[Bug tree-optimization/102448] New: [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[Bug tree-optimization/102448] New: [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

            Bug ID: 102448
           Summary: [12 Regression] wrong codegen in gcc in spec2017 since
                    24f99147b9264f8f7d9cfb2fa6bd431edfa252d2
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: tnfchris at gcc dot gnu.org
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---

Since g:24f99147b9264f8f7d9cfb2fa6bd431edfa252d2 we've been getting a segfault
on gcc in spec2017.

It looks like ira_init has been miscompiled and an additional unconditional
store materialized:

Before:

add     x1, x19, #0x4
add     x2, x19, #0x14
ldr     q0, [x0,#4064]
str     q0, [x1],#16


After:

add     x19, x19, #0x4
ldr     q0, [x0,#4000]
str     q0, [x19],#16
str     q0, [x19],#16

so it's pushing 16 bytes more into x19 than it did before.

Trying to see if I can reduce a testcase

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |aarch64
   Target Milestone|---                         |12.0

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
The rev. in question should only affect alignment info on a SSA name.

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

--- Comment #2 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
I have double checked the revision and it does start happening with it.

Though I can only reproduce it with -flto.  the codegen without lto seems the
same.

Any ideas how to debug further?

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Tamar Christina from comment #2)
> I have double checked the revision and it does start happening with it.
> 
> Though I can only reproduce it with -flto.  the codegen without lto seems
> the same.
> 
> Any ideas how to debug further?

Since you identified the offending assembler see what's the corresponding
source portion - there look at the .optimized gimple dumps and see when the bad
code was introduced.  I'll see if the issue reproduces on x86_64.

What options are you using for aarch64 besides -flto and which -march?

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Target|aarch64                     |aarch64, x86_64-*-*
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2021-09-23
     Ever confirmed|0                           |1

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
I can reproduce the issue on x86_64 with -O3 -flto (but not -O2 -flto or -O3
-fno-tree-vectorize -flto).  I'm taking a look.

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
  <bb 276> [local count: 5160403229]:
  # ivtmp.589_349 = PHI <ivtmp.589_627(276), ivtmp.589_618(275)>
  _903 = (void *) ivtmp.589_349;
  [ira-costs.c:1641:24] MEM <vector(4) int> [(int *)_903] = { 1000000, 1000000,
1000000, 1000000 };
  ivtmp.589_627 = ivtmp.589_349 + 16;
  goto <bb 276>; [100.00%]

that's an endless loop...

but nothing wrong in .vect:

  if (_475 <= 2)
    goto <bb 402>; [10.00%]
  else
    goto <bb 397>; [90.00%]

  <bb 397> [local count: 860067200]:
  # RANGE [1, 1073741823] NONZERO 1073741823
  bnd.549_503 = niters.548_402 >> 2;
  vect_cst__537 = { 1000000, 1000000, 1000000, 1000000 };
  # PT = null { D.10048 } (escaped, escaped heap)
  # ALIGN = 8, MISALIGN = 0
  vectp_newmem.553_545 = newmem_696 + 4;

  <bb 265> [local count: 5160403229]:
  # RANGE [0, 2147483647] NONZERO 2147483647
  # i_395 = PHI <[ira-costs.c:1640:47] i_23(312), [ira-costs.c:1640:10] 0(397)>
  # PT = null { D.10048 } (escaped, escaped heap)
  # ALIGN = 4, MISALIGN = 0
  # vectp_newmem.552_559 = PHI <vectp_newmem.552_560(312),
vectp_newmem.553_545(397)>
  # ivtmp_572 = PHI <ivtmp_587(312), 0(397)>
  [ira-costs.c:1641:24] MEM <vector(4) int> [(int *)vectp_newmem.552_559] =
vect_cst__537;
  [ira-costs.c:1640:47] # RANGE [1, 2147483647] NONZERO 2147483647
  i_23 = i_395 + 1;
  [ira-costs.c:1640:17] # PT = null { D.10048 } (escaped, escaped heap)
  # ALIGN = 8, MISALIGN = 0
  vectp_newmem.552_560 = vectp_newmem.552_559 + 16;
  [ira-costs.c:1640:17] ivtmp_587 = ivtmp_572 + 1;
  if (ivtmp_587 < bnd.549_503)
    goto <bb 312>; [83.33%]
  else
    goto <bb 399>; [16.67%]

