gcc/passes.c:2135
#17 0x0000000000a5a5ee in tree_rest_of_compilation (fndecl=0x7ffff5672c00) at
/mnt/svn/gcc-trunk/gcc/tree-optimize.c:421
#18 0x00000000006ad84a in cgraph_expand_function (node=0x7ffff55636c0) at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1818
#19 0x00000000006af5ec in cgraph_expand_all_functions () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1885
#20 cgraph_optimize () at /mnt/svn/gcc-trunk/gcc/cgraphunit.c:2198
#21 0x00000000006afd5a in cgraph_finalize_compilation_unit () at
/mnt/svn/gcc-trunk/gcc/cgraphunit.c:1327
#22 0x000000000058d620 in c_write_global_declarations () at
/mnt/svn/gcc-trunk/gcc/c-decl.c:10026
#23 0x00000000009edc94 in compile_file (argc=15, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:573
#24 do_compile (argc=15, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:1928
#25 toplev_main (argc=15, argv=0x7fffffffdad8) at
/mnt/svn/gcc-trunk/gcc/toplev.c:2004
#26 0x00007ffff61570ed in __libc_start_main () from /lib64/libc.so.6
#27 0x0000000000570df1 in _start ()


The testcase was reduced from gcc.target/i386/sse2-pandn-1.c, which needs more
flags:
$ gcc -O -fno-tree-loop-optimize -funroll-loops --param=max-cse-insns=1
gcc.target/i386/sse2-pandn-1.c
In file included from gcc.target/i386/sse2-pandn-1.c:13:0:
gcc.target/i386/sse2-check.h: In function 'do_test':
gcc.target/i386/sse2-check.h:13:1: internal compiler error: in form_sum, at
reload.c:5345
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Tested revisions:
r182206 - crash
4.6 r180325 - crash
4.5 r180325 - crash
4.4 r180325 - OK

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ra
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011-12-12
   Target Milestone|---                         |4.5.4
     Ever Confirmed|0                           |1

--- Comment #1 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-12-12 10:04:25 UTC ---
--param max-cse-insns=4 still ICEs, --param max-cse-insns=5 works, so probably
a genuine reload bug.

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ebotcazou at gcc dot
                   |                            |gnu.org, jakub at gcc dot
                   |                            |gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-12-13 08:29:00 UTC ---
Reload is innocent here.
IMHO the problem is that we have a REG_EQUAL note that refers to dead pseudos,
perhaps DF should just remove such notes?  Or it might be combiner fault.
Before combine we have:
(insn 30 2 5 2 (set (reg/v:QI 59 [ i ])
        (const_int 0 [0])) pr51505.c:14 -1
     (nil))

(insn 5 30 6 2 (set (reg:SI 60 [ D.1713 ])
        (sign_extend:SI (reg/v:QI 59 [ i ]))) pr51505.c:14 130 {extendqisi2}
     (expr_list:REG_DEAD (reg/v:QI 59 [ i ])
        (nil)))
...
(insn 10 9 11 2 (set (reg:DI 70 [ D.1713 ])
        (sign_extend:DI (reg:SI 60 [ D.1713 ]))) pr51505.c:14 124
{*extendsidi2_rex64}
     (expr_list:REG_DEAD (reg:SI 60 [ D.1713 ])
        (nil)))

(insn 11 10 12 2 (parallel [
            (set (reg:QI 71)
                (and:QI (reg:QI 68)
                    (mem/s/j:QI (plus:DI (plus:DI (reg/f:DI 20 frame)
                                (reg:DI 70 [ D.1713 ]))
                            (const_int -768 [0xfffffffffffffd00])) [0 s2.a S1
A8])))
            (clobber (reg:CC 17 flags))
        ]) pr51505.c:14 383 {*andqi_1}
     (expr_list:REG_DEAD (reg:DI 70 [ D.1713 ])
        (expr_list:REG_DEAD (reg:QI 68)
            (expr_list:REG_UNUSED (reg:CC 17 flags)
                (nil)))))

