[Bug c/42231] New: [4.4.x Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[Bug c/42231] New: [4.4.x Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[roche+gccbugs at exalead dot com]

Bug reproduced with GCC 4.4.2 and GCC 4.4.1, on x86_64.

The following simple test program should succeed (EXIT_SUCCESS return code from
main()), but fails with GCC 4.4.2 when compiling with -O3.

The program succeed with "-O2", _AND_ "-O2 -finline-functions -funswitch-loops
-fpredictive-commoning -fgcse-after-reload -ftree-vectorize" (which is supposed
to be the same as -O3, according to the manual, but there must be some
additional optimization out there)

The problem might be related to some inlining magic of the callback function,
because
* if you remove the "&& !fun(0);" in the CallFunction() function, the program
works again.
* if you change the function arguments "int depth" into "const int depth", the
program works again
* when the program works (for example, by adding "const" to the function
arguments), the callback function "callback" is NOT inlined


-- 
           Summary: [4.4.x Regression] Wrong generated code when using a
                    callback function (possible callback function inlining
                    bug ?)
           Product: gcc
           Version: 4.4.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: roche+gccbugs at exalead dot com
GCC target triplet: x86_64-unknown-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug c/42231] [4.4.x Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[roche+gccbugs at exalead dot com]

------- Comment #1 from roche+gccbugs at exalead dot com  2009-11-30 14:29 -------
Created an attachment (id=19188)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=19188&action=view)
The test program (exit code is meaningful)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug c/42231] [4.4.x Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[roche+gccbugs at exalead dot com]

------- Comment #2 from roche+gccbugs at exalead dot com  2009-11-30 14:38 -------
Created an attachment (id=19189)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=19189&action=view)
The preprocessor version


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug c/42231] [4.4.x Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[roche+gccbugs at exalead dot com]

------- Comment #3 from roche+gccbugs at exalead dot com  2009-11-30 14:38 -------
Created an attachment (id=19190)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=19190&action=view)
The assembly source version


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[rguenth at gcc dot gnu dot org]

------- Comment #4 from rguenth at gcc dot gnu dot org  2009-11-30 14:46 -------
Confirmed.  Works with 4.5 and with -fno-ipa-cp.

IPA lattices after propagation:

Lattice:
  Node: main:
  Node: callback:
    param [0]: type is CONST 0

which is obviously wrong.  On trunk the same propagation result is achived
but somehow we do not miscompile there.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |NEW
          Component|c                           |tree-optimization
     Ever Confirmed|0                           |1
           Keywords|                            |wrong-code
      Known to fail|                            |4.4.3
      Known to work|                            |4.3.4 4.5.0
   Last reconfirmed|0000-00-00 00:00:00         |2009-11-30 14:46:30
               date|                            |
            Summary|[4.4.x Regression] Wrong    |[4.4 Regression] Wrong
                   |generated code when using a |generated code when using a
                   |callback function (possible |callback function (possible
                   |callback function inlining  |callback function inlining
                   |bug ?)                      |bug ?)
   Target Milestone|---                         |4.4.3


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[rguenth at gcc dot gnu dot org]

-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|4.4.3                       |4.4.0 4.4.3
           Priority|P3                          |P2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[roche+gccbugs at exalead dot com]

------- Comment #5 from roche+gccbugs at exalead dot com  2009-11-30 15:06 -------
Just a small note: also work with "just" -fno-ipa-cp-clone in O3 mode,
actually. Therefore the issue is probably related to the "Perform function
cloning to make interprocedural constant propagation stronger" feature
introduced in -O3 optimization.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[jamborm at gcc dot gnu dot org]

------- Comment #6 from jamborm at gcc dot gnu dot org  2009-11-30 22:22 -------
The lattices are OK per se.  Lattices really only represent arguments
of calls that are represented in the call graph.  When there might be
other calls that are not represented in the graph, the function body
is cloned and the original should be used for those.  But it appears
it isn't.  (In fact it is always cloned because that's how replacement
with constants works.)

Specifically, the problem is that the wrong version of callback is
_inlined_ into CallFunctionRec.  Since indirect inlining is not
involved, I'm surprised that this indirect call is inlined.  So it all
comes down to the fact that we have a wrong edge in the call graph
after ipa-cp.

This happens in the following way:

1. CallFunctionRec is cloned because fun is constant.  fun is replaced
   by callback in the call statement.  It then calls rebuild
   cgraph_edges so that a call graph edge is created for the statement
   (among other things, I believe cgraph verifier mandates this).

2. callback is cloned.  IPA-CP does a rather nasty trick when
   redirecting callers:  It redirects all of them and then figures out
   later when it was wrong.  However a clone calling a clone is
   considered always safe.  That would be so, however, only if the
   edge we created in the previous cloning was also part of the
   call graph when we did our analysis.  But we added it later.

We do not have this issue in trunk at least since may because the
clone is now virtual, has no body and so we do not rebuild outgoing
call graph edges in this way.  (In fact, for the sake of indirect
inlining, we should be creating these edges too.)

Anyway, my proposed fix would be to replace the call
rebuild_cgraph_edges in ipcp_update_cloned_node with something that
just adds new call graph edges and also marks the new ones as
indirect.  Then it would be enough to tell ipcp_update_callgraph to
redirect these edges back to (hm, actually from) the original nodes as
well.

If there are no objections, I'll prepare a patch along these lines in
the next few days.


-- 

jamborm at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jh at suse dot cz


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[jamborm at gcc dot gnu dot org]

------- Comment #7 from jamborm at gcc dot gnu dot org  2009-12-08 22:56 -------
Patch submitted to the mailing list:
http://gcc.gnu.org/ml/gcc-patches/2009-12/msg00458.html


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[jamborm at gcc dot gnu dot org]

------- Comment #8 from jamborm at gcc dot gnu dot org  2009-12-27 22:40 -------
Subject: Bug 42231

Author: jamborm
Date: Sun Dec 27 22:39:58 2009
New Revision: 155481

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=155481
Log:
2009-12-27  Martin Jambor  <mjambor@suse.cz>

        PR tree-optimization/42231
        * ipa-cp.c (ipcp_update_cloned_node): Add missing edges manually
        instead of relying on rebuild_cgraph_edges and mark them as
        indirect calls.
        (ipcp_update_callgraph): Always redirect indirect edges.

        * testsuite/gcc.c-torture/execute/pr42231.c: New test.


Added:
    branches/gcc-4_4-branch/gcc/testsuite/gcc.c-torture/execute/pr42231.c
Modified:
    branches/gcc-4_4-branch/gcc/ChangeLog
    branches/gcc-4_4-branch/gcc/ipa-cp.c
    branches/gcc-4_4-branch/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[jamborm at gcc dot gnu dot org]

------- Comment #9 from jamborm at gcc dot gnu dot org  2009-12-28 01:41 -------
Subject: Bug 42231

Author: jamborm
Date: Mon Dec 28 01:41:07 2009
New Revision: 155485

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=155485
Log:
2009-12-27  Martin Jambor  <mjambor@suse.cz>

        PR tree-optimization/42231
        * testsuite/gcc.c-torture/execute/pr42231.c: New test.


Added:
    trunk/gcc/testsuite/gcc.c-torture/execute/pr42231.c
Modified:
    trunk/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231

[Bug tree-optimization/42231] [4.4 Regression] Wrong generated code when using a callback function (possible callback function inlining bug ?)

[jamborm at gcc dot gnu dot org]

------- Comment #10 from jamborm at gcc dot gnu dot org  2009-12-28 01:45 -------
Fixed.


-- 

jamborm at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42231