[Bug rtl-optimization/99041] New: combine creates invalid address which ICEs in decompose_normal_address

[Bug rtl-optimization/99041] New: combine creates invalid address which ICEs in decompose_normal_address

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

            Bug ID: 99041
           Summary: combine creates invalid address which ICEs in
                    decompose_normal_address
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bergner at gcc dot gnu.org
  Target Milestone: ---

Created attachment 50153
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50153&action=edit
creduced test case

For a reduced test case from the Eigen library with some MMA builtin usage, we
are ICEing in decompose_normal_address():

bergner@pike:~/gcc/BUGS/MMA/CHIP$ xg++ -B/path/to/gcc -S -mcpu=power10
-std=c++03 -nostdinc -fno-check-new -fno-common -fstrict-aliasing -ansi -O2 -w
polynomialsolver.ii 
during RTL pass: reload
polynomialsolver.ii: In function ‘void test_polynomialsolver()’:
polynomialsolver.ii:78:67: internal compiler error: in
decompose_normal_address, at rtlanal.c:6754
   78 |  void test_polynomialsolver() { polynomialsolver< double, 5 >(5); }
      |                                                                   ^
0x10ecf3cf decompose_normal_address
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/rtlanal.c:6754
0x10ecf3cf decompose_address(address_info*, rtx_def**, machine_mode, unsigned
char, rtx_code)
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/rtlanal.c:6787
0x10cda44f process_address_1
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/lra-constraints.c:3460
0x10cdd80b process_address
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/lra-constraints.c:3734
0x10cdd80b curr_insn_transform
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/lra-constraints.c:4049
0x10ce497f lra_constraints(bool)
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/lra-constraints.c:5138
0x10cc560f lra(_IO_FILE*)
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/lra.c:2336
0x10c535bb do_reload
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/ira.c:5821
0x10c535bb execute
        /home/bergner/gcc/gcc-fsf-mainline-pr98872/gcc/ira.c:6007
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

The invalid address comes from:

(insn 127 126 128 3 (set (reg:OO 138 [ _41 ])
        (unspec:OO [
                (mem:V16QI (reg:DI 149 [ ivtmp.49 ]) [0 MEM <ax> [(void
*)_75]+0 S16 A8])
                (mem:V16QI (plus:DI (plus:DI (reg:DI 142 [ _63 ])
                            (reg:DI 149 [ ivtmp.49 ]))
                        (reg:DI 197)) [0 MEM <ax> [(void *)_24 + _16 * 1]+0 S16
A8])
            ] UNSPEC_MMA_ASSEMBLE)) 2074 {*mma_assemble_pair}
     (nil))

[Bug rtl-optimization/99041] combine creates invalid address which ICEs in decompose_normal_address

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

Peter Bergner <bergner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-02-09

--- Comment #1 from Peter Bergner <bergner at gcc dot gnu.org> ---
This looks like a combine issue.  Before combine, we have:

(insn 124 123 125 3 (set (reg:V2DF 198 [ MEM <ax> [(void *)_75] ])
        (mem:V2DF (reg:DI 149 [ ivtmp.49 ]) [0 MEM <ax> [(void *)_75]+0 S16
A8])) "bug.ii":22:67 1130 {vsx_movv2df_64bit}
     (nil))

(insn 125 124 126 3 (set (reg:DI 199)
        (plus:DI (reg:DI 142 [ _63 ])
            (reg:DI 149 [ ivtmp.49 ]))) "bug.ii":22:67 66 {*adddi3}
     (nil))

(insn 126 125 127 3 (set (reg:V2DF 200 [ MEM <ax> [(void *)_24 + _16 * 1] ])
        (mem:V2DF (plus:DI (reg:DI 199)
                (reg:DI 197)) [0 MEM <ax> [(void *)_24 + _16 * 1]+0 S16 A8]))
"bug.ii":22:67 1130 {vsx_movv2df_64bit}
     (expr_list:REG_DEAD (reg:DI 199)
        (nil)))

(insn 127 126 128 3 (set (reg:OO 138 [ _41 ])
        (unspec:OO [
                (subreg:V16QI (reg:V2DF 198 [ MEM <ax> [(void *)_75] ]) 0)
                (subreg:V16QI (reg:V2DF 200 [ MEM <ax> [(void *)_24 + _16 * 1]
]) 0)
            ] UNSPEC_MMA_ASSEMBLE)) 2074 {*mma_assemble_pair}
     (expr_list:REG_DEAD (reg:V2DF 200 [ MEM <ax> [(void *)_24 + _16 * 1] ])
        (expr_list:REG_DEAD (reg:V2DF 198 [ MEM <ax> [(void *)_75] ])
            (nil))))


