[Bug rtl-optimization/61572] New: [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[Bug rtl-optimization/61572] New: [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

            Bug ID: 61572
           Summary: [4.10 Regression] ICE: in assign_by_spills, at
                    lra-assigns.c:1335
           Product: gcc
           Version: 4.10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org

Happens while building the Linux kernel:

markus@x4 linux-3.15 % cat test.i
struct autofs_sb_info
{
  int exp_timeout;
};
void *f;
int g;
int fn1 (struct autofs_sb_info *p1)
{
  int a, b;
  a = (
      {
        register __typeof__(0) c asm("rdx");
        b = c;
        int d;
        __typeof__(0) e;
        e = p1->exp_timeout / 1000;
        switch (0)
        default:
        asm("" : "=a"(d) : "0"(e), ""(0));
        d;
      });
  if (a)
    return 1;
  if (b)
    p1->exp_timeout = 0;
  return 0;
}

int fn2 ()
{
  struct autofs_sb_info *h = f;
  switch (g)
    {
    case 0 ?:
      0 : return fn1 (h);
    default:
      return 0;
    }
}

markus@x4 linux-3.15 % gcc -c -O2 root.i
fs/autofs4/root.c: In function ‘autofs4_root_ioctl_unlocked.isra.14’:
fs/autofs4/root.c:874:1: internal compiler error: in assign_by_spills, at
lra-assigns.c:1335
 }
 ^
0x8aa979 assign_by_spills
        ../../gcc/gcc/lra-assigns.c:1335
0x8ab2f3 lra_assign()
        ../../gcc/gcc/lra-assigns.c:1500
0x8a707b lra(_IO_FILE*)
        ../../gcc/gcc/lra.c:2230
0x8670c6 do_reload
        ../../gcc/gcc/ira.c:5325
0x8670c6 execute
        ../../gcc/gcc/ira.c:5486
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
>From gcc-bugs-return-454585-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Jun 20 07:47:53 2014
Return-Path: <gcc-bugs-return-454585-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 30922 invoked by alias); 20 Jun 2014 07:47:53 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 30884 invoked by uid 48); 20 Jun 2014 07:47:50 -0000
From: "xinliangli at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/61571] bad aliasing --> wrong FRE
Date: Fri, 20 Jun 2014 07:47:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: xinliangli at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-61571-4-Kf1oBNITEc@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61571-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61571-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-06/txt/msg01667.txt.bz2
Content-length: 447

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida571

davidxl <xinliangli at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |richard.guenther at gmail dot com

--- Comment #2 from davidxl <xinliangli at gmail dot com> ---
The issue exists in trunk and as early as 4.7 (that i have tested).

[Bug rtl-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-06-20
                 CC|                            |rguenth at gcc dot gnu.org
      Known to work|                            |4.8.3, 4.9.0
   Target Milestone|---                         |4.10.0
     Ever confirmed|0                           |1
      Known to fail|                            |4.10.0

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Started with r211770.

[Bug rtl-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ra
             Target|                            |x86_64-*-*
                 CC|                            |vmakarov at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Probably a latent issue.

[Bug rtl-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[vmakarov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #3 from Vladimir Makarov <vmakarov at gcc dot gnu.org> ---
When LRA processes insn 17 in BB3 it creates a reload pseudo 101 of DREG class

         Choosing alt 0 in insn 17:  (0) =d  (1) %a  (2) rm  (3) =1
{*smulsi3_highpart_1}
      Creating newreg=101 from oldreg=93, assigning class DREG to r101
      Creating newreg=102 from oldreg=100, assigning class AREG to r102
   17: {r101:SI=trunc(sign_extend(r102:SI)*sign_extend(r94:SI) 0>>0x20);clobber
r102:SI;clobber flags:CC;}
      REG_UNUSED r100:SI
      REG_DEAD r94:SI
      REG_UNUSED flags:CC
      REG_EQUAL trunc(sign_extend(r92:SI)*0x10624dd3 0>>0x20)
    Inserting insn reload before:
   63: r102:SI=r92:SI
    Inserting insn reload after:
   62: r93:SI=r101:SI

but LRA can not to assign dx to pseudo 101 as it already lives through BB 3.

