Hi Manolis,

On 7/18/23 11:01, Jeff Law via Gcc-patches wrote:
> Vineet @ Rivos has indicated he stumbled across an ICE with the V3 
> code.  Hopefully he'll get a testcase for that extracted shortly. 

Yeah, I was trying to build SPEC2017 with this patch and ran into ICE 
for several of them with -Ofast build: The reduced test from 455.nab is 
attached here.
The issue happens with v2 as well, so not something introduced by v3.

There's ICE in cprop_hardreg which immediately follows f-m-o.


The protagonist is ins 93 which starts off in combine as a simple set of 
a DF 0.

| sff.i.288r.combine:(insn 93 337 94 8 (set (reg/v:DF 236 [ e ])
| sff.i.288r.combine- (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 
190 {*movdf_hardfloat_rv64}

Subsequently reload transforms it into SP + offset

| sff.i.303r.reload:(insn 93 337 94 9 (set (mem/c:DF (plus:DI (reg/f:DI 
2 sp)
| sff.i.303r.reload- (const_int 8 [0x8])) [4 %sfp+-8 S8 A64])
| sff.i.303r.reload- (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 190 
{*movdf_hardfloat_rv64}
| sff.i.303r.reload- (expr_list:REG_EQUAL (const_double:DF 0.0 [0x0.0p+0])

It gets processed by f-m-o and lands in cprop_hardreg, where it triggers 
ICE.

| (insn 93 337 523 11 (set (mem/c:DF (plus:DI (reg/f:DI 2 sp)
|                 (const_int 8 [0x8])) [4 %sfp+-8 S8 A64])
|         (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 -1
^^^
|      (expr_list:REG_EQUAL (const_double:DF 0.0 [0x0.0p+0])
|        (nil)))
| during RTL pass: cprop_hardreg

Here's my analysis:

f-m-o: do_check_validity() -> insn_invalid_p() tries to recog() a 
modified version of insn 93 (actually there is no change, so perhaps 
something we can optimize later). The corresponding md pattern 
movdf_hardfloat_rv64 no longer matches since it expects REG_P for 
operand0, while reload has converted it into SP + offset. f-m-o then 
does the right thing by invalidating INSN_CODE=-1 for a subsequent 
recog() to work correctly.
But it seems this -1 lingers into the next pass, and trips up 
copyprop_hardreg_forward_1() -> extract_constrain_insn()
So I don't know what the right fix here should be.

In a run with -fno-fold-mem-offsets, the same insn 93 is successfully 
grok'ed by cprop_hardreg,

| (insn 93 337 522 11 (set (mem/c:DF (plus:DI (reg/f:DI 2 sp)
|                (const_int 8 [0x8])) [4 %sfp+-8 S8 A64])
|        (const_double:DF 0.0 [0x0.0p+0])) "sff.i":23:11 190 
{*movdf_hardfloat_rv64}
^^^^^^^^^^^^^^^
|     (expr_list:REG_EQUAL (const_double:DF 0.0 [0x0.0p+0])
|        (nil)))

P.S. I wonder if it is a good idea in general to call recog() post 
reload since the insn could be changed sufficiently to no longer match 
the md patterns. Of course I don't know the answer.

P.S.2 When debugging code, I noticed a minor annoyance in the patch with 
the whole fold_mem_offsets_driver() switch-case indirection. It doesn't 
seem to be serving any purpose, and we could simply call corresponding 
do_* routines in execute () itself.

Thx,
-Vineet