[Bug debug/43290] New: ICE in dwarf2out_frame_debug_expr

["jakub at gcc dot gnu dot org" <gcc-bugzilla at gcc dot gnu dot org>]

I have only reproducer for this on redhat/gcc-4_4-branch, though I believe the
problem is just latent on vanilla 4.4 branch and likely on the trunk too,
therefore I want to discuss this here.

namespace std
{
  template <class> struct char_traits;
}
typedef struct { union { char __wchb[4]; }; } mbstate_t;
namespace std
{
  template <typename _StateT> struct fpos
  {
    long long _M_off;
    _StateT _M_state;
    fpos (long long):_M_off (), _M_state () { }
    _StateT state () { return _M_state; }
  };
  typedef fpos <mbstate_t> streampos;
}
namespace std
{
  template <> struct char_traits <char>
  {
    typedef streampos pos_type;
    typedef long long off_type;
    typedef mbstate_t state_type;
  };
}
struct pthread_mutex_t;
namespace
{
  enum _Ios_Openmode { _S_in = 3, _S_out };
  enum _Ios_Seekdir { _S_beg };
  struct ios_base
  {
    typedef _Ios_Openmode openmode;
    static const openmode in = _S_in;
    static const openmode out = _S_out;
    typedef _Ios_Seekdir seekdir;
    static const seekdir beg = _S_beg;
  };
  template < typename _CharT, typename > struct basic_streambuf
  {
    typedef _CharT char_type;
    char_type * _M_in_beg;
    char_type *eback () { return _M_in_beg; }
    char_type *gptr () {}
  };
}
namespace std
{
  typedef struct pthread_mutex_t __c_lock;
  template <typename> class __basic_file;
  template <> struct __basic_file <char>
  {
    __basic_file (__c_lock * = 0);
    bool is_open ();
  };
  template <typename _CharT, typename _Traits> struct basic_filebuf : public
basic_streambuf <_CharT, _Traits>
  {
    typedef _CharT char_type;
    typedef _Traits traits_type;
    typedef typename traits_type::pos_type pos_type;
    typedef typename traits_type::off_type off_type;
    typedef __basic_file < char >__file_type;
    typedef typename traits_type::state_type __state_type;
    __file_type _M_file;
    char_type *_M_pback_cur_save;
    bool _M_pback_init;
    void _M_destroy_pback () throw ()
    {
_M_pback_cur_save += this->gptr () != this->eback ();
_M_pback_init = false;
    }
    bool is_open () throw () { return _M_file.is_open (); }
    pos_type seekpos (pos_type, ios_base::openmode = ios_base::in |
ios_base::out);
    pos_type _M_seek (off_type, ios_base::seekdir, __state_type);
  };
  template <typename _CharT, typename _Traits>
  typename basic_filebuf <_CharT, _Traits>::pos_type
  basic_filebuf <_CharT, _Traits>::seekpos (pos_type __pos, ios_base::openmode)
  {
    pos_type __ret = (off_type ());
    if (this->is_open ())
      {
_M_destroy_pback ();
__ret = _M_seek (off_type (), ios_base::beg, __pos.state ());
      }
    return __ret;
  }
  template class basic_filebuf <char, char_traits <char> >;
}

ICEs on redhat/gcc-4_4-branch when compiled with -O3 -mavx -fPIC -m32
-mtune=core2 with:
snb.ii: In member function â??typename std::basic_filebuf<_CharT,
_Traits>::pos_type std::basic_filebuf<_CharT, _Traits>::seekpos(typename
_Traits::pos_type, <unnamed>::_Ios_Openmode) [with _CharT = char, _Traits =
std::char_traits<char>]â??:
snb.ii:87: internal compiler error: in dwarf2out_frame_debug_expr, at
dwarf2out.c:2492

Vanilla 4.4 branch generates very similar rtl, the only change seems to be
slightly different sched2 decition.
It compiles seekpos into:
        .cfi_startproc
        .cfi_personality 0x9b,DW.ref.__gxx_personality_v0
        .cfi_lsda 0x1b,.LLSDA9
        # basic block 2
        leal    4(%esp), %ecx
        .cfi_def_cfa 1, 0
        andl    $-32, %esp
        pushl   -4(%ecx)
        pushl   %ebp
        movl    %esp, %ebp
        .cfi_escape 0x10,0x5,0x1,0x55
        subl    $120, %esp
        movl    %ebx, 108(%esp)
        movl    %ecx, 104(%esp)
        .cfi_escape 0xf,0x3,0x75,0x70,0x6
        movl    %esi, 112(%esp)
        movl    %edi, 116(%esp)
        call    .L17
.L17:
        popl    %ebx
        addl    $_GLOBAL_OFFSET_TABLE_+[.-.L17], %ebx
        .cfi_escape 0x10,0x7,0x2,0x75,0x7c
        .cfi_escape 0x10,0x6,0x2,0x75,0x78
        .cfi_escape 0x10,0x3,0x2,0x75,0x74
        movl    (%ecx), %esi
        movl    %ecx, -60(%ebp)

but redhat/gcc-4_4-branch reorders the %ecx stores, so after sp = sp - 120
there is:
        subl    $120, %esp
        movl    %ecx, -60(%ebp)
        movl    %ebx, 108(%esp)
        movl    %esi, 112(%esp)
        movl    %ecx, 104(%esp)
        movl    %edi, 116(%esp)
([ebp-60] = ecx got moved earlier, and [sp+108] = ecx got moved later).
Given that both of these ecx stores are frame related, I don't see anything
wrong on that scheduling decision.
But when processing the frame related insns in dwarf2out, after sp = sp - 120
we have:
(gdb) p cfa
$1 = {offset = 0, base_offset = 0, reg = 2, indirect = 0, in_use = 0}
(gdb) p cfa_temp
$2 = {offset = 0, base_offset = 0, reg = 2, indirect = 0, in_use = 0}
(gdb) p cfa_store
$3 = {offset = 120, base_offset = 0, reg = 7, indirect = 0, in_use = 0}
and so ICE, because we don't know what offset to use:
2488    if (cfa_store.reg == (unsigned) regno)
2489      offset -= cfa_store.offset;
2490    else
2491      {
2492        gcc_assert (cfa_temp.reg == (unsigned) regno);
2493        offset -= cfa_temp.offset;
2494      }
The store using ebp comes from the code before IRA starting with
(set (reg:SI 71) (reg:SI %ecx)) and IRA spilling reg:SI 71 to the stack.
This insn has been created by ix86_get_drap_rtx ():
8098      drap_vreg = copy_to_reg (arg_ptr);
The second store of %ecx comes from prologue expansion.


-- 
           Summary: ICE in dwarf2out_frame_debug_expr
           Product: gcc
           Version: 4.4.4
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: debug
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: jakub at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43290