[4.8 Regression] unable to find a register to spill in class 'LO_REGS'

[Matthias Klose]

seen with the 4.8 branch on arm-linux-gnueabihf, configured with
--with-arch=armv7-a --with-fpu=vfpv3-d16 --with-float=hard --with-mode=thumb

omitting the -fno-tree-dce works around the issue. not seen with the 4.7 branch and trunk 20140306.

$ g++ -std=c++11 -fPIC -fno-tree-dce -fno-exceptions -fno-omit-frame-pointer -c -g -O2 JITArithmetic32_64.ii
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp: In member function 'void JSC::JIT::emit_op_add(JSC::Instruction*)':
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:526:1: error: unable to find a register to spill in class 'LO_REGS'
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:526:1: error: this is the insn:
(insn 335 334 336 20 (parallel [
            (set (reg:SI 3 r3)
                (ior:SI (eq:SI (reg/v:SI 112 [ op ])
                        (reg/v:SI 110 [ dst ]))
                    (eq:SI (reg/v:SI 111 [ op ])
                        (reg/v:SI 110 [ dst ]))))
            (clobber (reg:CC 100 cc))
        ]) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:514 295 {*ior_scc_scc}
     (expr_list:REG_UNUSED (reg:CC 100 cc)
        (nil)))
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:526: confused by earlier errors, bailing out
Preprocessed source stored into /tmp/ccb0Osgc.out file, please attach this to your bugreport.

[Doko-v (doko-v)]

Created attachment 32424
preprocessed source

seen with the 4.8 branch on arm-linux-gnueabihf, configured with
--with-arch=armv7-a --with-fpu=vfpv3-d16 --with-float=hard --with-mode=thumb

omitting the -fno-tree-dce works around the issue. not seen with the 4.7 branch and trunk 20140306.

$ g++ -std=c++11 -fPIC -fno-tree-dce -fno-exceptions -fno-omit-frame-pointer -c -g -O2 JITArithmetic32_64.ii
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp: In member function 'void JSC::JIT::emit_op_add(JSC::Instruction*)':
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:526:1: error: unable to find a register to spill in class 'LO_REGS'
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:526:1: error: this is the insn:
(insn 335 334 336 20 (parallel [
            (set (reg:SI 3 r3)
                (ior:SI (eq:SI (reg/v:SI 112 [ op ])
                        (reg/v:SI 110 [ dst ]))
                    (eq:SI (reg/v:SI 111 [ op ])
                        (reg/v:SI 110 [ dst ]))))
            (clobber (reg:CC 100 cc))
        ]) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:514 295 {*ior_scc_scc}
     (expr_list:REG_UNUSED (reg:CC 100 cc)
        (nil)))
../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:526: confused by earlier errors, bailing out
Preprocessed source stored into /tmp/ccb0Osgc.out file, please attach this to your bugreport.

[Rguenth (rguenth)]

-fno-tree-dce is certainly not a good idea ... (doesn't make it a non-bug, of course).

[Kumar Venkataramanan (venkataramanan-kumar)]

This seems to be issue with reload and I am able to reproduce this is with FSF 4.8 and 4.7 branch.

This is not visible in trunk. To reproduce this in trunk turn off LRA ( -mno-lra)

[Venkataramanan-kumar-e (venkataramanan-kumar-e)]

This bug occurrs with GCC trunk as well with IRA and reload.
Can be reproduced with -std=c++11 -fno-tree-dce -fno-omit-frame-pointer -O2 -mno-lra.

[Kumar Venkataramanan (venkataramanan-kumar)]

There is difference in machine descritptions writtem for *ior_scc_scc pattern.

GCC 4.8 branch, *ior_scc_scc pattern is

(define_insn_and_split "*ior_scc_scc"
  [(set (match_operand:SI 0 "s_register_operand" "=r")
        (ior:SI (match_operator:SI 3 "arm_comparison_operator"
                 [(match_operand:SI 1 "s_register_operand" "r")
                  (match_operand:SI 2 "arm_add_operand" "rIL")])
                (match_operator:SI 6 "arm_comparison_operator"
                 [(match_operand:SI 4 "s_register_operand" "r")
                  (match_operand:SI 5 "arm_add_operand" "rIL")])))
   (clobber (reg:CC CC_REGNUM))]