(insn 12 11 13 2 (set (mem/s/j:QI (plus:DI (plus:DI (reg/f:DI 20 frame)
                    (reg:DI 66 [ D.1713 ]))
                (const_int -1024 [0xfffffffffffffc00])) [0 e S1 A8])
        (reg:QI 71)) pr51505.c:14 66 {*movqi_internal}
     (expr_list:REG_DEAD (reg:QI 71)
        (expr_list:REG_DEAD (reg:DI 66 [ D.1713 ])
            (expr_list:REG_EQUAL (and:QI (reg:QI 68)
                    (mem/s/j:QI (plus:DI (plus:DI (reg/f:DI 20 frame)
                                (reg:DI 70 [ D.1713 ]))
                            (const_int -768 [0xfffffffffffffd00])) [0 s2.a S1
A8]))
                (nil)))))

Note REG_DEAD before insn 12 which uses pseudo 70 in its REG_EQUAL note.
Then during combine we decide to change mode of pseudo 70 from DImode to QImode
and just change it, thinking we've adjusted all places where it was used, but
in fact we adjust the content of the REG_EQUAL note to (and:QI (reg:QI 68)
(mem:QI (plus:DI (plus:DI (reg:DI 20) (reg:QI 70)) (const_int -768)))).
And of course, as this is not valid RTL, when reload attempts to use the
REG_EQUAL note it ICEs.  Now the combiner changing of pseudo 70 happens I think
when i3 is insn 12, i2 is insn 11 and i1 is insn 10, so in theory the combiner
should be able to do the adjustment of the REG_EQUAL note in there too, but I
wonder if similar mode transformation couldn't happen also when just working on
i3 where the pseudo is dead and some insns that feed it, with the REG_EQUAL
note being in some subsequent insns - then I doubt it would be able to do that.

Eric, what do you think about this?

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bonzini at gnu dot org

--- Comment #3 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2011-12-13 11:02:32 UTC ---
> IMHO the problem is that we have a REG_EQUAL note that refers to dead pseudos,
> perhaps DF should just remove such notes? 

I'd think so.  When DF adds REG_DEAD/REG_UNUSED notes, it knowingly ignores
REG_EQUAL/REG_EQUIV notes (even if you do df_set_flags (DF_EQ_NOTES) before
df_note_add_problem).  That's a reasonable choice, but then it should remove
the latter notes that have become invalid because of the former.

Paolo, would this be easily doable?

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[bonzini at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #4 from Paolo Bonzini <bonzini at gnu dot org> 2011-12-13 19:34:25 UTC ---
No, it should be easy.  Just look at the EQ_USES in df_kill_notes and, if one
EQ_USE refers to a dead pseudo, kill the REG_EQUAL or REG_EQUIV note.

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #5 from Andrey Belevantsev <abel at gcc dot gnu.org> 2012-01-17 16:05:26 UTC ---
Created attachment 26353
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26353
untested patch

I've tried to implement what Paolo suggests, the attached patch bootstraps but
otherwise untested.  The code is somewhat ugly as we need to purge all
registers reffered to from the note we delete also from EQ_USES list (or we get
verification errors).  I've never tried to dig deeply in DF core so sorry if
the patch is completely in the wrong direction.

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[bonzini at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #6 from Paolo Bonzini <bonzini at gnu dot org> 2012-01-17 16:22:08 UTC ---
Yeah, perhaps you can make the code nicer by avoiding the nested loops:

        for (use_rec = DF_INSN_EQ_USES (insn); *use_rec; use_rec++)
          {
        df_ref use = *use_rec;
        if (DF_REF_REGNO (use) > FIRST_PSEUDO_REGISTER
            && (DF_REF_FLAGS (use) & DF_REF_IN_NOTE)
            && !bitmap_bit_p (live, DF_REF_REGNO (use))
            && DF_REF_LOC (use)
            && loc_mentioned_in_p (DF_REF_LOC (use), XEXP (link, 0)))
                  {
                    delete = true;
                    break;
                  }
              }
            if (!delete)
              ...
        for (use_rec = DF_INSN_EQ_USES (insn); *use_rec; use_rec++)
          if ((DF_REF_FLAGS (*use_rec) & DF_REF_IN_NOTE)
          && DF_REF_LOC (*use_rec)
          && loc_mentioned_in_p (DF_REF_LOC (*use_rec),
                     XEXP (link, 0)))
        VEC_safe_push (df_ref, heap, refs, *use_rec);
        FOR_EACH_VEC_ELT (df_ref, refs, i, use)
          df_ref_remove (use);
        VEC_free (df_ref, heap, refs);
        free_EXPR_LIST_node (link);
        *pprev = link = next;

Using a heap-allocated VEC is also a bit heavy, perhaps it's cheaper to
allocate on the stack a vector with room for all EQ_USES.  In fact, there can
be only one REG_EQUAL/REG_EQUIV note, so all EQ_USES should be killed, no?  Are
the loc_mentioned_in_p tests redundant?

