[Bug target/94740] New: ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[Bug target/94740] New: ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[acsawdey at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

            Bug ID: 94740
           Summary: ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future
                    -mpcrel -O1
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acsawdey at gcc dot gnu.org
  Target Milestone: ---

Compiler is trunk 3bcdb5dec72b6d7b197821c2b814bc9fc07f4628 on ppc64le power9
host.

~/work/gcc/trunk/build/gcc/xgcc -B/home2/sawdey/work/gcc/trunk/build/gcc
/home2/sawdey/work/gcc/trunk/gcc/gcc/testsuite/gcc.dg/sso/t5.c -mcpu=future
-mpcrel -O1 -lm -o ./t5.exe
during RTL pass: reload
/home2/sawdey/work/gcc/trunk/gcc/gcc/testsuite/gcc.dg/sso/t5.c: In function
‘main’:
/home2/sawdey/work/gcc/trunk/gcc/gcc/testsuite/gcc.dg/sso/t5.c:73:1: internal
compiler error: in set_address_disp, at rtlanal.c:6254
   73 | }
      | ^
0x10a50ca3 set_address_disp
        ../../gcc/gcc/rtlanal.c:6254
0x10a50ca3 set_address_disp
        ../../gcc/gcc/rtlanal.c:6252
0x10a50ca3 decompose_automod_address
        ../../gcc/gcc/rtlanal.c:6297
0x10a50ca3 decompose_address(address_info*, rtx_def**, machine_mode, unsigned
char, rtx_code)
        ../../gcc/gcc/rtlanal.c:6457
0x10887973 process_address_1
        ../../gcc/gcc/lra-constraints.c:3367
0x10889b9b process_address
        ../../gcc/gcc/lra-constraints.c:3641
0x10889b9b curr_insn_transform
        ../../gcc/gcc/lra-constraints.c:3956
0x1088f95f lra_constraints(bool)
        ../../gcc/gcc/lra-constraints.c:5029
0x1087119f lra(_IO_FILE*)
        ../../gcc/gcc/lra.c:2440
0x10810b9b do_reload
        ../../gcc/gcc/ira.c:5523
0x10810b9b execute
        ../../gcc/gcc/ira.c:5709
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug target/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[acsawdey at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

--- Comment #1 from acsawdey at gcc dot gnu.org ---
Reduced test case:



struct __attribute__((scalar_storage_order("big-endian"))) {
  int a;
  int b[];
} c;
int d;
int e() { d = c.b[0]; }

[Bug target/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

Peter Bergner <bergner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-04-24

--- Comment #2 from Peter Bergner <bergner at gcc dot gnu.org> ---
Confirmed.  I'll have a quick look.

[Bug target/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

--- Comment #3 from Peter Bergner <bergner at gcc dot gnu.org> ---
Here's a simpler test case that fails the same way:

int array[8];
int
foo (void)
{
  return __builtin_bswap32 (array[1]);
}

So before CSE, we have:

(insn 5 2 6 2 (set (reg/f:DI 121)
                   (symbol_ref:DI ("*.LANCHOR0") [flags 0x182]))
{*pcrel_local_addr})
(insn 6 5 7 2 (set (reg:DI 123)
                   (const_int 4 [0x4])) {*movdi_internal64})
(insn 7 6 8 2 (set (reg:SI 122)
                   (bswap:SI (mem/c:SI (plus:DI (reg/f:DI 121)
                                                (reg:DI 123)))))
{bswapsi2_load}
     (expr_list:REG_EQUAL (bswap:SI (mem/c:SI (plus:DI (reg/f:DI 121)
                    (const_int 4 [0x4]))))))
...

After CSE, we then have all the way up to LRA:
(insn 7 9 14 2 (set (reg:SI 122)
                    (bswap:SI (mem/c:SI (plus:DI (symbol_ref:DI ("*.LANCHOR0")
[flags 0x182])
                    (const_int 4))))) {bswapsi2_load})
...

