Bug 110271 - [14 Regression] UICE on pycryptodome-3.17.0 during GIMPLE pass: widening_mul: in gsi_replace, at gimple-iterator.cc:437
Summary: [14 Regression] UICE on pycryptodome-3.17.0 during GIMPLE pass: widening_mul:...
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 14.0
: P3 normal
Target Milestone: 14.0
Assignee: Not yet assigned to anyone
URL:
Keywords:
: 110296 (view as bug list)
Depends on:
Blocks:
 
Reported: 2023-06-15 18:09 UTC by Sergei Trofimovich
Modified: 2023-06-17 08:34 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2023-06-15 00:00:00


Attachments
mont.c.c.orig.xz (99.82 KB, application/x-xz)
2023-06-15 18:11 UTC, Sergei Trofimovich
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sergei Trofimovich 2023-06-15 18:09:27 UTC
Found an ICE on pycryptodome-3.17.0 when building against r14-1868-ga4df0ce78d6f1b

Reduced example:

// $ cat mont.c.c
unsigned square_sum_hi, square_sum_lo, square_tmp, square_carry, square_tmp2;
void square(unsigned *t, int nw) {
  int i = 0;
  for (; i < nw; i++) {
    square_sum_lo += square_carry;
    square_sum_hi += square_sum_lo < square_carry;
    square_sum_hi += square_tmp = (unsigned long)t > 3;
    square_carry = t[1] + (square_sum_hi < square_tmp);
    square_sum_hi += square_tmp2;
    square_carry += square_sum_hi < square_tmp2;
  }
}
void mont_mult(void) {
  unsigned *t;
  square(t, 9);
}

$ gcc  -fwrapv -O3  -c mont.c.c -o moujnt.o -mavx2 -Wall -Wextra
mont.c.c: In function 'mont_mult':
mont.c.c:15:3: warning: 't' is used uninitialized [-Wuninitialized]
   15 |   square(t, 9);
      |   ^~~~~~~~~~~~
mont.c.c:14:13: note: 't' was declared here
   14 |   unsigned *t;
      |             ^
during GIMPLE pass: widening_mul
mont.c.c:13:6: internal compiler error: in gsi_replace, at gimple-iterator.cc:437
   13 | void mont_mult(void) {
      |      ^~~~~~~~~
0x6bcf05 gsi_replace(gimple_stmt_iterator*, gimple*, bool)
        ../../source/gcc/gimple-iterator.cc:437
0xe203f4 match_uaddc_usubc
        ../../source/gcc/tree-ssa-math-opts.cc:4880
0xe296f1 after_dom_children
        ../../source/gcc/tree-ssa-math-opts.cc:5581
0x1886063 dom_walker::walk(basic_block_def*)
        ../../source/gcc/domwalk.cc:354
0xe1d76d execute
        ../../source/gcc/tree-ssa-math-opts.cc:5658
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ gcc -v |& unnix
Using built-in specs.
COLLECT_GCC=/<<NIX>>/gcc-14.0.0/bin/gcc
COLLECT_LTO_WRAPPER=/<<NIX>>/gcc-14.0.0/libexec/gcc/x86_64-unknown-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with:
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 99999999 (experimental) (GCC)
Comment 1 Sergei Trofimovich 2023-06-15 18:11:35 UTC
Created attachment 55330 [details]
mont.c.c.orig.xz

In case I reduced it too much mont.c.c.orig.xz is the original preprocessed file. ICEs with identical compiler options.
Comment 2 Andrew Pinski 2023-06-15 19:19:09 UTC
99% sure it was introduced with r14-1837-g43a3252c42af12 .
Comment 3 Andrew Pinski 2023-06-15 19:34:30 UTC
Confirmed.
Comment 4 Jakub Jelinek 2023-06-15 20:52:57 UTC
The problem is that I thought match_arith_overflow returns true if it replaced something, but that is not the case, it only returns true for the BIT_NOT_EXPR case when it removed the stmt.
So, I think the right test for whether match_arith_overflow actually replaced something is whether gsi_stmt (gsi) == stmt.
Comment 5 GCC Commits 2023-06-16 17:48:57 UTC
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:5b67116a85298bbe358b036d34ad23119cebbdac

commit r14-1895-g5b67116a85298bbe358b036d34ad23119cebbdac
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Fri Jun 16 19:46:36 2023 +0200

    tree-ssa-math-opts: Fix up uaddc/usubc pattern matching [PR110271]
    
    The following testcase ICEs, because I misremembered what the return value
    from match_arith_overflow is.  It isn't true if __builtin_*_overflow was
    matched, but it is true only in the BIT_NOT_EXPR case if stmt was removed.
    
    So, if match_arith_overflow matches something, gsi_stmt (gsi) will not
    be stmt and match_uaddc_usubc will be confused and can ICE.
    
    The following patch fixes it by checking if gsi_stmt (gsi) == stmt,
    in that case we know it is still a PLUS_EXPR/MINUS_EXPR and we can try to
    pattern match it further as UADDC/USUBC.
    
    2023-06-16  Jakub Jelinek  <jakub@redhat.com>
    
            PR tree-optimization/110271
            * tree-ssa-math-opts.cc (math_opts_dom_walker::after_dom_children)
            <case PLUS_EXPR>: Ignore return value from match_arith_overflow,
            instead call match_uaddc_usubc only if gsi_stmt (gsi) is still stmt.
    
            * gcc.c-torture/compile/pr110271.c: New test.
Comment 6 Jakub Jelinek 2023-06-16 18:02:08 UTC
Should be fixed now.
Comment 7 Sergei Trofimovich 2023-06-16 20:43:49 UTC
I confirm the fix also fixes pycryptodome-3.17.0 package build. Thank you!
Comment 8 Andrew Pinski 2023-06-17 08:34:26 UTC
*** Bug 110296 has been marked as a duplicate of this bug. ***