[Bug tree-optimization/100923] New: wrong code at -Os and above on x86_64-linux-gnu

[Bug tree-optimization/100923] New: wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

            Bug ID: 100923
           Summary: wrong code at -Os and above on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

[560] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210605 (experimental) [master revision
549d7f4310f:e97b11a9189:f31729d794c4150f6cba97f33ec125e180abd7dd] (GCC) 
[561] % 
[561] % gcctk -O1 small.c; ./a.out
[562] % 
[562] % gcctk -Os small.c
[563] % ./a.out
Floating point exception
[564] % 
[564] % cat small.c
int a = 1, b, c, *d = &a, *e = &a, f;
void g(int h) {}
void k(int *l) {
  int ***j;
  if (c) {
    *j = &l;
    ***j;
  }
  g(*l);
  *e = f;
  if (*l) {
    int i = b / a;
    a = i;
  }
}
int main() {
  k(d);
  return 0;
}

[Bug tree-optimization/100923] wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

--- Comment #1 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
It seems to affect all versions since 9.*, but not 8.*.

[Bug tree-optimization/100923] wrong code at -O2 and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|wrong code at -Os and above |wrong code at -O2 and above
                   |on x86_64-linux-gnu         |on x86_64-linux-gnu
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-06-06
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |alias, wrong-code

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
- working (-O2 -fno-strict-aliasing)
+ not working (-O2 -fstrict-aliasing)

-  l.1_3 = l;
-  e.2_5 = e;
-  f.3_6 = f;
-  *e.2_5 = f.3_6;
-  _7 = *l.1_3;
-  if (_7 != 0)

+  l.1_4 = l;
+  _5 = *l.1_4;
+  e.2_6 = e;
+  f.3_7 = f;
+  *e.2_6 = f.3_7;
+  if (_5 != 0)

So we swapped around the store to *e and the load from *l.

[Bug tree-optimization/100923] [9/10/11/12 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|wrong code at -O2 and above |[9/10/11/12 Regression]
                   |on x86_64-linux-gnu         |wrong code at -O2 and above
                   |                            |on x86_64-linux-gnu
   Target Milestone|---                         |9.5

[Bug tree-optimization/100923] [9/10/11/12 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
So FRE thinks:
  *e.2_6 = f.3_7;

Does not modify:

  _9 = *l.1_4;

[Bug tree-optimization/100923] [9/10/11/12 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
            Version|unknown                     |12.0
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug tree-optimization/100923] [9/10/11/12 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
The bug is that PTA computes

  <bb 3> :
  *j_15(D) = &l;
  # PT = null
  _2 = *j_15(D);
  # PT = null
  _3 = *_2;

and VN (in)correctly value-numbers the later load from 'l' to _3, pulling
the points-to info into the alias test.  PTA does not generate a constraint
for

  *j_15(D) = &l;

where *null = &l is thrown away early and

  _2 = *j_15(D);

_2 = *null as well.  So _2 remains empty thus _3 as well.

We thus enter the alias-oracle with a valueized ref that looks like
__MEM (_3) via ao_ref_init_from_vn_reference which fails to consider
availability here.

Not sure why -fno-strict-aliasing "works", it looks like we fail to
value-number the load from 'l' for some reason.

It's going to be a bit awkward to fix, but maybe it's not too bad.

[Bug tree-optimization/100923] [9/10/11/12 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:7a56d3d3e99cc77ad8a6a674870c814da6225675

commit r12-1295-g7a56d3d3e99cc77ad8a6a674870c814da6225675
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jun 8 12:52:12 2021 +0200

    tree-optimization/100923 - fix alias-ref construction wrt availability

    This PR shows that building an ao_ref from value-numbers is prone to
    expose bogus contextual alias info to the oracle.  The following makes
    sure to construct ao_refs from SSA names available at the program point
    only.

    On the way it modifies the awkward valueize_refs[_1] API.

    2021-06-08  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/100923
            * tree-ssa-sccvn.c (valueize_refs_1): Take a pointer to
            the operand vector to be valueized.
            (valueize_refs): Likewise.
            (valueize_shared_reference_ops_from_ref): Adjust.
            (valueize_shared_reference_ops_from_call): Likewise.
            (vn_reference_lookup_3): Likewise.
            (vn_reference_lookup_pieces): Likewise.  Re-valueize
            with honoring availability when we are about to create
            the ao_ref and valueized before.
            (vn_reference_lookup): Likewise.
            (vn_reference_insert_pieces): Adjust.

            * gcc.dg/torture/pr100923.c: New testcase.

