[Bug tree-optimization/29631] New: [4.1 regression] Incorrect zero extension of signed short IV

[Bug tree-optimization/29631] New: [4.1 regression] Incorrect zero extension of signed short IV

[falk at debian dot org]

This is extracted from gnushogi (http://bugs.debian.org/393075).

falk@juist:~% cat bug.c
const signed char nunmap[] = { 17, -1, 1 };

__attribute__((noinline))
void ff(int i) {
    asm volatile("");
}

__attribute__((noinline))
void f(short delta) {
    short p0 = 2, s;
    for (s = 0; s < 2; s++) {
        p0 += delta;
        ff(s);
        if (nunmap[p0] == 17)
            asm volatile("# nop");
    }
}

int main() {
    f(-1);
    return 0;
}

falk@juist:~% gcc-3.4 -O2 bug.c && ./a.out   
falk@juist:~% gcc-4.2 -O2 bug.c && ./a.out    
falk@juist:~% gcc-4.1 -O2 bug.c && ./a.out 
zsh: segmentation fault (core dumped)  ./a.out

Reason seems to be that delta is zero extended, not sign extended:

$f..ng:
        lda $30,-32($30)
        ldah $1,nunmap($29)             !gprelhigh
        lda $1,nunmap($1)               !gprellow
        stq $9,8($30)
        stq $10,16($30)
        mov $31,$9
        stq $11,24($30)
        lda $10,3($1)        # $10 = numap + 3
        zapnot $16,3,$11     # $11 = zero extend delta (=65535)
        stq $26,0($30)
        .prologue 1
$L4:
        addq $10,$11,$10     # $10 += $11
        addl $31,$9,$16
        bsr $26,ff              !samegp
        ldq_u $1,-1($10)     # access numap[65537] -> SEGV
        extqh $1,$10,$1
        sra $1,56,$1
        cmpeq $1,17,$1
        bne $1,$L12
$L5:
        lda $9,1($9)
        cmpeq $9,2,$1
        beq $1,$L4
        ldq $26,0($30)
        ldq $9,8($30)
        ldq $10,16($30)
        ldq $11,24($30)
        lda $30,32($30)
        ret $31,($26),1
        .align 4
$L12:
        .set    macro
        # nop
        .set    nomacro
        br $31,$L5


-- 
           Summary: [4.1 regression] Incorrect zero extension of signed
                    short IV
           Product: gcc
           Version: 4.1.2
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: falk at debian dot org
 GCC build triplet: alpha-linux-gnu
  GCC host triplet: alpha-linux-gnu
GCC target triplet: alpha-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug middle-end/29631] [4.1 regression] Incorrect zero extension of signed short IV

[pinskia at gcc dot gnu dot org]

------- Comment #1 from pinskia at gcc dot gnu dot org  2006-10-28 23:05 -------
What happens if you try -O2 -fno-loop-optimize?


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |middle-end
      Known to work|                            |4.2.0
   Target Milestone|---                         |4.1.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug middle-end/29631] [4.1 regression] Incorrect zero extension of signed short IV

[falk at debian dot org]

------- Comment #2 from falk at debian dot org  2006-10-28 23:13 -------
(In reply to comment #1)
> What happens if you try -O2 -fno-loop-optimize?

No crash then.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug rtl-optimization/29631] [4.1 regression] Incorrect zero extension of signed short IV

[pinskia at gcc dot gnu dot org]

------- Comment #3 from pinskia at gcc dot gnu dot org  2006-10-28 23:19 -------
> No crash then.
So this is another loop.c bug.  This is why it was removed, it was full of bugs
:).


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  BugsThisDependsOn|                            |28970
          Component|middle-end                  |rtl-optimization


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug rtl-optimization/29631] [4.1 regression] Incorrect zero extension of signed short IV

[ebotcazou at gcc dot gnu dot org]

------- Comment #4 from ebotcazou at gcc dot gnu dot org  2006-10-29 11:35 -------
> So this is another loop.c bug.

Confirmed.

> This is why it was removed, it was full of bugs :).

With this criterion VRP wouldn't have survived either. :-)


-- 

ebotcazou at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2006-10-29 11:35:30
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug rtl-optimization/29631] [4.1 regression] Incorrect zero extension of signed short IV

[ebotcazou at gcc dot gnu dot org]

------- Comment #5 from ebotcazou at gcc dot gnu dot org  2006-10-29 11:35 -------
Investigating.


-- 

ebotcazou at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |ebotcazou at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED
   Last reconfirmed|2006-10-29 11:35:30         |2006-10-29 11:35:52
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug rtl-optimization/29631] [4.1 regression] Incorrect zero extension of signed short IV

[ebotcazou at gcc dot gnu dot org]

------- Comment #6 from ebotcazou at gcc dot gnu dot org  2006-10-29 21:40 -------
It's another fallout of PR middle-end/25125.  In final_cleanup:

  short unsigned int pretmp.53;
  short int p0;

<bb 0>:
  pretmp.53 = (short unsigned int) delta;
  p0 = 2;
  ivtmp.59 = 0;

<L0>:;
  p0 = (short int) (pretmp.53 + (short unsigned int) p0);


I'm a little concerned about patching loop.c at this point, this could
pessimize especially on Alpha.  Experimenting...


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug rtl-optimization/29631] [4.1 regression] bug with promoted induction variable

[ebotcazou at gcc dot gnu dot org]

------- Comment #7 from ebotcazou at gcc dot gnu dot org  2006-10-31 23:34 -------
Subject: Bug 29631

Author: ebotcazou
Date: Tue Oct 31 23:34:05 2006
New Revision: 118346

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=118346
Log:
        PR rtl-optimization/29631
        * loop.c (basic_induction_var): Add new parameter inner_mode.
        <PLUS>: If set, convert the increment to it before sign-extending.
        <CONST_INT>: Likewise.
        <SUBREG>: Set it.
        <ASHIFTRT>: Likewise.  Return 0 if flag_wrapv.


Added:
    branches/gcc-4_1-branch/gcc/testsuite/gcc.c-torture/execute/20061031-1.c
Modified:
    branches/gcc-4_1-branch/gcc/ChangeLog
    branches/gcc-4_1-branch/gcc/loop.c
    branches/gcc-4_1-branch/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631

[Bug rtl-optimization/29631] [4.1 regression] bug with promoted induction variable

[ebotcazou at gcc dot gnu dot org]

------- Comment #8 from ebotcazou at gcc dot gnu dot org  2006-10-31 23:38 -------
Should be fixed now.


-- 

ebotcazou at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |http://gcc.gnu.org/ml/gcc-
                   |                            |patches/2006-
                   |                            |10/msg01750.html
             Status|ASSIGNED                    |RESOLVED
      Known to fail|                            |3.4.0
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29631