[Bug rtl-optimization/97535] New: ICE when building xmrig on AArch64

[Bug rtl-optimization/97535] New: ICE when building xmrig on AArch64

[icenowy at aosc dot io]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

            Bug ID: 97535
           Summary: ICE when building xmrig on AArch64
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: icenowy at aosc dot io
  Target Milestone: ---

Created attachment 49425
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49425&action=edit
Preprocessed source file

When building xmrig on AArch64 with GCC 9.3.1, this file will trap cc1plus into
infinitely running.

I extracted the preprocessed source and then proceed with GCC master (commit
0a74a0e1a2d ("libstdc++: Fix custom clock in test")), and now it fails with
ICE:

/var/cache/acbs/build/acbs.6sxjqdht/xmrig-6.3.5/src/crypto/rx/RxDataset.cpp: In
member function 'void xmrig::RxDataset::setRaw(const void*)':
/var/cache/acbs/build/acbs.6sxjqdht/xmrig-6.3.5/src/crypto/rx/RxDataset.cpp:178:1:
error: unrecognizable insn:
(insn 80 79 81 4 (parallel [
            (set (reg:V4SI 162)
                (mem:V4SI (plus:DI (reg:DI 97)
                        (const_int 1024 [0x400])) [0 MEM <char[1:2181038080]>
[(void *)raw_7(D)]+1024 S16 A8]))
            (set (reg:V4SI 163)
                (mem:V4SI (plus:DI (reg:DI 97)
                        (const_int 1040 [0x410])) [0 MEM <char[1:2181038080]>
[(void *)raw_7(D)]+1040 S16 A8]))
        ])
"/var/cache/acbs/build/acbs.6sxjqdht/xmrig-6.3.5/src/crypto/rx/RxDataset.cpp":177:11
-1
     (nil))
during RTL pass: vregs
/var/cache/acbs/build/acbs.6sxjqdht/xmrig-6.3.5/src/crypto/rx/RxDataset.cpp:178:1:
internal compiler error: in extract_insn, at recog.c:2295
0x82f9e8 _fatal_insn(char const*, rtx_def const*, char const*, int, char
const*)
        /home/icenowy/git-repos/gcc/gcc/rtl-error.c:108
0x82fa04 _fatal_insn_not_found(rtx_def const*, char const*, int, char const*)
        /home/icenowy/git-repos/gcc/gcc/rtl-error.c:116
0x82def9 extract_insn(rtx_insn*)
        /home/icenowy/git-repos/gcc/gcc/recog.c:2295
0xe433b7 instantiate_virtual_regs_in_insn
        /home/icenowy/git-repos/gcc/gcc/function.c:1656
0xe433b7 instantiate_virtual_regs
        /home/icenowy/git-repos/gcc/gcc/function.c:1977
0xe433b7 execute
        /home/icenowy/git-repos/gcc/gcc/function.c:2026

[Bug rtl-optimization/97535] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[icenowy at aosc dot io]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #1 from Icenowy Zheng <icenowy at aosc dot io> ---
The problem is found to be trying to expand a memcpy() call with fixed length
2181038080.

Handling of memcpy() expansion seem to be corrupted when len >= 2147483648. The
length is mod with 2147483648, and then forced to expand.

When a test program that contains a call to memcpy() with len 2147483648 is
tried, it is "expanded" to nothing.

The problematic thing seems to be aarch64_expand_cpymem() in master at
config/aarch64/aarch64.c (aarch64_expand_movmem() in GCC 9), in which the
variable n is declared with `int` (a 32-bit signed integer on both AArch64 LP64
and x86-64). Modify it to HOST_WIDE_INT seems to fix the problem.

[Bug rtl-optimization/97535] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org
   Last reconfirmed|                            |2020-10-23
           Keywords|                            |needs-reduction
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed. I'm reducing that right now.

[Bug rtl-optimization/97535] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[icenowy at aosc dot io]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #3 from Icenowy Zheng <icenowy at aosc dot io> ---
A minimal reproduction: (Compile with gcc -c -O1)

```
#include <string.h>

#define SIZE 2181038080

extern char raw_buffer[SIZE];

void setRaw(const void *raw)
{
        memcpy(raw_buffer, raw, SIZE);
}
```

[Bug rtl-optimization/97535] [9/10/11 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #4 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Yeah, the overflow in the signed type is causing the number of instructions
guard to fail.