[Bug tree-optimization/100923] [9/10/11 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11/12 Regression]     |[9/10/11 Regression] wrong
                   |wrong code at -O2 and above |code at -O2 and above on
                   |on x86_64-linux-gnu         |x86_64-linux-gnu
      Known to work|                            |12.0

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
OK, fixed on trunk.  Let's see if there's any fallout optimization-wise.

[Bug tree-optimization/100923] [9/10/11 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:2afae9ff16c45747e8e9c2ad477d28ee159fb1f7

commit r11-8697-g2afae9ff16c45747e8e9c2ad477d28ee159fb1f7
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jun 8 12:52:12 2021 +0200

    tree-optimization/100923 - fix alias-ref construction wrt availability

    This PR shows that building an ao_ref from value-numbers is prone to
    expose bogus contextual alias info to the oracle.  The following makes
    sure to construct ao_refs from SSA names available at the program point
    only.

    On the way it modifies the awkward valueize_refs[_1] API.

    2021-06-08  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/100923
            * tree-ssa-sccvn.c (valueize_refs_1): Take a pointer to
            the operand vector to be valueized.
            (valueize_refs): Likewise.
            (valueize_shared_reference_ops_from_ref): Adjust.
            (valueize_shared_reference_ops_from_call): Likewise.
            (vn_reference_lookup_3): Likewise.
            (vn_reference_lookup_pieces): Likewise.  Re-valueize
            with honoring availability when we are about to create
            the ao_ref and valueized before.
            (vn_reference_lookup): Likewise.
            (vn_reference_insert_pieces): Adjust.

            * gcc.dg/torture/pr100923.c: New testcase.

    (cherry picked from commit 7a56d3d3e99cc77ad8a6a674870c814da6225675)

[Bug tree-optimization/100923] [9/10 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923
Bug 100923 depends on bug 103204, which changed state.

Bug 103204 Summary: [11 Regression] ICE: in vn_reference_insert_pieces, at tree-ssa-sccvn.c:3842 (on -O2 and above) since r12-1295-g7a56d3d3e99cc77a
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103204

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

[Bug tree-optimization/100923] [9/10 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:a650dc2deb2b6906334c6b06991255f46df93c16

commit r10-10461-ga650dc2deb2b6906334c6b06991255f46df93c16
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jun 8 12:52:12 2021 +0200

    tree-optimization/100923 - fix alias-ref construction wrt availability

    This PR shows that building an ao_ref from value-numbers is prone to
    expose bogus contextual alias info to the oracle.  The following makes
    sure to construct ao_refs from SSA names available at the program point
    only.

    On the way it modifies the awkward valueize_refs[_1] API.

    2021-06-08  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/100923
            * tree-ssa-sccvn.c (valueize_refs_1): Take a pointer to
            the operand vector to be valueized.
            (valueize_refs): Likewise.
            (valueize_shared_reference_ops_from_ref): Adjust.
            (valueize_shared_reference_ops_from_call): Likewise.
            (vn_reference_lookup_3): Likewise.
            (vn_reference_lookup_pieces): Likewise.  Re-valueize
            with honoring availability when we are about to create
            the ao_ref and valueized before.
            (vn_reference_lookup): Likewise.
            (vn_reference_insert_pieces): Adjust.

            * gcc.dg/torture/pr100923.c: New testcase.

    (cherry picked from commit 7a56d3d3e99cc77ad8a6a674870c814da6225675)

[Bug tree-optimization/100923] [9 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
   Target Milestone|9.5                         |10.4
         Resolution|---                         |FIXED

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
fixed for GCC 10.4

[Bug tree-optimization/100923] [9 Regression] wrong code at -O2 and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100923

--- Comment #11 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:7c469a9fc785505dc350aba60311812c2bb0c1b5

commit r15-204-g7c469a9fc785505dc350aba60311812c2bb0c1b5
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Feb 28 10:08:31 2024 +0100

    tree-optimization/100923 - re-do VN with contextual PTA info fix

    The following implements the gist of the PR100923 fix in a leaner
    (and more complete) way by realizing that all ao_ref_init_from_vn_reference
    uses need to have an SSA name in the base valueized with availability
    in mind.  Instead of re-valueizing the whole chain of operands we can
    simply only and always valueize the SSA name we put in the base.

    This handles also two omitted places in vn_reference_lookup_3.

            PR tree-optimization/100923
            * tree-ssa-sccvn.cc (ao_ref_init_from_vn_reference): Valueize
            base SSA_NAME.
            (vn_reference_lookup_3): Adjust vn_context_bb around calls
            to ao_ref_init_from_vn_reference.
            (vn_reference_lookup_pieces): Revert original PR100923 fix.
            (vn_reference_lookup): Likewise.