[Bug rtl-optimization/100253] New: [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[Bug rtl-optimization/100253] New: [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

            Bug ID: 100253
           Summary: [10/11/12 Regression] wrong code with -O2
                    -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned
                    movdqa)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu

Created attachment 50672
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50672&action=edit
testcase

Output:
$ x86_64-pc-linux-gnu-g++ testcase.C -O2 -fno-tree-bit-ccp -ftree-slp-vectorize
$ ./a.out
Segmentation fault

Program received signal SIGSEGV, Segmentation fault.
0x00000000004011aa in S::operator= (this=0x404120 <s>) at testcase.C:7
7       struct S
(gdb) disas
Dump of assembler code for function main():
   0x0000000000401180 <+0>:     push   %rbp
   0x0000000000401181 <+1>:     mov    $0x404120,%edi
   0x0000000000401186 <+6>:     push   %rbx
   0x0000000000401187 <+7>:     sub    $0x8,%rsp
   0x000000000040118b <+11>:    movsbq 0x2f2d(%rip),%rbp        # 0x4040c0 <c>
   0x0000000000401193 <+19>:    shl    $0x6,%rbp
   0x0000000000401197 <+23>:    lea    0x4040e0(%rbp),%rsi
   0x000000000040119e <+30>:    call   0x4014e0
<_ZNSt6vectorIS_I1TSaIS0_EESaIS2_EEaSERKS4_>
   0x00000000004011a3 <+35>:    movzbl 0x4040f8(%rbp),%eax
=> 0x00000000004011aa <+42>:    movdqa 0x404109(%rbp),%xmm0
   0x00000000004011b2 <+50>:    movdqa 0x4040f9(%rbp),%xmm1
   0x00000000004011ba <+58>:    mov    %al,0x2f78(%rip)        # 0x404138
<s+24>
   0x00000000004011c0 <+64>:    xor    %eax,%eax
   0x00000000004011c2 <+66>:    movups %xmm1,0x2f70(%rip)        # 0x404139
<s+25>
   0x00000000004011c9 <+73>:    movups %xmm0,0x2f79(%rip)        # 0x404149
<s+41>
   0x00000000004011d0 <+80>:    add    $0x8,%rsp
   0x00000000004011d4 <+84>:    pop    %rbx
   0x00000000004011d5 <+85>:    pop    %rbp
   0x00000000004011d6 <+86>:    ret

[Bug rtl-optimization/100253] [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[crazylht at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

Hongtao.liu <crazylht at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |crazylht at gmail dot com

--- Comment #1 from Hongtao.liu <crazylht at gmail dot com> ---
for sse load/store, with aligned address, movdqu is as fast as movdqa, so i'm
thinking that backend can generate only unaligned load/store instructions(which
of course may cover up some problems).

[Bug tree-optimization/100253] [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|rtl-optimization            |tree-optimization
   Last reconfirmed|                            |2021-04-25
     Ever confirmed|0                           |1

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The problem is right away in expand:
;; vect__36.383_12 = MEM <vector(1) __int128 unsigned> [(char * {ref-all})_10 +
16B];

(insn 23 22 0 (set (reg:V1TI 88 [ vect__36.383 ])
        (mem:V1TI (plus:DI (reg/f:DI 86 [ _10 ])
                (const_int 16 [0x10])) [0 MEM <vector(1) __int128 unsigned>
[(char * {ref-all})_10 + 16B]+0 S16 A128])) -1
     (nil))


I think SLP did not mark the load as unaligned even though it knows it is one:
t.cc:7:8: note:   Vectorizing an unaligned access.
t.cc:7:8: note:   vect_model_load_cost: unaligned supported by hardware.
t.cc:7:8: note:   vect_model_load_cost: inside_cost = 24, prologue_cost = 0 .
t.cc:7:8: note:   ==> examining statement: MEM <__int128 unsigned> [(char *
{ref-all})&s + 25B] = _36;
t.cc:7:8: note:   vect_is_simple_use: operand # VUSE <.MEM_30>
MEM <__int128 unsignedD.19> [(charD.10 * {ref-all})_10], type of def: internal
t.cc:7:8: note:   vect_is_simple_use: operand # VUSE <.MEM_35>
MEM <__int128 unsignedD.19> [(charD.10 * {ref-all})_19], type of def: internal
t.cc:7:8: note:   Vectorizing an unaligned access.
t.cc:7:8: note:   vect_model_store_cost: unaligned supported by hardware.