After combine, we have:

(note 124 123 125 3 NOTE_INSN_DELETED)

(note 125 124 126 3 NOTE_INSN_DELETED)

(note 126 125 127 3 NOTE_INSN_DELETED)

(insn 127 126 128 3 (set (reg:OO 138 [ _41 ])
        (unspec:OO [
                (mem:V16QI (reg:DI 149 [ ivtmp.49 ]) [0 MEM <ax> [(void
*)_75]+0 S16 A8])
                (mem:V16QI (plus:DI (plus:DI (reg:DI 142 [ _63 ])
                            (reg:DI 149 [ ivtmp.49 ]))
                        (reg:DI 197)) [0 MEM <ax> [(void *)_24 + _16 * 1]+0 S16
A8])
            ] UNSPEC_MMA_ASSEMBLE)) 2074 {*mma_assemble_pair}
     (nil))

That bad address on the 2nd mem then makes it all the way to LRA which
eventually dies when it calls decompose_normal_address on it.

Segher, is combine allowed to create invalid addresses like that and LRA is
supposed to fix it up or is this really a combine issue?

[Bug rtl-optimization/99041] combine creates invalid address which ICEs in decompose_normal_address

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Combiner tries to combine whatever it can and if it matches (and costs suggest
it is beneficial) it keeps it.
So, this looks like a target bug to me.
In particular, mma_assemble_input_operand predicate seems to allow any MEM
whatsoever as long as it has V16QImode:
(define_special_predicate "mma_assemble_input_operand"
  (match_test "(mode == V16QImode
                && (vsx_register_operand (op, mode) || MEM_P (op)))"))
I don't believe it can allow any, there must be some requirement on what the
address of the MEM can be, whether a REG + REG, REG + offset etc. and the ICE
is a proof it is not the case.

[Bug rtl-optimization/99041] combine creates invalid address which ICEs in decompose_normal_address

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #3 from Peter Bergner <bergner at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #2)
> Combiner tries to combine whatever it can and if it matches (and costs
> suggest it is beneficial) it keeps it.
> So, this looks like a target bug to me.
> In particular, mma_assemble_input_operand predicate seems to allow any MEM
> whatsoever as long as it has V16QImode:
> (define_special_predicate "mma_assemble_input_operand"
>   (match_test "(mode == V16QImode
>                 && (vsx_register_operand (op, mode) || MEM_P (op)))"))
> I don't believe it can allow any, there must be some requirement on what the
> address of the MEM can be, whether a REG + REG, REG + offset etc. and the
> ICE is a proof it is not the case.

Ahh, ok.  I can make that more robust.  Thanks for the pointer!

[Bug rtl-optimization/99041] combine creates invalid address which ICEs in decompose_normal_address

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #4 from Segher Boessenkool <segher at gcc dot gnu.org> ---
combine always asks recog(), so that must have said it is okay?

[Bug rtl-optimization/99041] combine creates invalid address which ICEs in decompose_normal_address

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #5 from Segher Boessenkool <segher at gcc dot gnu.org> ---
(As Jakub said; I'm just slow).

[Bug target/99041] combine creates invalid address which ICEs in decompose_normal_address

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

Peter Bergner <bergner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #6 from Peter Bergner <bergner at gcc dot gnu.org> ---
(In reply to Peter Bergner from comment #3)
> Ahh, ok.  I can make that more robust.  Thanks for the pointer!

The mma_assemble_pair/mma_assemble_acc patterns both generate lxv or lxvp
instructions, which both use a DQ offset and we already have function to test
for that.  The following change fixes the ICE, so I'll give it a spin on
regtesting.

diff --git a/gcc/config/rs6000/predicates.md b/gcc/config/rs6000/predicates.md
index 76328ecff3d..bd26c62b3a4 100644
--- a/gcc/config/rs6000/predicates.md
+++ b/gcc/config/rs6000/predicates.md
@@ -1156,7 +1156,9 @@
 ;; Return 1 if this operand is valid for a MMA assemble accumulator insn.
 (define_special_predicate "mma_assemble_input_operand"
   (match_test "(mode == V16QImode
-               && (vsx_register_operand (op, mode) || MEM_P (op)))"))
+               && (vsx_register_operand (op, mode)
+                   || (MEM_P (op)
+                       && quad_address_p (XEXP (op, 0), mode, false))))"))

