[Bug target/95361] New: Segfault when generating an epilogue for a partly-shrinked-wrapped SVE frame

[Bug target/95361] New: Segfault when generating an epilogue for a partly-shrinked-wrapped SVE frame

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95361

            Bug ID: 95361
           Summary: Segfault when generating an epilogue for a
                    partly-shrinked-wrapped SVE frame
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rsandifo at gcc dot gnu.org
  Target Milestone: ---
            Target: aarch64*-*-*

Compiling the following with -O2 -march=armv8.2+sve causes
the compiler to segfault during aarch64_expand_epilogue:

----------------------------------------------------
__SVInt8_t
f (__SVInt8_t x, int y)
{
  if (y == 1)
    asm volatile ("" ::: "z8");
  if (y == 2)
    asm volatile ("" ::: "z9");
  return x;
}
----------------------------------------------------

The problem is that we individually shrink-wrap the saves
and restores of z8 and z9, but need to keep the stack
allocation common to both arms.  Before emitting the
deallocation instruction, we try to add a REG_CFA_DEF_CFA
note to the final restore, which doesn't exist:

  if (callee_adjust != 0 || maybe_gt (initial_adjust, 65536))
    {
      /* Emit delayed restores and set the CFA to be SP + initial_adjust.  */
      insn = get_last_insn ();
      rtx new_cfa = plus_constant (Pmode, stack_pointer_rtx, initial_adjust);
      REG_NOTES (insn) = alloc_reg_note (REG_CFA_DEF_CFA, new_cfa, cfi_ops);
      RTX_FRAME_RELATED_P (insn) = 1;
      cfi_ops = NULL;
    }

This in practice only happens for SVE because:

(a) We don't try to shrink-wrap wb_candidate* registers even when
    we've decided to treat them as normal saves and restores.
    I have a fix for that.

(b) Even with (a) fixed, we're (almost?) guaranteed to emit a stack
    tie for frames that are 64k or larger, so we end up hanging the
    REG_CFA_DEF_CFA note on that instead.

I haven't yet checked how far back this goes.

[Bug target/95361] Segfault when generating an epilogue for a partly-shrinked-wrapped SVE frame

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95361

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-05-27
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
           Assignee|unassigned at gcc dot gnu.org      |rsandifo at gcc dot gnu.org

--- Comment #1 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Mine.

[Bug target/95361] Segfault when generating an epilogue for a partly-shrinked-wrapped SVE frame

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95361

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:1ccbfffb0fb614f09cf2b7b70f152d6e489cfd17

commit r11-691-g1ccbfffb0fb614f09cf2b7b70f152d6e489cfd17
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Thu May 28 13:18:12 2020 +0100

    aarch64: Fix segfault in aarch64_expand_epilogue [PR95361]

    The stack frame for the function in the testcase consisted of two
    SVE save slots.  Both saves had been shrink-wrapped, but for different
    blocks, meaning that the stack allocation and deallocation were
    separate from the saves themselves.  Before emitting the deallocation,
    we tried to attach a REG_CFA_DEF_CFA note to the preceding instruction,
    to redefine the CFA in terms of the stack pointer.  But in this case
    there was no preceding instruction.

    This in practice only happens for SVE because:

    (a) We don't try to shrink-wrap wb_candidate* registers even when
        we've decided to treat them as normal saves and restores.
        I have a fix for that.

    (b) Even with (a) fixed, we're (almost?) guaranteed to emit
        a stack tie for frames that are 64k or larger, so we end
        up hanging the REG_CFA_DEF_CFA note on that instead.

    We should only need to redefine the CFA if it was previously
    defined in terms of the frame pointer.  In other cases the CFA
    should already be defined in terms of the stack pointer,
    so redefining it is unnecessary but usually harmless.

    2020-05-28  Richard Sandiford  <richard.sandiford@arm.com>

    gcc/
            PR testsuite/95361
            * config/aarch64/aarch64.c (aarch64_expand_epilogue): Assert that
            we have at least some CFI operations when using a frame pointer.
            Only redefine the CFA if we have CFI operations.

    gcc/testsuite/
            PR testsuite/95361
            * gcc.target/aarch64/sve/pr95361.c: New test.

[Bug target/95361] Segfault when generating an epilogue for a partly-shrinked-wrapped SVE frame

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95361

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Sandiford
<rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:c082cb8a2523d8c5afe5710e265bc72dd71aa60b

commit r10-8201-gc082cb8a2523d8c5afe5710e265bc72dd71aa60b
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Thu May 28 19:03:46 2020 +0100

    aarch64: Fix segfault in aarch64_expand_epilogue [PR95361]

    The stack frame for the function in the testcase consisted of two
    SVE save slots.  Both saves had been shrink-wrapped, but for different
    blocks, meaning that the stack allocation and deallocation were
    separate from the saves themselves.  Before emitting the deallocation,
    we tried to attach a REG_CFA_DEF_CFA note to the preceding instruction,
    to redefine the CFA in terms of the stack pointer.  But in this case
    there was no preceding instruction.

    This in practice only happens for SVE because:

    (a) We don't try to shrink-wrap wb_candidate* registers even when
        we've decided to treat them as normal saves and restores.
        I have a fix for that.

    (b) Even with (a) fixed, we're (almost?) guaranteed to emit
        a stack tie for frames that are 64k or larger, so we end
        up hanging the REG_CFA_DEF_CFA note on that instead.

    We should only need to redefine the CFA if it was previously
    defined in terms of the frame pointer.  In other cases the CFA
    should already be defined in terms of the stack pointer,
    so redefining it is unnecessary but usually harmless.

    2020-05-28  Richard Sandiford  <richard.sandiford@arm.com>

    gcc/
            PR testsuite/95361
            * config/aarch64/aarch64.c (aarch64_expand_epilogue): Only
            redefine the CFA if we have CFI operations.

    gcc/testsuite/
            PR testsuite/95361
            * gcc.target/aarch64/sve/pr95361.c: New test.

[Bug target/95361] Segfault when generating an epilogue for a partly-shrinked-wrapped SVE frame

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95361

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
The original testcase requires support for built-in SVE vector types,
which were only added in GCC 10.  I'm not planning to backport
further unless there's a different testcase that needs the
same fix.