[Bug tree-optimization/101501] New: wrong code at -O3 on x86_64-linux-gnu

[Bug tree-optimization/101501] New: wrong code at -O3 on x86_64-linux-gnu

[qrzhang at gatech dot edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

            Bug ID: 101501
           Summary: wrong code at -O3 on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: qrzhang at gatech dot edu
  Target Milestone: ---

It appears to be a recent regression. Gcc-10 works fine.

$ gcc-trunk -v
gcc version 12.0.0 20210718 (experimental) [master revision
0103d18dfc9:a1cef02c5e3:853921378bfa149353b4e1c7dde5c02f80072ad7] (GCC)


$ gcc-trunk abc.c ; ./a.out
-1

$ gcc-trunk -O3 abc.c ; ./a.out
40


$ cat abc.c
char a = 55;
int main() {
  int b;
  char c;
d:
  c = a-- * 52;
  b = 3L * c;
  if (b)
    goto d;
  printf("%d\n", a);
}

[Bug tree-optimization/101501] wrong code at -O3 on x86_64-linux-gnu

[qrzhang at gatech dot edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

--- Comment #1 from Qirun Zhang <qrzhang at gatech dot edu> ---
My bisection points to g:287522613d661b4c5ba8403b051eb470c1674cba

[Bug tree-optimization/101501] [11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.2
            Summary|wrong code at -O3 on        |[11/12 Regression] wrong
                   |x86_64-linux-gnu            |code at -O3 on
                   |                            |x86_64-linux-gnu
           Keywords|                            |wrong-code

[Bug tree-optimization/101501] [11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[glisse at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

--- Comment #2 from Marc Glisse <glisse at gcc dot gnu.org> ---
unsigned char a = 55;
int main() {
  unsigned char c;
d:
  c = a-- * 52;
  if (c)
    goto d;
  __builtin_printf("%d\n", a);
}


outputs 40 at -O3 instead of 255, and already fails with gcc-8. Cunroll seems
confused about the number of iterations of this loop.

[Bug tree-optimization/101501] [11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |11.1.1

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Possibly related to PR100740, but my not complete fix for that doesn't fix this
one.

[Bug tree-optimization/101501] [11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-07-22
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
niter analysis computes

Analyzing # of iterations of loop 2
  exit condition [a_lsm.5_10 * 52, + , 204] != 0
  bounds on difference of bases: -255 ... 0
  result:
    # of iterations (a_lsm.5_10 * 52) / 52, bounded by 63

but then

Loop 2 iterates at most 14 times.
Loop 2 likely iterates at most 14 times.

because we have nb_iterations_upper_bound set on the loop.  That upper bound
is set by the vectorizer which vectorizes the loop but then it's immediately
removed again because the runtime profitability check optimizes to 1 != 0?!
With -fno-vect-cost-model things don't fare any better but -fno-tree-vectorize
fixes the issue.

[Bug tree-optimization/101501] [11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
    # of iterations (a_lsm.5_10 * 52) / 52, bounded by 63

is obviously wrong with a_lsm.5_10 being a 'char', that boils down to zero
iterations when computed at runtime.  The loop body looks like

  <bb 3> [local count: 1073741824]:
  # a_3 = PHI <a_5(2), a_6(5)>
d:
  a_6 = a_3 + 255;
  c_7 = a_3 * 52;
  if (c_7 != 0)
    goto <bb 5>; [89.00%]
  else
    goto <bb 4>; [11.00%]

  <bb 5> [local count: 955630224]:
  goto <bb 3>; [100.00%]

and SCEV computes

  (scalar = c_7)
  (scalar_evolution = {a_5 * 52, +, 204}_1))

which looks correct.

niter compute does

static bool
number_of_iterations_ne (class loop *loop, tree type, affine_iv *iv,
                         tree final, class tree_niter_desc *niter,
                         bool exit_must_be_taken, bounds *bnds)
{                       
...
  /* Compute no-overflow information for the control iv.  This can be
     proven when below two conditions are satisfied: 

       1) IV evaluates toward FINAL at beginning, i.e:
            base <= FINAL ; step > 0
            base >= FINAL ; step < 0

       2) |FINAL - base| is an exact multiple of step.
...
  if (!niter->control.no_overflow
      && (integer_onep (s) || multiple_of_p (type, c, s)))
    {

and there we have the issue of multiple_of_p not handling overflow (there's
a duplicate bug, PR100499 about this issue).  The 1) condition ends up
as unsigned-val >= 0 which is trivially true.

[Bug tree-optimization/101501] [11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101501

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Dup.

*** This bug has been marked as a duplicate of bug 100499 ***