[Bug tree-optimization/102622] [12 Regression] Wrong code with -O3 for skylake-avx512 and icelake-server by r12-3903

["aldyh at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102622

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amacleod at redhat dot com,
                   |                            |jakub at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org

--- Comment #12 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
I had to download the Intel SDE to reproduce it, but was finally able to narrow
it down to 4 jump threading paths:

./xg++ -B./ a.c -O3 -L/usr/lib/gcc/x86_64-redhat-linux/11/
-march=skylake-avx512 -fdump-tree-all-details -fdisable-tree-ethread
-fdisable-tree-thread1 -fdisable-tree-thread2 -fdisable-tree-thread3
-fdisable-tree-thread4  -fdbg-cnt=registered_jump_thread:2-4:19-20

$ grep 'thread' a.c.* |grep Registering
a.c.113t.vrp-thread1:  [2] Registering jump thread: (9, 11) incoming edge; 
(11, 10) normal; 
a.c.113t.vrp-thread1:  [4] Registering jump thread: (5, 7) incoming edge;  (7,
8) normal; 
a.c.197t.vrp-thread2:  [19] Registering jump thread: (15, 16) incoming edge; 
(16, 18) normal; 
a.c.197t.vrp-thread2:  [20] Registering jump thread: (21, 16) incoming edge; 
(16, 18) normal; 

Things start getting challenging after the vectorizer and cunroll run.  Such
that by vrp-thread2, ranger figures out that the 2->3 edge is unreachable, _21
must be 0, and shit rolls downhill from there:

  unsigned long ivtmp.31;
  short int * vectp_arr_32.21;
  vector(8) short int * vectp_arr_32.20;
  unsigned short tmp.19;
  short int tmp.18;
  int D.4484;
  bool var_22_lsm_flag.15;
  int var_22_lsm.14;
  int D.4481;
  bool var_20_lsm_flag.13;
  int var_20_lsm.12;
  unsigned int f;
  int e;
  short int d;
  short int _2;
  unsigned int _3;
  bool _4;
  long long int _6;
  int _7;
  bool _21;
  unsigned short ivtmp_24;
  int _30(D);
  bool _33;
  unsigned short ivtmp_41;
  int _43(D);
  short int * _55;
  <signed-boolean:1> _64;
  int _66;
  unsigned long _74;
  <signed-boolean:1> _75;
  vector(8) <signed-boolean:1> vect_cst__76;
  void * _81;

  <bb 2> [local count: 8685306]:
  _2 = (short int) b_15(D);
  _3 = (unsigned int) _2;
  _4 = _3 != 0;
  _33 = _3 < b_15(D);
  _21 = _4 | _33;
  _64 = (<signed-boolean:1>) _21;
  _75 = -_64;
  vect_cst__76 = {_75, _75, _75, _75, _75, _75, _75, _75};
  if (_75 == 0)
    goto <bb 4>; [100.00%]
  else
    goto <bb 3>; [20.00%]

  <bb 3> [local count: 1737061]:
  MEM <vector(8) short int> [(short int *)&arr_32] = { 0, 0, 0, 0, 0, 0, 0, 0
};

  <bb 4> [local count: 8685306]:
  if (_21 != 0)
    goto <bb 5>; [50.00%]
  else
    goto <bb 6>; [50.00%]

  <bb 5> [local count: 2171327]:
  arr_32[8] = 0;

  <bb 6> [local count: 4342653]:
  if (_21 != 0)
    goto <bb 7>; [50.00%]
  else
    goto <bb 8>; [50.00%]
[snip]
[snip]

The reason ranger concludes that 2->3 is unreachable is from analyzing block 2:

  <bb 2> [local count: 8685306]:
  _2 = (short int) b_15(D);
  _3 = (unsigned int) _2;
  _4 = _3 != 0;
  _33 = _3 < b_15(D);
  _21 = _4 | _33;
  _64 = (<signed-boolean:1>) _21;
  _75 = -_64;
  vect_cst__76 = {_75, _75, _75, _75, _75, _75, _75, _75};
  if (_75 == 0)
    goto <bb 4>; [100.00%]
  else
    goto <bb 3>; [20.00%]

On the 2->3 edge, _75 == -1 because this is a 1-bit signed integer.  Solving
back we have:

_75 = - _64; ==> [-1,-1] = -_64;

-1 for a 1-bit signed integer is TYPE_MIN_VALUE, and NEG(TYPE_MIN_VALUE) is
unrepresentable.  So, _75 cannot be -1, thus the edge is unexecutable.

Questions:

a) Is -(-1) representable in 1-bit signed?

b) Could we somehow avoid creating the 1-bit signed in the vectorizer, since
they are a source of endless exception?

Thanks.