[Bug target/99104] New: [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[Bug target/99104] New: [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

            Bug ID: 99104
           Summary: [11 Regression] ICE: Segmentation fault (in
                    bitmap_list_find_element)
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---
            Target: x86_64-pc-linux-gnu-gcc

gcc-11.0.0-alpha20210214 snapshot (g:9966699d7a9d8e35c0c4cf9a945bcf90ef874f2d)
ICEs when compiling the following testcase w/ -O2 -fsel-sched-pipelining
-fselective-scheduling2 -funroll-loops:

__int128 i128_0;
int s_1;

int
func_6 (void);

int __attribute__ ((simd))
func_4 (void)
{
  i128_0 = ~i128_0;

  if (func_6 ())
    s_1 = 0;
}

% x86_64-pc-linux-gnu-gcc-11.0.0 -O2 -fsel-sched-pipelining
-fselective-scheduling2 -funroll-loops -c mconkyrw.c
during RTL pass: split4
mconkyrw.c: In function 'func_4.simdclone.7':
mconkyrw.c:14:1: internal compiler error: Segmentation fault
   14 | }
      | ^
0xe033cf crash_signal
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/toplev.c:327
0x90c64c bitmap_list_find_element
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/bitmap.c:352
0x90c64c bitmap_bit_p(bitmap_head const*, int)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/bitmap.c:995
0x1182ed9 ix86_ok_to_clobber_flags
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/config/i386/i386.c:15000
0x118379e ix86_avoid_lea_for_addr(rtx_insn*, rtx_def**)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/config/i386/i386.c:15075
0x1786aa2 split_11
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/config/i386/i386.md:5192
0x179d83a split_insns(rtx_def*, rtx_insn*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/config/i386/i386.md:14096
0xa502b9 try_split(rtx_def*, rtx_insn*, int)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/emit-rtl.c:3834
0xd65356 split_insn
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/recog.c:3361
0xd6aab7 split_all_insns()
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/recog.c:3465
0xd6ab68 execute
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20210214/work/gcc-11-20210214/gcc/recog.c:4383

[Bug target/99104] [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Target Milestone|---                         |11.0
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
   Last reconfirmed|                            |2021-02-15
           Priority|P3                          |P1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with my r11-7235-g05402ca65a6696a8f20a3dbcb18f47ba3bdfa268
I'll have a look.

[Bug target/99104] [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 50186
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50186&action=edit
gcc11-pr99104.patch

What a mess!  Can we finally get rid of sel-sched?
The x86 backend uses DF inside of the splitter conditions which looks
problematic as the split passes don't really call df_analyze but so far we were
just lucky that the pass right before it maintained df.
Selective scheduling (unlike normal scheduling) can create new blocks with
insns that may need splitting and nothing computes the live or lr problem for
those.
So, either the backend needs to cope with df_get_live_out returning NULL, or,
because the pass_split_before_regstack pass is a single backend specific pass
(i386) we can call df_analyze there.

[Bug target/99104] [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Well, at least if split() does not maintain DF then split patterns may not use
DF.  It's as simple as that ;)  Note you need DF analyze anyway since even
if present, the DF problem might be out-of-date.

Note when you add DF_LIVE you have to remove it manually again if optimize == 1
because there we do not maintain it (but the problem is still not optional).

I guess if the x86 backend wants to use DF but other backends do not and do
not want to pay the compile-time cost of a df_analyze we could put DF
setup into a target hooks hand ... (or a target hook returning the DF problems
it likes to have computed for split).

[Bug target/99104] [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |uros at gcc dot gnu.org

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Note, try_split actually makes some attempts to maintain df,
it calls emit_insn_after_setloc and delete_insn and the former in the end calls
df_set_bb_dirty and df_insn_rescan and the latter df_insn_delete.

So, one question is if ix86_ok_to_clobber_flags can safely use
          FOR_EACH_INSN_USE (use, insn)
            if (DF_REF_REG_USE_P (use) && DF_REF_REGNO (use) == FLAGS_REG)
              return false;

          if (insn_defines_reg (FLAGS_REG, INVALID_REGNUM, insn))
            return true;
and another question is if it can safely use
  live = df_get_live_out(bb);
  return !REGNO_REG_SET_P (live, FLAGS_REG);

And, yes, perhaps a way out of this is a target hook that would initialize df
for insn splitting passes and return TODO_* to be returned.
All the split conditions that can call ix86_ok_to_clobber_flags are guarded
with reload_completed, so we could df_analyze just for split{2,3,4} (split5
isn't even invoked on x86).

[Bug target/99104] [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #50186|0                           |1
        is obsolete|                            |

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 50188
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50188&action=edit
gcc11-pr99104.patch

Different (still untested) fix.

[Bug target/99104] [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:decd8fb0128870d0d768ba53dae626913d6d9c54

commit r11-7274-gdecd8fb0128870d0d768ba53dae626913d6d9c54
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Feb 18 09:16:28 2021 +0100

    i386: Fix up df uses in i386 splitters [PR99104]

    The following testcase started ICEing with my recent changes to enable
    split4 after sel-sched, but it seems the bug is more general.
    Some of the i386 splitter condition functions use and rely on df, but
    the split passes don't really df_analyze/df_finish_pass, so the DF info
    may be stale or not computed at all - the particular ICE is because
    there is a new bb and df_get_live_out (bb) returns NULL on it as the
    live or lr problem has not been computed yet.

    This patch fixes it by not calling ix86_ok_to_clobber_flags from
    ix86_avoid_lea_for_add where it wasn't ever needed because the splitters
    using that function as condition have (clobber FLAGS) in their pattern.
    And, changes the ix86_avoid_lea_for_addr using splitter from normal
splitter
    to peephole2 splitter that uses peep2_regno_dead_p infrastructure to
    determine if FLAGS is dead.  Also, it saves and restores recog_data
    variable around the call to distance_non_agu_define and doesn't call
    extract_insn_data there, because split_insns or peephole2_insns just
    clear recog_data.insn and then fill in recog_data.operand array, and so
    might not match what extract_insn will do on the insn at all.

    2021-02-18  Jakub Jelinek  <jakub@redhat.com>

            PR target/99104
            * config/i386/i386.c (distance_non_agu_define): Don't call
            extract_insn_cached here.
            (ix86_lea_outperforms): Save and restore recog_data around call
            to distance_non_agu_define and distance_agu_use.
            (ix86_ok_to_clobber_flags): Remove.
            (ix86_avoid_lea_for_add): Don't call ix86_ok_to_clobber_flags.
            (ix86_avoid_lea_for_addr): Likewise.  Adjust function comment.
            * config/i386/i386.md (*lea<mode>): Change from
define_insn_and_split
            into define_insn.  Move the splitting to define_peephole2 and
            check there using peep2_regno_dead_p if FLAGS_REG is dead.

            * gcc.dg/pr99104.c: New test.

[Bug target/99104] [11 Regression] ICE: Segmentation fault (in bitmap_list_find_element)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99104

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.