I'll submit a patch.

[Bug target/97535] [9/10/11 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Tamar Christina <tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:0f801e0b6cc9f67c9a8983127e23161f6025c5b6

commit r11-4453-g0f801e0b6cc9f67c9a8983127e23161f6025c5b6
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Tue Oct 27 16:30:31 2020 +0000

    AArch64: Fix overflow in memcopy expansion on aarch64.

    Currently the inline memcpy expansion code for AArch64 is using a signed
int
    to hold the number of elements to copy.  When you giver give it a value
larger
    than INT_MAX it will overflow.

    The overflow causes the maximum number of instructions we want to expand to
    check to fail since this assumes an unsigned number.

    This patch changes the maximum isns arithmetic to be unsigned
HOST_WIDE_INT.

    note that the calculation *must* remained signed as the memcopy issues
    overlapping unaligned copies.  This means the pointer must be moved back
and
    so you need signed arithmetic.

    gcc/ChangeLog:

            PR target/97535
            * config/aarch64/aarch64.c (aarch64_expand_cpymem): Use unsigned
            arithmetic in check.

    gcc/testsuite/ChangeLog:

            PR target/97535
            * gcc.target/aarch64/pr97535.c: New test.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11 Regression] On     |[9/10 Regression] On
                   |AArch64 memcpy expansion    |AArch64 memcpy expansion
                   |cannot handle length >      |cannot handle length >
                   |32-bit signed int max       |32-bit signed int max
             Status|NEW                         |ASSIGNED

--- Comment #6 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
fixed in trunk, will backport in a few days.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Tamar Christina <tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:3dcd47389b16f48dcf5512b9ebba15af5c0be948

commit r11-4496-g3dcd47389b16f48dcf5512b9ebba15af5c0be948
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Wed Oct 28 19:13:27 2020 +0000

    AArch64: Skip test for pr97535 on ILP32 since it can't express the range.

    I am excluding the test from ILP32 since the goal of the test is to test
    truncations of large numbers above INT_MAX.

    gcc/testsuite/ChangeLog:

            PR target/97535
            * gcc.target/aarch64/pr97535.c: Exclude ILP32.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
           Priority|P3                          |P2
                 CC|                            |rguenth at gcc dot gnu.org
   Target Milestone|---                         |9.4

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Tamar Christina
<tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:886964a78aa89ef3c15e69a7b4b96c55d51ea812

commit r10-9034-g886964a78aa89ef3c15e69a7b4b96c55d51ea812
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Tue Nov 17 10:19:20 2020 +0000

    AArch64: Fix overflow in memcopy expansion on aarch64.

    Currently the inline memcpy expansion code for AArch64 is using a signed
int
    to hold the number of elements to copy.  When you giver give it a value
larger
    than INT_MAX it will overflow.

    The overflow causes the maximum number of instructions we want to expand to
    check to fail since this assumes an unsigned number.

    This patch changes the maximum isns arithmetic to be unsigned.  The type
can
    stay 32-bits since the number of instructions we are allowed to expand to
    are at most 8 which is far below what you could fit in an unsigned int.

    note that the calculation *must* remained signed as the memcopy issues
    overlapping unaligned copies.  This means the pointer must be moved back
and
    so you need signed arithmetic.

    gcc/ChangeLog:

            PR target/97535
            * config/aarch64/aarch64.c (aarch64_expand_cpymem): Use unsigned
            arithmetic in check.

    gcc/testsuite/ChangeLog:

            PR target/97535
            * gcc.target/aarch64/pr97535.c: New test.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Tamar Christina
<tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:9d65095e72502c12903e202cfe2e1fc58140522a

commit r9-9052-g9d65095e72502c12903e202cfe2e1fc58140522a
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Tue Oct 27 16:30:31 2020 +0000

    AArch64: Fix overflow in memcopy expansion on aarch64.

    Currently the inline memcpy expansion code for AArch64 is using a signed
int
    to hold the number of elements to copy.  When you giver give it a value
larger
    than INT_MAX it will overflow.

