[Bug c/22348] New: Execution continues past end of for loop end condition with optimisation enabled

[Bug c/22348] New: Execution continues past end of for loop end condition with optimisation enabled

[matt+gccbugs at ucc dot asn dot au]

In a for loop with multiple variables, the end condition is not respected, execution continues past the end 
condition.

The small attached sample code runs fine with -O0 or with gcc-3.3, but fails with -O1, -Os, -O2 or -O3 
with gcc-4.0. Execution continues past the end of the loop, resulting in a segfault (buffer overflow).

Versions tested include 
gcc version 4.0.1 20050522 (prerelease) (Debian 4.0.0-9)
and 
gcc version 4.0.1 20050701 (prerelease) (Debian 4.0.0-12ubuntu2)

-- 
           Summary: Execution continues past end of for loop end condition
                    with optimisation enabled
           Product: gcc
           Version: 4.0.0
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: matt+gccbugs at ucc dot asn dot au
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug c/22348] Execution continues past end of for loop end condition with optimisation enabled

[matt+gccbugs at ucc dot asn dot au]

------- Additional Comments From matt+gccbugs at ucc dot asn dot au  2005-07-07 16:59 -------
Created an attachment (id=9223)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=9223&action=view)
failing testcase


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug c/22348] Execution continues past end of for loop end condition with optimisation enabled

[matt+gccbugs at ucc dot asn dot au]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #9223|application/octet-stream    |text/plain
          mime type|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |tree-optimization
  GCC build triplet|i686-pc-linux-gnu           |
   GCC host triplet|i686-pc-linux-gnu           |
 GCC target triplet|i686-pc-linux-gnu           |
           Keywords|                            |wrong-code
            Summary|Execution continues past end|[4.0 Regression] Execution
                   |of for loop end condition   |continues past end of for
                   |with optimisation enabled   |loop end condition with
                   |                            |optimisation enabled
   Target Milestone|---                         |4.0.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] Execution continues past end of for loop end condition with optimisation enabled

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-07-07 17:39 -------
Reduced testcase:
void abort (void);
void f(int i)
{
  if (i>4 + 3 * 16)
   abort();
}
int main()
{
 unsigned int buflen, i;
 buflen = 4 + 3 * 16;
 for (i = 4; i < buflen; i+= 3)
   f(i);
 return 0;
}

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2005-07-07 17:39:27
               date|                            |
            Summary|[4.0 Regression] Execution  |[4.0/4.1 Regression]
                   |continues past end of for   |Execution continues past end
                   |loop end condition with     |of for loop end condition
                   |optimisation enabled        |with optimisation enabled


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] IV canonicalization causes execution of loops past their end condition

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2005-07-14 20:33 -------
On mainline we have this .empty dump for main: 
 
;; Function main (main) 
 
main () 
{ 
  unsigned int i; 
  int D.1613; 
  int i.0; 
 
<bb 0>: 
 
  # i_2 = PHI <i_6(2), 4(0)>; 
<L0>:; 
  i.0_5 = (int) i_2; 
  f (i.0_5); 
  i_6 = i_2 + 3; 
  if (i_6 <= 51) goto <L6>; else goto <L2>; 
 
<L6>:; 
  goto <bb 1> (<L0>); 
 
<L2>:; 
  return 0; 
 
} 
 
 
and this .ivcanon dump, which is wrong: 
 
;; Function main (main) 
 
main () 
{ 
  unsigned int ivtmp.51; 
  unsigned int i; 
  int D.1613; 
  int i.0; 
 
<bb 0>: 
 
  # ivtmp.51_1 = PHI <ivtmp.51_3(2), 1431655782(0)>; 
  # i_2 = PHI <i_6(2), 4(0)>; 
<L0>:; 
  i.0_5 = (int) i_2; 
  f (i.0_5); 
  i_6 = i_2 + 3; 
  ivtmp.51_3 = ivtmp.51_1 - 1; 
  if (ivtmp.51_3 != 0) goto <L6>; else goto <L2>; 
 
