[Bug tree-optimization/102446] New: wrong code at -O3 on x86_64-linux-gnu

[Bug tree-optimization/102446] New: wrong code at -O3 on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

            Bug ID: 102446
           Summary: wrong code at -O3 on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This seems to be a long-latent miscompilation, affecting GCC 5.1 and later.

[583] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210922 (experimental) [master r12-3777-g578b7687338] (GCC)
[584] %
[584] % gcctk -O2 small.c; ./a.out
[585] %
[585] % gcctk -O3 small.c
[586] % ./a.out
Segmentation fault
[587] %
[587] % cat small.c
int a = 1, c, e, f, *j, k, o, *r = &f, s;
char b, l;
short d, *g;
unsigned h;
static void m(void);
static void n(int);
void p(int *q) {
  while (1) {
    if (*q)
      break;
    if (*g)
      o = c;
    while (l)
      ;
  }
}
void t() {
  for (; s < 8; s++)
    m();
}
void m() {
  int aa = 0, i = 0;
  for (; i < 3; i++)
    if (k < 0)
      aa |= *j;
  if (d)
    c = (h + *g + 2) & c;
  n(aa);
}
void n(int ac) {
  char *ad = &b, u = ac, *v = &b;
  int ae = *ad = a;
  u && (*v = e > 0);
  *r = c;
  p(&ae);
}
int main() {
  t();
  return 0;
}

[Bug tree-optimization/102446] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-09-22
           Keywords|                            |wrong-code
            Version|unknown                     |12.0
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  Happens with -O3 -fno-inline as well, -fdisable-tree-cunroll "fixes
it", not further investigated.

[Bug tree-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
            Summary|wrong code at -O3 on        |[9/10/11/12 Regression]
                   |x86_64-linux-gnu            |wrong code at -O3 on
                   |                            |x86_64-linux-gnu
   Target Milestone|---                         |9.5

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r5-6477-g3620b606822f80863488ca4883542d848d41f9f9

[Bug tree-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
void m() {
  int aa = 0, i = 0;
  for (; i < 3; i++)
    if (k < 0)
      aa |= *j;

Dump of assembler code for function m:
   0x0000000000400540 <+0>:     mov    0x200b16(%rip),%edi        # 0x60105c
<k>
   0x0000000000400546 <+6>:     mov    0x200b13(%rip),%rax        # 0x601060
<j>
   0x000000000040054d <+13>:    sar    $0x1f,%edi
=> 0x0000000000400550 <+16>:    and    (%rax),%edi
   0x0000000000400552 <+18>:    cmpw   $0x0,0x200af6(%rip)        # 0x601050
<d>

so we're loading *j before checking k < 0.  On GIMPLE that's OK:

  <bb 2> [local count: 268435456]:
  k.5_1 = k;
  j.6_2 = j;
  if (k.5_1 < 0)
    goto <bb 3>; [41.00%]
  else
    goto <bb 4>; [59.00%]

  <bb 3> [local count: 110058537]:
  j.6__lsm0.31_28 = *j.6_2;

  <bb 4> [local count: 268435456]:
  # aa_9 = PHI <j.6__lsm0.31_28(3), 0(2)>

but RTL if-conversion makes the load unconditional.

(insn 13 12 35 3 (set (reg/v:SI 89 [ j.6__lsm0.31 ])
        (mem:SI (reg/f:DI 83 [ j.6_2 ]) [1 *j.6_2+0 S4 A32])) 77
{*movsi_internal}
     (expr_list:REG_DEAD (reg/f:DI 83 [ j.6_2 ])
        (nil)))

I don't see any flags marking it as not trapping?

Re: [Bug tree-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[Jan Hubicka]

> Started with r5-6477-g3620b606822f80863488ca4883542d848d41f9f9
This only affects early inlining decisions, so it may be useful to
bisect this with --param early-inlining-insns=14

Honza

[Bug tree-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #4 from Jan Hubicka <hubicka at ucw dot cz> ---
> Started with r5-6477-g3620b606822f80863488ca4883542d848d41f9f9
This only affects early inlining decisions, so it may be useful to
bisect this with --param early-inlining-insns=14

Honza

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
          Component|tree-optimization           |rtl-optimization

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #4)
> > Started with r5-6477-g3620b606822f80863488ca4883542d848d41f9f9
> This only affects early inlining decisions, so it may be useful to
> bisect this with --param early-inlining-insns=14
> 
> Honza

It's also miscompiled with -fno-inline.

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
int a = 1, c, e, f, *j, k, o, *r = &f, s;
char b, l;
short d, *g;
unsigned h;
static void m(void);
static inline void n(int);
void p(int *q) {
  while (1) {
    if (*q)
      break;
    if (*g)
      o = c;
    while (l)
      ;
  }
}
void t() {
  for (; s < 8; s++)
    m();
}
__attribute__((noinline)) void m() {
  int aa = 0, i = 0;
  for (; i < 3; i++)
    if (k < 0)
      aa |= *j;
  if (d)
    c = (h + *g + 2) & c;
  n(aa);
}
static inline __attribute__((always_inline)) void n(int ac) {
  char *ad = &b, u = ac, *v = &b;
  int ae = *ad = a;
  u && (*v = e > 0);
  *r = c;
  p(&ae);
}
int main() {
  t();
  return 0;
}

ICEs already in r105000.

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I mean segfaults at runtime, not ICEs.

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=23567

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #3)
> I don't see any flags marking it as not trapping?

Related to PR 23567 (which was fixed but maybe not fully).

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I think PR23567 is quite different, that was about stores to a place that might
not be writable, this is about making a possibly trapping conditional load
being unconditional.

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #6)

This testcase seems to be fixed on the trunk. It would be useful to know where
it was fixed.

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It still fails for me.  As I corrected in #c7, I didn't mean ICE but
miscompilation (at -O3).

[Bug rtl-optimization/102446] [9/10/11/12 Regression] wrong code at -O3 on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #11)
> It still fails for me.  As I corrected in #c7, I didn't mean ICE but
> miscompilation (at -O3).

Yes it does still fail for me too, I don't know what I was doing wrong last
night.

[Bug rtl-optimization/102446] [10/11/12/13 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.5                         |10.4

--- Comment #13 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9 branch is being closed

[Bug rtl-optimization/102446] [10/11/12/13 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug rtl-optimization/102446] [10/11 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11/12/13 Regression]    |[10/11 Regression] wrong
                   |wrong code at -O3 on        |code at -O3 on
                   |x86_64-linux-gnu            |x86_64-linux-gnu
           Keywords|                            |needs-bisection
      Known to work|                            |12.1.1, 13.0
      Known to fail|                            |11.3.1

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> ---
It no longer fails on trunk and the branch.  What fixed it?  Still broken on
the GCC 11 branch.

[Bug rtl-optimization/102446] [10/11 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |

--- Comment #16 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
On the trunk r13-1186-ga0c30fe3b888f20215f and that has been backported in
r12-8523-g9e72a522dd9f835dd15.

[Bug rtl-optimization/102446] [10/11 Regression] wrong code at -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

--- Comment #17 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
So dup or related to PR106032.

[Bug rtl-optimization/102446] [11 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102446

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #18 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.