LRA then calls decompse_address with the above address, which causes us to go
sideways.  Not sure why yet.  Maybe our bswap2_load pattern needs help?

[Bug target/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

--- Comment #4 from Peter Bergner <bergner at gcc dot gnu.org> ---
Removing the bswap and recompiling, the non-bswap load pattern has no problem
accepting an address like that, so this looks like a target issue with that
pattern.

[Bug rtl-optimization/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

Peter Bergner <bergner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |segher at gcc dot gnu.org
          Component|target                      |rtl-optimization

--- Comment #5 from Peter Bergner <bergner at gcc dot gnu.org> ---
Looking into this more, it seems the problem is that CSE creates a constant
address and does not wrap it with a (const: ...).  If the constant address does
have a (const: ) wrapper, then decompose_address handles this just fine.  I can
modify the test case such that combine can combine our bswap load with a
following insn and combine will call simplify_binary_operation on the address
and it will create the (const: ) for us.  CSE should probably do the same when
it creates a constant address.

The following patch fixes the ICE for me.  I'll run it through bootstrap and
regtesting.

diff --git a/gcc/cse.c b/gcc/cse.c
index 5aaba8d80e0..870e2a21dbd 100644
--- a/gcc/cse.c
+++ b/gcc/cse.c
@@ -6328,6 +6328,14 @@ cse_process_notes (rtx x, rtx object, bool *changed)
   rtx new_rtx = cse_process_notes_1 (x, object, changed);
   if (new_rtx != x)
     *changed = true;
+  if (*changed && object != NULL_RTX && MEM_P (object))
+    {
+      /* Call simplify_rtx on the updated address in case it is now
+        a constant and needs to be wrapped with a (const: ...).  */
+      rtx simplified_rtx = simplify_rtx (new_rtx);
+      if (simplified_rtx)
+       new_rtx = simplified_rtx;
+    }
   return new_rtx;
 }

[Bug rtl-optimization/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

--- Comment #6 from Segher Boessenkool <segher at gcc dot gnu.org> ---
It is of course good to wrap things with CONST whenever possible, but it
isn't documented anywhere (afaics) that this would be required, so this
is a workaround, not a fix?

[Bug rtl-optimization/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

Peter Bergner <bergner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2020-April/5
                   |                            |44894.html

--- Comment #7 from Peter Bergner <bergner at gcc dot gnu.org> ---
Richard has a much better patch which we're both testing.

[Bug rtl-optimization/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:66ec22b0d3feb96049283abe5c6c9a05ecef8b86

commit r11-4-g66ec22b0d3feb96049283abe5c6c9a05ecef8b86
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Thu Apr 30 20:00:52 2020 +0100

    cse: Use simplify_replace_fn_rtx to process notes [PR94740]

    cse_process_notes did a very simple substitution, which in the wrong
    circumstances could create non-canonical RTL and invalid MEMs.
    Various sticking plasters have been applied to cse_process_notes_1
    to handle cases like ZERO_EXTEND, SIGN_EXTEND and UNSIGNED_FLOAT,
    but I think this PR is a plaster too far.

    The code is trying hard to avoid creating unnecessary rtl, which of
    course is a good thing.  If we continue to do that, then we can end
    up changing subexpressions while keeping the containing rtx.
    This in turn means that validate_change will be a no-op on the
    containing rtx, even if its contents have changed.  So in these
    cases we have to apply validate_change to the individual subexpressions.

    On the other hand, if we always apply validate_change to the
    individual subexpressions, we'll end up calling validate_change
    on something before it has been simplified and canonicalised.
    And that's one of the situations we're trying to avoid.

    There might be a middle ground in which we queue the validate_changes
    as part of a group, and so can cancel the pending validate_changes
    for subexpressions if there's a change in the outer expression.
    But that seems even more ad-hoc than the current code.
    It would also be quite an invasive change.