<L6>:; 
  goto <bb 1> (<L0>); 
 
<L2>:; 
  return 0; 
 
} 

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rakdver at gcc dot gnu dot
                   |                            |org
           Priority|P2                          |P1
            Summary|[4.0/4.1 Regression]        |[4.0/4.1 Regression] IV
                   |Execution continues past end|canonicalization causes
                   |of for loop end condition   |execution of loops past
                   |with optimisation enabled   |their end condition


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] IV canonicalization causes execution of loops past their end condition

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2005-07-14 23:17 -------
Loop 1 iterates 1431655781 times  :-) 
 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] IV canonicalization causes execution of loops past their end condition

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2005-07-14 23:58 -------
Clearly something's fishy in number_of_iterations_cond.  But I honestly don't 
understand that code.  Zdenek, can you please look at this one? 
 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] IV canonicalization causes execution of loops past their end condition

[rakdver at gcc dot gnu dot org]

------- Additional Comments From rakdver at gcc dot gnu dot org  2005-07-15 09:47 -------
This seems to be some curious bug in fold; the following patch fixes the problem
mysteriously :-)

Index: tree-ssa-loop-niter.c
===================================================================
RCS file: /cvs/gcc/gcc/gcc/tree-ssa-loop-niter.c,v
retrieving revision 2.32
diff -c -3 -p -r2.32 tree-ssa-loop-niter.c
*** tree-ssa-loop-niter.c       28 Jun 2005 00:52:25 -0000      2.32
--- tree-ssa-loop-niter.c       15 Jul 2005 09:45:01 -0000
*************** number_of_iterations_cond (tree type, tr
*** 273,279 ****
        step = fold_unary_to_constant (NEGATE_EXPR, type, step1);
        else
        step = step0;
!       delta = build2 (MINUS_EXPR, type, base1, base0);
        delta = fold_build2 (FLOOR_MOD_EXPR, type, delta, step);
        may_xform = boolean_false_node;

--- 273,279 ----
        step = fold_unary_to_constant (NEGATE_EXPR, type, step1);
        else
        step = step0;
!       delta = fold_build2 (MINUS_EXPR, type, base1, base0);
        delta = fold_build2 (FLOOR_MOD_EXPR, type, delta, step);
        may_xform = boolean_false_node;


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] IV canonicalization causes execution of loops past their end condition

[rakdver at gcc dot gnu dot org]

------- Additional Comments From rakdver at gcc dot gnu dot org  2005-07-15 10:09 -------
extract_muldiv(51 - 7, 3, FLOOR_MOD_EXPR) returns incorrectly 0.

The reason is that 51 - 7 is replaced with 51 + ~6, and both 51 and ~6 are
divisible by 3, so the result obviously is 0 :-) Someone forgot about overflows.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] IV canonicalization causes execution of loops past their end condition

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-07-27 14:04 -------
Subject: Bug 22348

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	rakdver@gcc.gnu.org	2005-07-27 14:04:17

Modified files:
	gcc            : ChangeLog tree-ssa-loop-niter.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/gcc.c-torture/execute: pr22348.c 

Log message:
	PR tree-optimize/22348
	* tree-ssa-loop-niter.c (number_of_iterations_cond):
	Fold the partial computation.
	
	* gcc.c-torture/execute/pr22348.c: New.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&r1=2.9564&r2=2.9565
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-ssa-loop-niter.c.diff?cvsroot=gcc&r1=2.33&r2=2.34
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&r1=1.5828&r2=1.5829
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gcc.c-torture/execute/pr22348.c.diff?cvsroot=gcc&r1=NONE&r2=1.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] Wrong folding for FLOOR_MOD_EXPR

[rakdver at gcc dot gnu dot org]

------- Additional Comments From rakdver at gcc dot gnu dot org  2005-07-27 14:07 -------
Not closing the PR, the workaround in number_of_iterations_cond just masks the 
problem. 