Confirmed.

When -fno-tree-bit-ccp is turned off, the prop of the unalignedness does not
happen.

[Bug tree-optimization/100253] [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[crazylht at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

--- Comment #3 from Hongtao.liu <crazylht at gmail dot com> ---
(In reply to Andrew Pinski from comment #2)
> The problem is right away in expand:
> ;; vect__36.383_12 = MEM <vector(1) __int128 unsigned> [(char *
> {ref-all})_10 + 16B];
> 
> (insn 23 22 0 (set (reg:V1TI 88 [ vect__36.383 ])
>         (mem:V1TI (plus:DI (reg/f:DI 86 [ _10 ])
>                 (const_int 16 [0x10])) [0 MEM <vector(1) __int128 unsigned>
> [(char * {ref-all})_10 + 16B]+0 S16 A128])) -1
>      (nil))
> 
> 
> I think SLP did not mark the load as unaligned even though it knows it is
> one:
But gimple tree is marked as aligned.

 <mem_ref 0x7fffe94a72d0
    type <vector_type 0x7fffe9a59150
        type <integer_type 0x7fffea300a80 __int128 unsigned public unsigned
type_6 TI
            size <integer_cst 0x7fffea2e2f00 constant 128>
            unit-size <integer_cst 0x7fffea2e2f18 constant 16>
            align:128 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffea300a80 precision:128 min <integer_cst 0x7fffea3031f8 0> max
<integer_cst 0x7fffea2f6870 0xffffffffffffffffffffffffffffffff>
            pointer_to_this <pointer_type 0x7fffe9a4c150>>
        unsigned V1TI size <integer_cst 0x7fffea2e2f00 128> unit-size
<integer_cst 0x7fffea2e2f18 16>
        align:128 warn_if_not_align:0 symtab:0 alias-set 31 canonical-type
0x7fffe9a59150 nunits:1
        pointer_to_this <pointer_type 0x7fffe9a4c2a0>>

    arg:0 <ssa_name 0x7fffe947ad38
        type <pointer_type 0x7fffea30c498 type <integer_type 0x7fffea30c3f0
char>
            sizes-gimplified public unsigned type_6 DI
            size <integer_cst 0x7fffea2e2eb8 constant 64>
            unit-size <integer_cst 0x7fffea2e2ed0 constant 8>
            align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffea30c498>
        visited
        def_stmt _11 = &g + _214;
        version:11
        ptr-info 0x7fffe9487330>
    arg:1 <integer_cst 0x7fffe949bf18 type <pointer_type 0x7fffe9a4c888>
constant 16>>

[Bug tree-optimization/100253] [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Hongtao.liu from comment #3)
> > I think SLP did not mark the load as unaligned even though it knows it is
> > one:
> But gimple tree is marked as aligned.

Right and we are saying the same thing just differently. SLP is what needs to
mark the load as unaligned as it creates the (gimple) load in the first place.

[Bug tree-optimization/100253] [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
           Priority|P3                          |P2
   Target Milestone|---                         |10.4

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug tree-optimization/100253] [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
So the issue is we're getting a dataref pointer like