    I think the best thing is just to hook into the existing
    simplify_replace_fn_rtx function, keeping the REG and MEM handling
    from cse_process_notes_1 essentially unchanged.  It can generate
    more redundant rtl when a simplification takes place, but it has
    the advantage of being relative well-used code (both directly
    and via simplify_replace_rtx).

    2020-04-30  Richard Sandiford  <richard.sandiford@arm.com>

    gcc/
            PR rtl-optimization/94740
            * cse.c (cse_process_notes_1): Replace with...
            (cse_process_note_1): ...this new function, acting as a
            simplify_replace_fn_rtx callback to process_note.  Handle only
            REGs and MEMs directly.  Validate the MEM if cse_process_note
            changes its address.
            (cse_process_notes): Replace with...
            (cse_process_note): ...this new function.
            (cse_extended_basic_block): Update accordingly, iterating over
            the register notes and passing individual notes to
cse_process_note.

[Bug rtl-optimization/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Sandiford
<rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:591d857164c37cd0bb96da2a293148e01f280e0f

commit r10-8080-g591d857164c37cd0bb96da2a293148e01f280e0f
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Thu Apr 30 20:32:49 2020 +0100

    cse: Use simplify_replace_fn_rtx to process notes [PR94740]

    cse_process_notes did a very simple substitution, which in the wrong
    circumstances could create non-canonical RTL and invalid MEMs.
    Various sticking plasters have been applied to cse_process_notes_1
    to handle cases like ZERO_EXTEND, SIGN_EXTEND and UNSIGNED_FLOAT,
    but I think this PR is a plaster too far.

    The code is trying hard to avoid creating unnecessary rtl, which of
    course is a good thing.  If we continue to do that, then we can end
    up changing subexpressions while keeping the containing rtx.
    This in turn means that validate_change will be a no-op on the
    containing rtx, even if its contents have changed.  So in these
    cases we have to apply validate_change to the individual subexpressions.

    On the other hand, if we always apply validate_change to the
    individual subexpressions, we'll end up calling validate_change
    on something before it has been simplified and canonicalised.
    And that's one of the situations we're trying to avoid.

    There might be a middle ground in which we queue the validate_changes
    as part of a group, and so can cancel the pending validate_changes
    for subexpressions if there's a change in the outer expression.
    But that seems even more ad-hoc than the current code.
    It would also be quite an invasive change.

    I think the best thing is just to hook into the existing
    simplify_replace_fn_rtx function, keeping the REG and MEM handling
    from cse_process_notes_1 essentially unchanged.  It can generate
    more redundant rtl when a simplification takes place, but it has
    the advantage of being relative well-used code (both directly
    and via simplify_replace_rtx).

    2020-04-30  Richard Sandiford  <richard.sandiford@arm.com>

    gcc/
            PR rtl-optimization/94740
            * cse.c (cse_process_notes_1): Replace with...
            (cse_process_note_1): ...this new function, acting as a
            simplify_replace_fn_rtx callback to process_note.  Handle only
            REGs and MEMs directly.  Validate the MEM if cse_process_note
            changes its address.
            (cse_process_notes): Replace with...
            (cse_process_note): ...this new function.
            (cse_extended_basic_block): Update accordingly, iterating over
            the register notes and passing individual notes to
cse_process_note.

[Bug rtl-optimization/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Peter Bergner <bergner@gcc.gnu.org>:

https://gcc.gnu.org/g:ff1e6276dd71fde59fde679557b5db1efca9f19c

commit r11-6-gff1e6276dd71fde59fde679557b5db1efca9f19c
Author: Peter Bergner <bergner@linux.ibm.com>
Date:   Thu Apr 30 18:21:30 2020 -0500

    cse: Add test case. [PR94740]

            PR rtl-optimization/94740
            * gcc.target/powerpc/pr94740.c: New test.

[Bug rtl-optimization/94740] ICE on testsuite/gcc.dg/sso/t5.c with -mcpu=future -mpcrel -O1

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94740

Peter Bergner <bergner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #11 from Peter Bergner <bergner at gcc dot gnu.org> ---
Richard committed his patch, so this is fixed now.