Dump from IRA or passes before it shows:

BB2:
;;  entry block defs     0 [ax] 1 [dx] 2 [cx] 4 [si] 5 [di] 6 [bp] 7 [sp] 16
[argp] 20 [frame] 21 [xmm0] 22 [xmm1] 23 [xmm2] 24 [xmm3] 25 [xmm4] 26 [xmm5]
27 [xmm6] 28 [xmm7] 37 [r8] 38 [\
r9]

;; lr  out       1 [dx] 6 [bp] 7 [sp] 16 [argp] 20 [frame] 83

BB3:
;; lr  in        1 [dx] 6 [bp] 7 [sp] 16 [argp] 20 [frame] 83
;; lr  out       1 [dx] 6 [bp] 7 [sp] 16 [argp] 20 [frame] 83 84

DX lives everywhere.  This info is calculated by DF-infrastructure.

So I think that maintainers of DF-infrastructure should work on this PR from
now on.

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #5)
> The question of course is why rdx is live from function entry to its first
> use.
> My patch will only continue to paper over this issue.

Because of

/* Set the bit for regs that are considered being defined at the entry. */

static void
df_get_entry_block_def_set (bitmap entry_block_defs)
{
  rtx r;
  int i;

  bitmap_clear (entry_block_defs);

  for (i = 0; i < FIRST_PSEUDO_REGISTER; i++)
    {
      if (global_regs[i])
        bitmap_set_bit (entry_block_defs, i);
      if (FUNCTION_ARG_REGNO_P (i))
        bitmap_set_bit (entry_block_defs, INCOMING_REGNO (i));
    }

dx is FUNCTION_ARG_REGNO_P.

I wonder if we can do less conservative here ...

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
I also note that the testcase no longer does what it tries to do after
fn1 is inlined.  It seems to try making rdx available for the asm by
loading p1 into b.  But after inlining completed rdx will contain garbage.

So very likely the kernel is miscompiled.  [and I don't think it's well-defined
to consider rdx unchanged from function entry to the load via c]

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Btw, can't find the source of that asm in autofs4 souce - can you provide
preprocessed source of the original testcase?

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #9 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Created attachment 32995
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=32995&action=edit
unreduced testcase

(In reply to Richard Biener from comment #8)
> Btw, can't find the source of that asm in autofs4 souce - can you provide
> preprocessed source of the original testcase?

Sure.

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
static inline __attribute__((no_instrument_function)) int
autofs4_compat_get_set_timeout(struct autofs_sb_info *sbi,
      compat_ulong_t *p)
{
 int rv;
 unsigned long ntimeout;

 if ((rv = ({ int __ret_gu; register
__typeof__(__builtin_choose_expr(sizeof(*(p)) > sizeof(0UL), 0ULL, 0UL))
__val_gu asm("%""rdx"); (void)0; might_fault(); asm volatile("call
__get_user_%P3" : "=a" (__ret_gu), "=r" (__val_gu) : "0" (p), "i"
(sizeof(*(p)))); (ntimeout) = (__typeof__(*(p))) __val_gu; __ret_gu; }))

ok, so the register variable is used to get at the return value of __get_user.

I wonder why that's not using proper constraints instead ...

Probably macro-expansion of GET_USER.

Creepy.

#define get_user(x, ptr)                        \
({                                    \
    int __ret_gu;                            \
    register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX);        \
    __chk_user_ptr(ptr);                        \
    might_fault();                            \
    asm volatile("call __get_user_%P3"                \
             : "=a" (__ret_gu), "=r" (__val_gu)            \
             : "0" (ptr), "i" (sizeof(*(ptr))));        \
    (x) = (__typeof__(*(ptr))) __val_gu;                \
    __ret_gu;                            \
})

Probably because this uses "proper" registers dependent on the size of *ptr
which may end up using a %ecx:%edx register pair.

What a hack to not use a compile-time conditional on sizeof (*ptr).

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #11 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
See comment in arch/x86/include/asm/uaccess.h:144.

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Tue Jun 24 10:35:30 2014
New Revision: 211933

URL: https://gcc.gnu.org/viewcvs?rev=211933&root=gcc&view=rev
Log:
2014-06-24  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/61572
    * tree-ssa-sink.c (statement_sink_location): Do not sink
    loads from hard registers.

    * gcc.target/i386/pr61572.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.target/i386/pr61572.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-sink.c

[Bug tree-optimization/61572] [4.10 Regression] ICE: in assign_by_spills, at lra-assigns.c:1335

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61572

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #13 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.