  <bb 312> [local count: 4300336028]:
  goto <bb 265>; [100.00%]

in IVOPTs we have

  <bb 265> [local count: 5160403229]:
  # ivtmp.589_349 = PHI <ivtmp.589_627(312), ivtmp.589_618(397)>
  # PT = null { D.10048 } (escaped, escaped heap)
  _903 = (void *) ivtmp.589_349;
  [ira-costs.c:1641:24] MEM <vector(4) int> [(int *)_903] = { 1000000, 1000000,
1000000, 1000000 };
  ivtmp.589_627 = ivtmp.589_349 + 16;
  if (ivtmp.589_627 != _914)
    goto <bb 312>; [83.33%]
  else
    goto <bb 399>; [16.67%]

but then CCP concludes the test is never false.

Visiting statement:
_914 = _398 + _935;
which is likely CONSTANT
Lattice value changed to CONSTANT 0x4 (0xfffffffffffffff8).  Adding SSA edges
to worklist.
marking stmt to be not simulated again
Adding destination of edge (282 -> 283) to worklist

...

Simulating block 283

Visiting PHI node: ivtmp.589_349 = PHI <ivtmp.589_627(283), ivtmp.589_618(282)>
        Argument #0 (283 -> 283 not executable)
        Argument #1 (282 -> 283 executable)
        ivtmp.589_618   Value: CONSTANT 0x0 (0xfffffffffffffff8)

    PHI node value: CONSTANT 0x0 (0xfffffffffffffff8)

Lattice value changed to CONSTANT 0x0 (0xfffffffffffffff8).  Adding SSA edges
to worklist.

Visiting statement:
# PT = null { D.10048 } (escaped, escaped heap)
_903 = (void *) ivtmp.589_349;
which is likely CONSTANT
Lattice value changed to CONSTANT 0x0 (0xfffffffffffffff8).  Adding SSA edges
to worklist.

Visiting statement:
ivtmp.589_627 = ivtmp.589_349 + 16;
which is likely CONSTANT
Lattice value changed to CONSTANT 0x0 (0xfffffffffffffff8).  Adding SSA edges
to worklist.

Visiting statement:
if (ivtmp.589_627 != _914)
which is likely CONSTANT
Adding destination of edge (283 -> 283) to worklist

Simulating block 283

Visiting PHI node: ivtmp.589_349 = PHI <ivtmp.589_627(283), ivtmp.589_618(282)>
        Argument #0 (283 -> 283 executable)
        ivtmp.589_627   Value: CONSTANT 0x0 (0xfffffffffffffff8)
        Argument #1 (282 -> 283 executable)
        ivtmp.589_618   Value: CONSTANT 0x0 (0xfffffffffffffff8)

    PHI node value: CONSTANT 0x0 (0xfffffffffffffff8)

so CCP knows that _627 is aligned to 8 but _914 has a bit 0x4 set.

What's wrong is

  # PT = { D.10048 } (escaped, escaped heap)
  # ALIGN = 8, MISALIGN = 0
  vectp_newmem.553_545 = newmem_696 + 4;

since newmem is aligned to 8, but here we offset it by 4.

It seems that DR_PTR_INFO cannot really be used to derive the alignment of
a pointer created from the access since it is the alignment of an SSA name
that's on the base of the ref which means that alignment info in this
does not reflect any constant or variable offset.

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:c0cc62b32d95caca25a8854e0d2b6f11f5674d30

commit r12-3839-gc0cc62b32d95caca25a8854e0d2b6f11f5674d30
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Sep 23 10:27:01 2021 +0200

    tree-optimization/102448 - clear copied alignment info from vect

    This fixes the previous change which removed setting alignment info
    from the vectorizers idea of how a pointer is being used but left
    in place the copied info from DR_PTR_INFO without realizing that this
    is in fact _not_ the alignment of the access but the alignment of
    a base pointer contained in it.

    The following makes sure to not use that info.

    2021-09-23  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/102448
            * tree-vect-data-refs.c (vect_duplicate_ssa_name_ptr_info):
            Clear alignment info copied from DR_PTR_INFO.

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/102448] [12 Regression] wrong codegen in gcc in spec2017 since 24f99147b9264f8f7d9cfb2fa6bd431edfa252d2

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102448

--- Comment #8 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Thanks!