Re: [PATCH v3] Implement new RTL optimizations pass: fold-mem-offsets.

[Vineet Gupta <vineetg@rivosinc.com>]

[-- Attachment #1: Type: text/plain, Size: 3042 bytes --]

Hi Manolis,

On 7/18/23 11:01, Jeff Law via Gcc-patches wrote:
> Vineet @ Rivos has indicated he stumbled across an ICE with the V3 
> code.  Hopefully he'll get a testcase for that extracted shortly. 

Yeah, I was trying to build SPEC2017 with this patch and ran into ICE 
for several of them with -Ofast build: The reduced test from 455.nab is 
attached here.
The issue happens with v2 as well, so not something introduced by v3.

There's ICE in cprop_hardreg which immediately follows f-m-o.


The protagonist is ins 93 which starts off in combine as a simple set of 
a DF 0.

| sff.i.288r.combine:(insn 93 337 94 8 (set (reg/v:DF 236 [ e ])
| sff.i.288r.combine- (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 
190 {*movdf_hardfloat_rv64}

Subsequently reload transforms it into SP + offset

| sff.i.303r.reload:(insn 93 337 94 9 (set (mem/c:DF (plus:DI (reg/f:DI 
2 sp)
| sff.i.303r.reload- (const_int 8 [0x8])) [4 %sfp+-8 S8 A64])
| sff.i.303r.reload- (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 190 
{*movdf_hardfloat_rv64}
| sff.i.303r.reload- (expr_list:REG_EQUAL (const_double:DF 0.0 [0x0.0p+0])

It gets processed by f-m-o and lands in cprop_hardreg, where it triggers 
ICE.

| (insn 93 337 523 11 (set (mem/c:DF (plus:DI (reg/f:DI 2 sp)
|                 (const_int 8 [0x8])) [4 %sfp+-8 S8 A64])
|         (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 -1
^^^
|      (expr_list:REG_EQUAL (const_double:DF 0.0 [0x0.0p+0])
|        (nil)))
| during RTL pass: cprop_hardreg

Here's my analysis:

f-m-o: do_check_validity() -> insn_invalid_p() tries to recog() a 
modified version of insn 93 (actually there is no change, so perhaps 
something we can optimize later). The corresponding md pattern 
movdf_hardfloat_rv64 no longer matches since it expects REG_P for 
operand0, while reload has converted it into SP + offset. f-m-o then 
does the right thing by invalidating INSN_CODE=-1 for a subsequent 
recog() to work correctly.
But it seems this -1 lingers into the next pass, and trips up 
copyprop_hardreg_forward_1() -> extract_constrain_insn()
So I don't know what the right fix here should be.

In a run with -fno-fold-mem-offsets, the same insn 93 is successfully 
grok'ed by cprop_hardreg,

| (insn 93 337 522 11 (set (mem/c:DF (plus:DI (reg/f:DI 2 sp)
|                (const_int 8 [0x8])) [4 %sfp+-8 S8 A64])
|        (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 190 
{*movdf_hardfloat_rv64}
^^^^^^^^^^^^^^^
|     (expr_list:REG_EQUAL (const_double:DF 0.0 [0x0.0p+0])
|        (nil)))

P.S. I wonder if it is a good idea in general to call recog() post 
reload since the insn could be changed sufficiently to no longer match 
the md patterns. Of course I don't know the answer.

P.S.2 When debugging code, I noticed a minor annoyance in the patch with 
the whole fold_mem_offsets_driver() switch-case indirection. It doesn't 
seem to be serving any purpose, and we could simply call corresponding 
do_* routines in execute () itself.

Thx,
-Vineet

[-- Attachment #2: sff.i --]
[-- Type: text/plain, Size: 690 bytes --]

a, c, d, g, h, i, j, k, m, p, q, r, aa, t, u, x;
double *f, *s;
double l, n, o, v, w;
b() {
  double e, ad, ae, af, ag, ah, ai, aj, am, an, ap, aq, ar, as, at, av, aw;
  for (; q; q = aa) {
    r = f[x];
    ah = f[r + 2] - g;
    af = f[0] - f[r];
    ag = 1 - f[r + 1];
    av = ae * af * ah * ai;
    aj = h - w * p * ah;
    am = o + av * af;
    an = j * o * av * ag;
    ap = (am - m) * ad * (k - an - n) * a - v * c;
    ar = (aj - l) * c;
    if (a)
      ;
    else
    az:
      switch (d) {
      case 1:
        e = aw * i;
        break;
      case 2:
        exit(1);
      }
    s[0] = ap;
    t += at * aq;
    u = as += at * ar;
    if (c)
      goto az;
  }
  return e;
}