https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117744

            Bug ID: 117744
           Summary: cprop_hardreg deleted an insns that's not dead
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gjl at gcc dot gnu.org
  Target Milestone: ---

Created attachment 59677
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=59677&action=edit
pr111683-1.c: C test case

$ avr-gcc pr111683-1.c -mmcu=atmega103 -O2 -da -S

In the pr111683-1.c.338r.fold_mem_offsets dump, there are the following insns:

(insn 859 528 860 3 (parallel [
            (set (reg:QI 26 r26)
                (reg:QI 8 r8))
            (clobber (reg:CC 36 cc))
        ]) "pr111683-1.c":15:44 89 {movqi_insn}
     (expr_list:REG_UNUSED (reg:CC 36 cc)
        (nil)))
(insn 860 859 529 3 (parallel [
            (set (reg:QI 27 r27)
                (reg:QI 9 r9))
            (clobber (reg:CC 36 cc))
        ]) "pr111683-1.c":15:44 89 {movqi_insn}
     (expr_list:REG_UNUSED (reg:CC 36 cc)
        (nil)))
(note 529 860 530 3 NOTE_INSN_DELETED)
(insn 530 529 531 3 (parallel [
            (set (reg:QI 27 r27)
                (mem:QI (plus:HI (reg:HI 26 r26)
                        (const_int 7 [0x7])) [1 MEM[(long long int *)_48]+7 S1
A8]))
            (clobber (reg:CC 36 cc))
        ]) "pr111683-1.c":15:44 89 {movqi_insn}
     (expr_list:REG_DEAD (reg:QI 26 r26)
        (expr_list:REG_UNUSED (reg:CC 36 cc)
            (nil))))

What they are doing is

r26:QI = r8:QI     ; insn 859
r27:QI = r9:QI     ; insn 860
r27:QI = * r26:HI  ; insn 530

But in pr111683-1.c.339r.cprop_hardreg:

...
deferring deletion of insn with uid = 859.
...
(insn 860 528 529 3 (parallel [
            (set (reg:QI 27 r27)
                (reg:QI 9 r9))
            (clobber (reg:CC 36 cc))
        ]) "pr111683-1.c":15:44 89 {movqi_insn}
     (expr_list:REG_UNUSED (reg:CC 36 cc)
        (nil)))
(note 529 860 530 3 NOTE_INSN_DELETED)
(insn 530 529 531 3 (parallel [
            (set (reg:QI 27 r27)
                (mem:QI (plus:HI (reg:HI 26 r26)
                        (const_int 7 [0x7])) [1 MEM[(long long int *)_48]+7 S1
A8]))
            (clobber (reg:CC 36 cc))
        ]) "pr111683-1.c":15:44 89 {movqi_insn}
     (expr_list:REG_DEAD (reg:QI 26 r26)
        (expr_list:REG_UNUSED (reg:CC 36 cc)
            (nil))))

Thus, insn 530 is reading from a wrong address and the program crashes.

Target: avr
Configured with: ../../source/gcc-master/configure --target=avr --disable-nls
--with-dwarf2 --with-gnu-as --with-gnu-ld --disable-shared
--with-long-double=64 --enable-languages=c,c++
Thread model: single
Supported LTO compression algorithms: zlib
gcc version 15.0.0 20241122 (experimental) (GCC) 

Notice that insns 859 and 860 are produced by a relatively new avr
optimization, and therefore bi-secting won't reveal where the cprop_hardreg bug
was introduced.

Reply via email to