[Bug target/61058] [4.7/4.8/4.9/4.10 Regression] ICE: RTL check: expected elt 3 type 'B', have '0' (rtx barrier) in distance_agu_use_in_bb, at config/i386/i386.c:16740 with __builtin_unreachable()

["ubizjak at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=61058

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at redhat dot com

--- Comment #2 from Uroš Bizjak <ubizjak at gmail dot com> ---
(In reply to Uroš Bizjak from comment #1)
> Similar to PR54455, where Steven said:
> 
> --q--
> There can't be a BARRIER in the middle of a basic block. This problem
> typically indicates that either a BARRIER was emitted in the wrong place, or
> BB_END wasn't updated properly after a BARRIER was inserted somewhere.
> BARRIERs never appear inside a basic block.
> --/q--
> 
> The target ICEs due to invalid BARRIER location, so it looks like
> rtl-optimization bug to me.

CC Jeff for confirmation.
>From gcc-bugs-return-450610-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon May 05 19:23:32 2014
Return-Path: <gcc-bugs-return-450610-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 2596 invoked by alias); 5 May 2014 19:23:32 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 2554 invoked by uid 48); 5 May 2014 19:23:29 -0000
From: "law at redhat dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug rtl-optimization/61047] [4.9/4.10 Regression] wrong code at -O1 on x86_64-linux
Date: Mon, 05 May 2014 19:23:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: rtl-optimization
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: law at redhat dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.1
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-61047-4-IRSj1M3Atz@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61047-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61047-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-05/txt/msg00302.txt.bz2
Content-length: 1940

http://gcc.gnu.org/bugzilla/show_bug.cgi?ida047

Jeffrey A. Law <law at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at redhat dot com

--- Comment #2 from Jeffrey A. Law <law at redhat dot com> ---

Prior to .ce3 we have:

(code_label 46 20 22 4 6 "" [1 uses])
(note 22 46 24 4 [bb 4] NOTE_INSN_BASIC_BLOCK)
(insn 24 22 25 4 (set (reg:CCZ 17 flags)
        (compare:CCZ (reg:HI 0 ax [orig:97 ivtmp.14 ] [97])
            (const_int 2837 [0xb15]))) j.c:12 6 {*cmphi_1}
     (nil))
(jump_insn 25 24 26 4 (set (pc)
        (if_then_else (ne (reg:CCZ 17 flags)
                (const_int 0 [0]))
            (label_ref 31)
            (pc))) j.c:12 596 {*jcc_1}
     (expr_list:REG_DEAD (reg:CCZ 17 flags)
        (int_list:REG_BR_PROB 7200 (nil)))
 -> 31)
;;  succ:       5 [28.0%]  (FALLTHRU)
;;              6 [72.0%]
;; lr  out       0 [ax] 1 [dx] 4 [si] 7 [sp]

;; basic block 5, loop depth 0, count 0, freq 1008, maybe hot
;;  prev block 4, next block 6, flags: (REACHABLE, RTL, MODIFIED)
;;  pred:       4 [28.0%]  (FALLTHRU)
;; bb 5 artificial_defs: { }
;; bb 5 artificial_uses: { u-1(7){ }}
;; lr  in        0 [ax] 1 [dx] 4 [si] 7 [sp]
;; lr  use       7 [sp]
;; lr  def       2 [cx]
(note 26 25 28 5 [bb 5] NOTE_INSN_BASIC_BLOCK)
(insn 28 26 73 5 (set (reg:SI 2 cx [orig:90 D.1786 ] [90])
        (mem/c:SI (plus:DI (reg/f:DI 7 sp)
                (const_int 11324 [0x2c3c])) [0  S4 A32])) j.c:13 90
{*movsi_internal}
     (nil))
(jump_insn 73 28 74 5 (set (pc)
        (label_ref 43)) 636 {jump}
     (nil)
 -> 43)

Note how the load at insn 28 is guarded by comparing ax against #2837.  CE3
transforms that into an unconditional load and we blow up reading the
out-of-range stack slot.

This isn't a threading issue, but a latent bug in CE as far as I can tell.