&MEM <__int128 unsigned> [(char * {ref-all})&s + 25B]

and the first access has DR_MISALIGNMENT of 9 and the target alignment is 16.
So we have

align == 16
misalign == 9

then we do

                  data_ref = fold_build2 (MEM_REF, vectype,
                                          dataref_ptr,
                                          dataref_offset
                                          ? dataref_offset
                                          : build_int_cst (ref_type, 0));
                  if (aligned_access_p (first_dr_info))
                    ;
                  else if (DR_MISALIGNMENT (first_dr_info) == -1)
                    TREE_TYPE (data_ref)
                      = build_aligned_type (TREE_TYPE (data_ref),
                                            align * BITS_PER_UNIT);
                  else
                    TREE_TYPE (data_ref)
                      = build_aligned_type (TREE_TYPE (data_ref),
                                            TYPE_ALIGN (elem_type));

but since DR_MISALIGNMENT is not -1 we assume element alignment
(since DR_MISALIGNMENT is the misalign in elements and at least at
some point wasn't arbitrary ... unless I misremember).  Since
the vector type is vector(1) __int128 unsigned we get an aligned
access.  Note how we're using 'align' in the == -1 case but that's
the target alignment ...

The load code has the same issue.  I'm testing a simplification.

[Bug tree-optimization/100253] [10/11/12 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:af4ccaa7515b8e72449448c509916575831e6292

commit r12-284-gaf4ccaa7515b8e72449448c509916575831e6292
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Apr 29 11:52:08 2021 +0200

    tree-optimization/100253 - fix bogus aligned vectorized loads/stores

    At some point DR_MISALIGNMENT was supposed to be -1 when the
    access was not element aligned.  That's obviously not true at this
    point so this adjusts both store and load vectorizing to no longer
    assume this which in turn allows simplifying the code.

    2021-04-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/100253
            * tree-vect-stmts.c (vectorizable_load): Do not assume
            element alignment when DR_MISALIGNMENT is -1.
            (vectorizable_store): Likewise.

            * g++.dg/pr100253.C: New testcase.

[Bug tree-optimization/100253] [10/11 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |12.0
            Summary|[10/11/12 Regression] wrong |[10/11 Regression] wrong
                   |code with -O2               |code with -O2
                   |-fno-tree-bit-ccp           |-fno-tree-bit-ccp
                   |-ftree-slp-vectorize        |-ftree-slp-vectorize
                   |(unaligned movdqa)          |(unaligned movdqa)
      Known to fail|12.0                        |

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.  The issue seems quite old btw, just got easier to
trigger.

[Bug tree-optimization/100253] [10/11 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:c980fbf5505dc2f50136d501b67dc3fbf4b08b0d

commit r11-8353-gc980fbf5505dc2f50136d501b67dc3fbf4b08b0d
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Apr 29 11:52:08 2021 +0200

    tree-optimization/100253 - fix bogus aligned vectorized loads/stores

    At some point DR_MISALIGNMENT was supposed to be -1 when the
    access was not element aligned.  That's obviously not true at this
    point so this adjusts both store and load vectorizing to no longer
    assume this which in turn allows simplifying the code.

    2021-04-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/100253
            * tree-vect-stmts.c (vectorizable_load): Do not assume
            element alignment when DR_MISALIGNMENT is -1.
            (vectorizable_store): Likewise.

            * g++.dg/pr100253.C: New testcase.

    (cherry picked from commit af4ccaa7515b8e72449448c509916575831e6292)

[Bug tree-optimization/100253] [10 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:92ffe7c3b6ffee8fd6ef92a5b3b4cc09263b01ee

commit r10-10260-g92ffe7c3b6ffee8fd6ef92a5b3b4cc09263b01ee
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Apr 29 11:52:08 2021 +0200

    tree-optimization/100253 - fix bogus aligned vectorized loads/stores

    At some point DR_MISALIGNMENT was supposed to be -1 when the
    access was not element aligned.  That's obviously not true at this
    point so this adjusts both store and load vectorizing to no longer
    assume this which in turn allows simplifying the code.

    2021-04-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/100253
            * tree-vect-stmts.c (vectorizable_load): Do not assume
            element alignment when DR_MISALIGNMENT is -1.
            (vectorizable_store): Likewise.

            * g++.dg/pr100253.C: New testcase.

[Bug tree-optimization/100253] [10 Regression] wrong code with -O2 -fno-tree-bit-ccp -ftree-slp-vectorize (unaligned movdqa)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED
      Known to fail|10.3.1                      |10.3.0
      Known to work|                            |10.3.1

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.