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[4.0/4.1 Regression] IV     |[4.0/4.1 Regression] Wrong
                   |canonicalization causes     |folding for FLOOR_MOD_EXPR
                   |execution of loops past     |
                   |their end condition         |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] Wrong folding for FLOOR_MOD_EXPR

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
OtherBugsDependingO|                            |23096
              nThis|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0/4.1 Regression] Execution continues past end of for loop end condition with optimisation enabled

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-07-27 16:37 -------
The work around is in but the new problem should have been filed as a new bug which I did as PR 
23096.

The testcase is now fixed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
OtherBugsDependingO|23096                       |
              nThis|                            |
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
            Summary|[4.0/4.1 Regression] Wrong  |[4.0/4.1 Regression]
                   |folding for FLOOR_MOD_EXPR  |Execution continues past end
                   |                            |of for loop end condition
                   |                            |with optimisation enabled


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-07-27 16:40 -------
Actually this was only fixed on the mainline, it also fails in 4.0.0 branch too.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |
            Summary|[4.0/4.1 Regression]        |[4.0 Regression] Execution
                   |Execution continues past end|continues past end of for
                   |of for loop end condition   |loop end condition with
                   |with optimisation enabled   |optimisation enabled


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |NEW


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[bonzini at gcc dot gnu dot org]

------- Additional Comments From bonzini at gcc dot gnu dot org  2005-08-29 14:37 -------
Could this apply to 4.0 as well?

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bonzini at gcc dot gnu dot
                   |                            |org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[rakdver at gcc dot gnu dot org]

------- Additional Comments From rakdver at gcc dot gnu dot org  2005-08-29 15:25 -------
The same workaround should work.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-09-01 16:09 -------
Subject: Bug 22348

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	apple-local-200502-branch
Changes by:	fjahanian@gcc.gnu.org	2005-09-01 16:09:12

Modified files:
	gcc            : ChangeLog.apple-ppc tree-ssa-loop-niter.c 
Added files:
	gcc/testsuite/gcc.c-torture/execute: pr22348.c 

Log message:
	Radar 4233894 (pr 22348)
	Oked by Stuart.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.apple-ppc.diff?cvsroot=gcc&only_with_tag=apple-local-200502-branch&r1=1.1.4.145&r2=1.1.4.146
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-ssa-loop-niter.c.diff?cvsroot=gcc&only_with_tag=apple-local-200502-branch&r1=2.20.4.1&r2=2.20.4.2
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gcc.c-torture/execute/pr22348.c.diff?cvsroot=gcc&only_with_tag=apple-local-200502-branch&r1=NONE&r2=1.1.10.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-09-08 10:09 -------
Subject: Bug 22348

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	gcc-4_0-branch
Changes by:	rguenth@gcc.gnu.org	2005-09-08 10:09:04

Modified files:
	gcc            : ChangeLog tree-ssa-loop-niter.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/gcc.c-torture/execute: pr22348.c 

Log message:
	2005-09-08  Richard Guenther  <rguenther@suse.de>
	Zdenek Dvorak  <rakdver@gcc.gnu.org>
	
	PR tree-optimization/22348
	* tree-ssa-loop-niter.c (number_of_iterations_cond): Fold
	MINUS_EXPR.
	
	* gcc.c-torture/execute/pr22348.c: New testcase.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=2.7592.2.418&r2=2.7592.2.419
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/tree-ssa-loop-niter.c.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=2.20&r2=2.20.8.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.5084.2.389&r2=1.5084.2.390
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gcc.c-torture/execute/pr22348.c.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=NONE&r2=1.1.14.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348

[Bug tree-optimization/22348] [4.0 Regression] Execution continues past end of for loop end condition with optimisation enabled

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-09-08 12:38 -------
Fixed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22348