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Andrey Belevantsev <abel at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #26353|0                           |1
        is obsolete|                            |

--- Comment #7 from Andrey Belevantsev <abel at gcc dot gnu.org> 2012-01-18 07:45:42 UTC ---
Created attachment 26359
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26359
Updated patch

How about this version then?  We need to count the number of EQ_USES to
allocate the temp vector on stack.  Unless we want a helper that would utilize
the knowledge of how df_ref_remove works.  

Is it fine that we mark bb as dirty as a result of calling df_ref_remove in the
middle of note computation?

Note also that for the testcase we find that register 68 is dead (which is
true) and that is the reason for note removal, not that register 70 is dead.

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[bonzini at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #8 from Paolo Bonzini <bonzini at gnu dot org> 2012-01-18 08:58:33 UTC ---
I think you can just kill the note and call df_notes_rescan, can't you?  (Sorry
for leaving this implicit in comment 4 and then forgetting about it yesterday).

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #9 from Andrey Belevantsev <abel at gcc dot gnu.org> 2012-01-18 09:46:41 UTC ---
This seems like an overkill as we only need to remove a single vector.  The
below helper looks enough:

+/* Remove the EQ_USES vector for INSN assuming it exists.  */
+void
+df_ref_remove_eq_uses (rtx insn)
+{
+  struct df_insn_info *insn_info = DF_INSN_UID_GET (INSN_UID (insn));
+  df_mw_hardreg_chain_delete_eq_uses (insn_info);
+  df_ref_chain_delete (insn_info->eq_uses);
+  insn_info->eq_uses = df_null_ref_rec;
+}
+

The patch then just calls this after killing a note.

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[bonzini at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #10 from Paolo Bonzini <bonzini at gnu dot org> 2012-01-18 10:58:19 UTC ---
Not using df_notes_rescan looks like premature optimization to me...

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #11 from Andrey Belevantsev <abel at gcc dot gnu.org> 2012-01-18 12:02:36 UTC ---
No problem -- I will go back to df_notes_rescan and repost to gcc-patches.

[Bug rtl-optimization/51505] [4.5/4.6/4.7 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[abel at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

--- Comment #12 from Andrey Belevantsev <abel at gcc dot gnu.org> 2012-01-19 07:29:25 UTC ---
Author: abel
Date: Thu Jan 19 07:29:18 2012
New Revision: 183296

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=183296
Log:
gcc/:
2012-01-19 Andrey Belevantsev <abel@ispras.ru>

    PR rtl-optimization/51505
    * df-problems.c (df_kill_notes): New parameter live. Update comment.
    Remove REG_EQUAL/REG_EQUIV notes referring to dead registers.
    (df_note_bb_compute): Update the call to df_kill_notes.

testsuite/:
2012-01-19 Andrey Belevantsev <abel@ispras.ru>

    PR rtl-optimization/51505
    * gcc.dg/pr51505.c: New test. 

Added:
    trunk/gcc/testsuite/gcc.dg/pr51505.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/df-problems.c
    trunk/gcc/testsuite/ChangeLog

[Bug rtl-optimization/51505] [4.5/4.6 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.7.0
            Summary|[4.5/4.6/4.7 Regression]    |[4.5/4.6 Regression] ICE:
                   |ICE: in form_sum, at        |in form_sum, at
                   |reload.c:5349 with -O       |reload.c:5349 with -O
                   |--param max-cse-insns=1     |--param max-cse-insns=1
      Known to fail|4.7.0                       |

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-01-19 08:49:22 UTC ---
Fixed on the trunk so far, thanks.

[Bug rtl-optimization/51505] [4.5/4.6 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.5.4                       |4.6.4

--- Comment #14 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-02 11:00:21 UTC ---
The 4.5 branch is being closed, adjusting target milestone.

[Bug rtl-optimization/51505] [4.6 Regression] ICE: in form_sum, at reload.c:5349 with -O --param max-cse-insns=1

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51505

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|4.6.4                       |4.7.0

--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-12 16:17:27 UTC ---
The 4.6 branch has been closed, fixed in GCC 4.7.0.