[Bug target/60598] New: [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[Bug target/60598] New: [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

            Bug ID: 60598
           Summary: [4.9 Regression] ICE in maybe_record_trace_start, at
                    dwarf2cfi.c:2239
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rguenth at gcc dot gnu.org
            Target: s390x-*-*

Created attachment 32401
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32401&action=edit
testcase

For example building libnettle on s390x (happens for many more packages)
results
in

gcc -I.  -DHAVE_CONFIG_H -fmessage-length=0 -grecord-gcc-switches
-fstack-protector -O2 -Wall -D_FORTIFY_SOURCE=2 -funwind-tables
-fasynchronous-unwind-tables -Wno-coverage-mismatch -g -ggdb3 -Wno-pointer-sign
-Wall -W   -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes  
-Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic  -fpic -c
camellia-set-decrypt-key.c
camellia-set-decrypt-key.c: In function 'nettle_camellia_invert_key':
camellia-set-decrypt-key.c:53:1: internal compiler error: in
maybe_record_trace_start, at dwarf2cfi.c:2239
 }
 ^
libbacktrace could not find executable to open
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://bugs.opensuse.org/> for instructions.

[Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Reproducible with a cross from x86_64 to s390x-linux and

./cc1 -fpreprocessed camellia-set-decrypt-key.i -quiet -march=z196 -mtune=zEC12
-m64 -O2 -fpic
camellia-set-decrypt-key.c: In function ‘nettle_camellia_invert_key’:
camellia-set-decrypt-key.c:53:1: internal compiler error: in
maybe_record_trace_start, at dwarf2cfi.c:2239
0x6cee6e maybe_record_trace_start
        /space/rguenther/src/svn/trunk/gcc/dwarf2cfi.c:2239
0x6cf5b6 scan_trace
        /space/rguenther/src/svn/trunk/gcc/dwarf2cfi.c:2416
0x6cfde6 create_cfi_notes
        /space/rguenther/src/svn/trunk/gcc/dwarf2cfi.c:2570
0x6cfde6 execute_dwarf2_frame
        /space/rguenther/src/svn/trunk/gcc/dwarf2cfi.c:2925
0x6cfde6 execute
        /space/rguenther/src/svn/trunk/gcc/dwarf2cfi.c:3421
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

reducing.
>From gcc-bugs-return-446975-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Mar 20 10:09:16 2014
Return-Path: <gcc-bugs-return-446975-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 24836 invoked by alias); 20 Mar 2014 10:09:15 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 24794 invoked by uid 48); 20 Mar 2014 10:09:08 -0000
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239
Date: Thu, 20 Mar 2014 10:09:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: cf_known_to_work target_milestone
Message-ID: <bug-60598-4-ci06PFm9FW@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-60598-4@http.gcc.gnu.org/bugzilla/>
References: <bug-60598-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-03/txt/msg01844.txt.bz2
Content-length: 1041

http://gcc.gnu.org/bugzilla/show_bug.cgi?id`598

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.8.0
   Target Milestone|---                         |4.9.0

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
typedef unsigned long int uint64_t;
struct camellia_ctx {
    unsigned nkeys;
    uint64_t keys[32];
};
void nettle_camellia_invert_key(struct camellia_ctx *dst,
                                const struct camellia_ctx *src)
{
  unsigned nkeys = src->nkeys;
  unsigned i;
  if (dst == src)
    for (i = 0; i < nkeys - 1 - i; i++)
      {
        uint64_t t_swap = (dst->keys[i]);
        (dst->keys[i]) = (dst->keys[nkeys - 1 - i]);
        (dst->keys[nkeys - 1 - i]) = t_swap;
      }
  else
    {
      dst->nkeys = nkeys;
      for (i = 0; i < nkeys; i++)
        dst->keys[i] = src->keys[nkeys - 1 - i];
    }
}

[Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-03-20
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |krebbel at gcc dot gnu.org,
                   |                            |rth at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly more reduced testcase for -march=z196 -mtune=zEC12 -m64 -O2 -fpic:
struct S { unsigned a, b[32]; };

void
foo (struct S *x, struct S *y)
{
  unsigned a = y->a, i;
  if (x == y)
    for (i = 0; i < a - 1 - i; i++)
      {
        unsigned t = x->b[i];
        x->b[i] = x->b[a - 1 - i];
        x->b[a - 1 - i] = t;
      }
  else
    {
      x->a = a;
      for (i = 0; i < a; i++)
        x->b[i] = y->b[a - 1 - i];
    }
}

