From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 58DF93858416; Sun, 28 May 2023 19:26:59 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 58DF93858416
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1685302019;
	bh=orn3zOkd6+gqbO4gfte5ul5B9KzV0T0zSCUN90mf4yY=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=j09AIuei/yce6sLo64AthlA4tG2H50wU78nVsKBXvT7tl2D+a59ed+bzfYjhpTqo1
	 dNlMWYBEA6PWvt/1Se9QOoRtK4Sa1n1cmZK09zdoXErCbWYba5H558IVL0GxfR0nlj
	 HOCljTeMBl6FaP4LONOy9vtbIX8n9eyjq1naYZFM=
From: "gjl at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug rtl-optimization/101188] [postreload] Uses content of a
 clobbered register
Date: Sun, 28 May 2023 19:26:58 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: rtl-optimization
X-Bugzilla-Version: 11.1.0
X-Bugzilla-Keywords: ra, wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: gjl at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-101188-4-xqYk7QQ2tC@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-101188-4@http.gcc.gnu.org/bugzilla/>
References: <bug-101188-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D101188

--- Comment #9 from Georg-Johann Lay <gjl at gcc dot gnu.org> ---
The bug works as follows:

postreload.cc::reload_cse_move2add() loops over all insns, and at some poin=
t it
encounters

(insn 44 14 15 2 (set (reg/f:HI 14 r14 [58])
        (reg/v/f:HI 16 r16 [orig:51 self ] [51])) "fail1.c":28:5 101
{*movhi_split}
     (nil))

During the analysis for that insn, it executes

          rtx_insn *next =3D next_nonnote_nondebug_insn (insn);
          rtx set =3D NULL_RTX;
          if (next)
            set =3D single_set (next);

where next is

(insn 15 44 16 2 (parallel [
            (set (reg/f:HI 14 r14 [58])
                (plus:HI (reg/f:HI 14 r14 [58])
                    (const_int 68 [0x44])))
            (clobber (reg:QI 31 r31))
        ]) "fail1.c":28:5 175 {addhi3_clobber}
     (nil))

Further down, it continues with success =3D 0:

      if (success)
        delete_insn (insn);
      changed |=3D success;
      insn =3D next;
      [...]
      continue;

The scan then continues with NEXT_INSN (insn), which is the insn AFTER insn=
 15,
so the CLOBBER of QI:31 in insn 15 is bypassed, and note_stores or similar =
is
never executed on insn 15.  The "set =3D single_set (next)" also bypasses t=
hat
insn 15 is a PARALLEL with a CLOBBER of a general purpose register.

Appears the code is in postreload since 2003, when postreload.c was split o=
ut
of reload1.c.=