In GCC 4.9 tunk

(define_insn_and_split "*ior_scc_scc"
  [(set (match_operand:SI 0 "s_register_operand" "=Ts")
        (ior:SI (match_operator:SI 3 "arm_comparison_operator"
                 [(match_operand:SI 1 "s_register_operand" "r")
                  (match_operand:SI 2 "arm_add_operand" "rIL")])
                (match_operator:SI 6 "arm_comparison_operator"
                 [(match_operand:SI 4 "s_register_operand" "r")
                  (match_operand:SI 5 "arm_add_operand" "rIL")])))
   (clobber (reg:CC CC_REGNUM))]

Which defines a new constarint "Ts"and gives it general register set when "it" support is not restriccted

(define_register_constraint "Ts" "(arm_restrict_it) ? LO_REGS : GENERAL_REGS"
 "For arm_restrict_it the core registers @code{r0}-@code{r7}. GENERAL_REGS otherwise."

This is the only difference in machinde descriptions. But this does not fixes the bug. I still count on LRA is able to satisfy the constraint while reload still fails even in trunk.

[Venkataramanan-kumar-e (venkataramanan-kumar-e)]

The bug is now hidden in trunk by revision 209897

The patch "Remove PUSH_ARGS_REVERSED from the RTL expander"
(reference below) seems to change the way arguments are handled in RTL.

Ref: http://gcc.gnu.org/git/?p=gcc.git;a=commit;h=bf29c577b9128551d76adc5b0331d375be49d7d3

[Venkataramanan-kumar-e (venkataramanan-kumar-e)]

Reverting this patch in 209897 bug still occurs in trunk with -mno-lra.

SPILL failure occurs for regno 110 ("dst" operand) in below instruction

(insn 634 633 635 27 (parallel [
            (set (reg:SI 3 r3)
                (ior:SI (eq:SI (reg/v:SI 110 [ dst ]) <== This operand r5 is registers gets assigned
                        (reg/v:SI 112 [ op2 ]))
                    (eq:SI (reg/v:SI 110 [ dst ]) <== This operand
                        (reg/v:SI 111 [ op1 ]))))
            (clobber (reg:CC 100 cc))
        ]) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:179 300 {*ior_scc_scc

First observation is that reload is not able to reuse "r5" that was used in second reload in operation for the same register id 110 "dst"

The IRA Dump shows.

(insn 632 631 633 27 (set (reg:SI 1 r1)
        (reg/v:SI 110 [ dst ])) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:179 667 {*thumb2_movsi_vfp}
     (nil))
(insn 633 632 634 27 (set (reg:SI 2 r2)
        (const_int 0 [0])) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:179 667 {*thumb2_movsi_vfp}
     (nil))
(insn 634 633 635 27 (parallel [
            (set (reg:SI 3 r3)
                (ior:SI (eq:SI (reg/v:SI 110 [ dst ])
                        (reg/v:SI 112 [ op2 ]))
                    (eq:SI (reg/v:SI 110 [ dst ])
                        (reg/v:SI 111 [ op1 ]))))
            (clobber (reg:CC 100 cc))
        ]) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:179 300 {*ior_scc_scc}

The register operand 110 "dst" is already passed as argument 1 and hence gets register r1. See insn 632.

But this is not reused by insn 634.

However there are some other places in IRA dump where the same expression occurs and there register r1 is used. Here operand "dst" 110 is marked as dead.

(insn 431 430 433 24 (set (reg:SI 1 r1)
        (reg/v:SI 110 [ dst ])) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:388 667 {*thumb2_movsi_vfp}
     (expr_list:REG_DEAD (reg/v:SI 110 [ dst ])
        (nil)))

(insn 433 431 432 24 (parallel [
            (set (reg:SI 3 r3)
                (ior:SI (eq:SI (reg/v:SI 112 [ op ])
                        (reg:SI 1 r1))
                    (eq:SI (reg/v:SI 111 [ op ])
                        (reg:SI 1 r1))))
            (clobber (reg:CC 100 cc))
        ]) ../Source/JavaScriptCore/jit/JITArithmetic32_64.cpp:388 300 {*ior_scc_scc

Still working on why IRA is not replacing the operand with R1 here, but replaces in other places.

[Rguenth (rguenth)]

GCC 4.8.3 is being released, adjusting target milestone.

[Kumar Venkataramanan (venkataramanan-kumar)]

This Bug is now tracked here https://bugs.linaro.org/show_bug.cgi?id=401

[Jakub-gcc (jakub-gcc)]

GCC 4.8.4 has been released.