    The overflow causes the maximum number of instructions we want to expand to
    check to fail since this assumes an unsigned number.

    This patch changes the maximum isns arithmetic to be unsigned
HOST_WIDE_INT.

    note that the calculation *must* remained signed as the memcopy issues
    overlapping unaligned copies.  This means the pointer must be moved back
and
    so you need signed arithmetic.

    gcc/ChangeLog:

            PR target/97535
            * config/aarch64/aarch64.c (aarch64_expand_cpymem): Use unsigned
            arithmetic in check.

    gcc/testsuite/ChangeLog:

            PR target/97535
            * gcc.target/aarch64/pr97535.c: New test.

    (cherry picked from commit 0f801e0b6cc9f67c9a8983127e23161f6025c5b6)

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Tamar Christina
<tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:7e785f4c7643dbf5c4ae8cf02e2c148429adbfcf

commit r9-9053-g7e785f4c7643dbf5c4ae8cf02e2c148429adbfcf
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Wed Oct 28 19:13:27 2020 +0000

    AArch64: Skip test for pr97535 on ILP32 since it can't express the range.

    I am excluding the test from ILP32 since the goal of the test is to test
    truncations of large numbers above INT_MAX.

    gcc/testsuite/ChangeLog:

            PR target/97535
            * gcc.target/aarch64/pr97535.c: Exclude ILP32.

    (cherry picked from commit 3dcd47389b16f48dcf5512b9ebba15af5c0be948)

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Tamar Christina
<tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:98ba03ffe0b9f37b4916ce6238fad754e00d720b

commit r10-9035-g98ba03ffe0b9f37b4916ce6238fad754e00d720b
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Wed Oct 28 19:13:27 2020 +0000

    AArch64: Skip test for pr97535 on ILP32 since it can't express the range.

    I am excluding the test from ILP32 since the goal of the test is to test
    truncations of large numbers above INT_MAX.

    gcc/testsuite/ChangeLog:

            PR target/97535
            * gcc.target/aarch64/pr97535.c: Exclude ILP32.

    (cherry picked from commit 3dcd47389b16f48dcf5512b9ebba15af5c0be948)

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #12 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Fixed and backported to GCC 10,9. Could not reproduce on 8 which has a
different algorithm.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #13 from rguenther at suse dot de <rguenther at suse dot de> ---
On Tue, 17 Nov 2020, tnfchris at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535
> 
> Tamar Christina <tnfchris at gcc dot gnu.org> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>          Resolution|---                         |FIXED
>              Status|ASSIGNED                    |RESOLVED
> 
> --- Comment #12 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
> Fixed and backported to GCC 10,9. Could not reproduce on 8 which has a
> different algorithm.

But aarch64_expand_movmem has the same problem:

bool
aarch64_expand_movmem (rtx *operands)
{
  unsigned int n;
...
  n = UINTVAL (operands[2]);

should use unsigned HOST_WIDE_INT.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |---
             Status|RESOLVED                    |ASSIGNED

--- Comment #14 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Hmm indeed. I only saw it was doing unsigned arithmetic.  I'll patch that one
too.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #15 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Hmm indeed. I only saw it was doing unsigned arithmetic.  I'll patch that one
too.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

--- Comment #16 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-8 branch has been updated by Tamar Christina
<tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:ff3bb57646fb49090ce84b05bda5003b8f33fc07

commit r8-10626-gff3bb57646fb49090ce84b05bda5003b8f33fc07
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Tue Nov 17 12:53:08 2020 +0000

    AArch64: Fix overflow in memcopy expansion on aarch64.

    This a partial backport for 0f801e0b6cc9f67c9a8983127e23161f6025c5b6 which
fixes
    a truncation error for the inline memcopy on AArch64 on GCC-8.

    gcc/ChangeLog:

            PR target/97535
            * config/aarch64/aarch64.c (aarch64_expand_movme): Use
            unsigned HOST_WIDE_INT.

    gcc/testsuite/ChangeLog:

            PR target/97535
            * gcc.target/aarch64/pr97535.c: New test.

[Bug target/97535] [9/10 Regression] On AArch64 memcpy expansion cannot handle length > 32-bit signed int max

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97535

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #17 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Fixed on master and all branches still open.