 ;; Return 1 if this operand is valid for an MMA disassemble insn.
 (define_predicate "mma_disassemble_output_operand"

[Bug target/99041] combine creates invalid address which ICEs in decompose_normal_address

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #7 from Segher Boessenkool <segher at gcc dot gnu.org> ---
(In reply to Peter Bergner from comment #6)
> The mma_assemble_pair/mma_assemble_acc patterns both generate lxv or lxvp
> at, which both use a DQ offset and we already have function to
> test for that.  The following change fixes the ICE, so I'll give it a spin
> on regtesting.

That looks fine; if that is the only change you need it is pre-approved
for trunk.  Thanks!

[Bug target/99041] combine creates invalid address which ICEs in decompose_normal_address

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Peter Bergner <bergner@gcc.gnu.org>:

https://gcc.gnu.org/g:2432c47970024db6410708b582a901259dabaae1

commit r11-7196-g2432c47970024db6410708b582a901259dabaae1
Author: Peter Bergner <bergner@linux.ibm.com>
Date:   Thu Feb 11 14:15:26 2021 -0600

    rs6000: Fix invalid address used in MMA built-in function

    The mma_assemble_input_operand predicate is too lenient on the memory
    operands it will accept, leading to an ICE when illegitimate addresses
    are passed in.  The solution is to only accept memory operands with
    addresses that are valid for quad word memory accesses.  The test case
    is a minimized test case from the Eigen library.  The creduced test case
    is very noisy with respect to warnings, so the test case has added -w to
    silence them.

    2021-02-11  Peter Bergner  <bergner@linux.ibm.com>

    gcc/
            PR target/99041
            * config/rs6000/predicates.md (mma_assemble_input_operand):
Restrict
            memory addresses that are legal for quad word accesses.

    gcc/testsuite/
            PR target/99041
            * g++.target/powerpc/pr99041.C: New test.

[Bug target/99041] combine creates invalid address which ICEs in decompose_normal_address

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #9 from Peter Bergner <bergner at gcc dot gnu.org> ---
Fixed on trunk.

I will check whether we need this on the GCC10 branch as well.  I believe we
probably will.

[Bug target/99041] combine creates invalid address which ICEs in decompose_normal_address

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #10 from Peter Bergner <bergner at gcc dot gnu.org> ---
(In reply to Peter Bergner from comment #9)
> Fixed on trunk.
> 
> I will check whether we need this on the GCC10 branch as well.  I believe we
> probably will.

Confirmed, we need this on GCC10 as well.  Segher approved the backport
offline.  I'll let the trunk commit bake a few days and then will push the
backport.

[Bug target/99041] combine creates invalid address which ICEs in decompose_normal_address

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Peter Bergner
<bergner@gcc.gnu.org>:

https://gcc.gnu.org/g:336cd08b65ea589bc4acc8c91a4a4c4873363989

commit r10-9430-g336cd08b65ea589bc4acc8c91a4a4c4873363989
Author: Peter Bergner <bergner@linux.ibm.com>
Date:   Thu Feb 11 14:15:26 2021 -0600

    rs6000: Fix invalid address used in MMA built-in function

    The mma_assemble_input_operand predicate is too lenient on the memory
    operands it will accept, leading to an ICE when illegitimate addresses
    are passed in.  The solution is to only accept memory operands with
    addresses that are valid for quad word memory accesses.  The test case
    is a minimized test case from the Eigen library.  The creduced test case
    is very noisy with respect to warnings, so the test case has added -w to
    silence them.

    2021-02-11  Peter Bergner  <bergner@linux.ibm.com>

    gcc/
            PR target/99041
            * config/rs6000/predicates.md (mma_assemble_input_operand):
Restrict
            memory addresses that are legal for quad word accesses.

    gcc/testsuite/
            PR target/99041
            * g++.target/powerpc/pr99041.C: New test.

    (cherry picked from commit 2432c47970024db6410708b582a901259dabaae1)

[Bug target/99041] combine creates invalid address which ICEs in decompose_normal_address

[bergner at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99041

Peter Bergner <bergner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #12 from Peter Bergner <bergner at gcc dot gnu.org> ---
Fixed everywhere.