[Bug target/97926] New: ICE in patch_jump_insn, at cfgrtl.c:1298

[Bug target/97926] New: ICE in patch_jump_insn, at cfgrtl.c:1298

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

            Bug ID: 97926
           Summary: ICE in patch_jump_insn, at cfgrtl.c:1298
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: segher at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-linux
            Target: ppc64-linux-gnu

The following ICEs:

$ ppc64-linux-gnu-gcc
/home/marxin/Programming/gcc/gcc/testsuite/c-c++-common/ubsan/float-cast-overflow-11.c
-ffinite-math-only -fsanitize=float-cast-overflow -c
during RTL pass: expand
/home/marxin/Programming/gcc/gcc/testsuite/c-c++-common/ubsan/float-cast-overflow-11.c:
In function ‘foo’:
/home/marxin/Programming/gcc/gcc/testsuite/c-c++-common/ubsan/float-cast-overflow-11.c:10:1:
internal compiler error: in patch_jump_insn, at cfgrtl.c:1298
   10 | }
      | ^
0x5b0036 patch_jump_insn
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfgrtl.c:1298
0x725bce redirect_branch_edge
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfgrtl.c:1325
0x726ec2 rtl_redirect_edge_and_branch
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfgrtl.c:1458
0x715589 redirect_edge_and_branch(edge_def*, basic_block_def*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfghooks.c:373
0x1193765 try_forward_edges
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfgcleanup.c:562
0x1193765 try_optimize_cfg
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfgcleanup.c:2960
0x1193765 cleanup_cfg(int)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfgcleanup.c:3174
0x713a0d execute
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-ppc64/build/gcc/cfgexpand.c:6763
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug target/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Target Milestone|---                         |11.0
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2020-11-20

[Bug target/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

--- Comment #1 from Segher Boessenkool <segher at gcc dot gnu.org> ---
Confirmed (needs -O0).

[Bug target/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[acsawdey at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

--- Comment #2 from acsawdey at gcc dot gnu.org ---
patch_jump_insn() is running into a land mine -- the insn before modification
is invalid:

(gdb) p insn_invalid_p(insn, true)
$4 = 1
(gdb) pr insn
(jump_insn 18 17 114 6 (set (pc)
        (if_then_else (unle (reg:CCFP 131)
                (const_int 0 [0]))
            (label_ref 21)
            (pc)))
"../../gcc/gcc/testsuite/c-c++-common/ubsan/float-cast-overflow-11.c":9:10 -1
     (nil)
 -> 21)

So verify_changes() fails because the same insn with a different label_ref
inserted is also invalid.

[Bug target/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[acsawdey at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

--- Comment #3 from acsawdey at gcc dot gnu.org ---
So the underlying problem here is that the unordered comparisons are not
allowed with -ffinite-math-only due to this predicate:

;; Return 1 if OP is a comparison operation that is valid for a branch
;; instruction.  We check the opcode against the mode of the CC value.
;; validate_condition_mode is an assertion.
(define_predicate "branch_comparison_operator"
   (and (match_operand 0 "comparison_operator")
        (match_test "GET_MODE_CLASS (GET_MODE (XEXP (op, 0))) == MODE_CC")
        (if_then_else (match_test "GET_MODE (XEXP (op, 0)) == CCFPmode")
          (if_then_else (match_test "flag_finite_math_only")
            (match_code "lt,le,gt,ge,eq,ne,unordered,ordered")
            (match_code "lt,gt,eq,unordered,unge,unle,ne,ordered"))
          (match_code "lt,ltu,le,leu,gt,gtu,ge,geu,eq,ne"))
        (match_test "validate_condition_mode (GET_CODE (op),
                                              GET_MODE (XEXP (op, 0))),
                     1")))


But ubsan_instrument_float_cast() generates this:

  t = fold_build2 (UNLE_EXPR, boolean_type_node, expr, min);
  tt = fold_build2 (UNGE_EXPR, boolean_type_node, expr, max);

which eventually leads to the ICE. Even if this branch wasn't rewritten by
patch_dump_insn() it would not be recognized and would eventually ICE.

Segher is working on a change to that predicate for PR98092 though which may be
a workaround fix for this.

[Bug target/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

Segher Boessenkool <segher at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|acsawdey at gcc dot gnu.org        |segher at gcc dot gnu.org

--- Comment #4 from Segher Boessenkool <segher at gcc dot gnu.org> ---
That is not where the UNGE and UNLE come from.  I have no idea where they
*do* come from though :-/

[Bug target/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

--- Comment #5 from Segher Boessenkool <segher at gcc dot gnu.org> ---
It helps if you test the compiler you just built, not something old.  Sigh.

Patch is testing.

[Bug target/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Segher Boessenkool <segher@gcc.gnu.org>:

https://gcc.gnu.org/g:ba16797fe69a0fae47355aa2c102ffac1c48c3bd

commit r11-7767-gba16797fe69a0fae47355aa2c102ffac1c48c3bd
Author: Segher Boessenkool <segher@kernel.crashing.org>
Date:   Fri Mar 19 15:02:00 2021 +0000

    ubsan: Don't test for NaNs if those do not exist (PR97926)

    2021-03-22  Segher Boessenkool  <segher@kernel.crashing.org>

            PR target/97926
            * ubsan.c (ubsan_instrument_float_cast): Don't test for unordered
if
            there are no NaNs.

[Bug testsuite/97926] ICE in patch_jump_insn, at cfgrtl.c:1298

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97926

Segher Boessenkool <segher at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|target                      |testsuite
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Segher Boessenkool <segher at gcc dot gnu.org> ---
Fixed.