Regressed with r208165, seems that the function is shrink-wrapped and the *.ce3
pass incorrectly moves a frame related insn across a conditional jump to a code
label right before the frame related insn, where the conditional jump falls
through into a simple_return.  Having the register save ahead of such
conditional jump means the *.dwarf2 pass sees a path where we reach with saved,
but not restored, register the simple_return and die.
(jump_insn 48 39 156 3 (parallel [
            (set (pc)
                (if_then_else (ne (reg/v:SI 1 %r1 [orig:87 a ] [87])
                        (const_int 1 [0x1]))
                    (label_ref:DI 164)
                    (pc)))
            (set (reg:SI 1 %r1 [orig:89 D.1427 ] [89])
                (plus:SI (reg/v:SI 1 %r1 [orig:87 a ] [87])
                    (const_int -1 [0xffffffffffffffff])))
            (clobber (scratch:SI))
            (clobber (reg:CC 33 %cc))
        ]) pr60598.c:8 619 {doloop_si64}
     (expr_list:REG_UNUSED (reg:CC 33 %cc)
        (int_list:REG_BR_PROB 9697 (nil)))
 -> 164)
(code_label 156 48 151 5 14 "" [1 uses])
(note 151 156 166 5 [bb 5] NOTE_INSN_BASIC_BLOCK)
(jump_insn 166 151 153 5 (simple_return) -1
     (nil)
 -> simple_return)
(barrier 153 166 164)
(code_label 164 153 163 6 15 "" [1 uses])
(note 163 164 147 6 [bb 6] NOTE_INSN_BASIC_BLOCK)
(insn/f 147 163 148 6 (set (reg:DI 16 %f0)
        (reg:DI 11 %r11)) pr60598.c:5 -1
     (expr_list:REG_DEAD (reg:DI 11 %r11)
        (nil)))
(note 148 147 126 6 NOTE_INSN_PROLOGUE_END)
is what we have in the *.peephole2 dump, and the *.ce3 pass moves insn 147 and
148 right before insn 48.

[Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

--- Comment #4 from Richard Henderson <rth at gcc dot gnu.org> ---
Created attachment 32411
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32411&action=edit
proposed patch

This appears to fix the bug.

This code has a distinctly weird look to it.  A doloop insn that doesn't
actually loop is the branch we were trying to reorganize.  If we'd used a
normal compare-and-branch sequence, we'd have been able to use a conditional
return here, avoiding the less than ideal branch-over-branch situation.

But that's clearly a different problem.

[Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

Richard Henderson <rth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #32411|0                           |1
        is obsolete|                            |

--- Comment #5 from Richard Henderson <rth at gcc dot gnu.org> ---
Created attachment 32412
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32412&action=edit
second patch

First patch didn't bootstrap on x86_64, due to using F_R_P on a NOTE.

Second version also doesn't bother checking until after pro/epilogues
created, saving time during ce1 and ce2 passes.

[Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 32413
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32413&action=edit
gcc49-pr60598.patch

I've bootstrapped/regtested this version of the patch (feel free to rewrite the
ChangeLog entry), attaching just to show the testcase added on
{s390,s390x,powerpc,powerpc64}-linux (--enable-checking=yes), no regressions.

[Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

--- Comment #7 from Richard Henderson <rth at gcc dot gnu.org> ---
Author: rth
Date: Fri Mar 21 15:31:25 2014
New Revision: 208749

URL: http://gcc.gnu.org/viewcvs?rev=208749&root=gcc&view=rev
Log:
PR target/60598

    * ifcvt.c (dead_or_predicable): Return FALSE if there are any frame
    related insns after epilogue_completed.
    * gcc.dg/pr60598.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr60598.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ifcvt.c
    trunk/gcc/testsuite/ChangeLog

[Bug target/60598] [4.9 Regression] ICE in maybe_record_trace_start, at dwarf2cfi.c:2239

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60598

Richard Henderson <rth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Richard Henderson <rth at gcc dot gnu.org> ---
Fixed.