[Bug tree-optimization/103300] New: wrong code at -O3 on x86_64-linux-gnu

[Bug tree-optimization/103300] New: wrong code at -O3 on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

            Bug ID: 103300
           Summary: wrong code at -O3 on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It appears to be a recent regression.

[596] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20211117 (experimental) [master r12-5333-g1a15a91a001] (GCC) 
[597] % 
[597] % gcctk -O2 small.c; ./a.out
[598] % 
[598] % gcc110 -O3 small.c; ./a.out
[599] % 
[599] % gcctk -O3 small.c
[600] % ./a.out
Aborted
[601] % 
[601] % cat small.c
int a, b[2], c, d, e, f;
int g(int h, int i) { return !i || h && i == 1 ? 0 : h % i; }
void j() {
  while (1)
    while (1) {
      if (d)
      L:
        if (f)
          break;
      if (e)
        goto L;
      return;
    }
}
int main() {
  j();
  for (c = 0; c < 3; c++)
    for (a = 0; a < 2; a++)
      if (g(0, b[a]++))
        while (1)
          ;
  if (b[1] != 3)
    __builtin_abort();
  return 0;
}

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |needs-bisection, wrong-code
   Last reconfirmed|                            |2021-11-17
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.0
            Summary|wrong code at -O3 on        |[12 Regression] wrong code
                   |x86_64-linux-gnu            |at -O3 on x86_64-linux-gnu

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

Re: [Bug tree-optimization/103300] New: wrong code at -O3 on x86_64-linux-gnu

[Jan Hubicka]

Needs -O2  -floop-unroll-and-jam   --param early-inlining-insns=14
to fail, so I guess it may be issue with unrol-and-jam.

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu

[hubicka at kam dot mff.cuni.cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

--- Comment #2 from hubicka at kam dot mff.cuni.cz ---
Needs -O2  -floop-unroll-and-jam   --param early-inlining-insns=14
to fail, so I guess it may be issue with unrol-and-jam.

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to hubicka from comment #2)
> Needs -O2  -floop-unroll-and-jam   --param early-inlining-insns=14
> to fail, so I guess it may be issue with unrol-and-jam.

The major difference I see between GCC 11 and GCC 12 is how tree-loop-im
handles the load/store of a and c. In GCC 11, it was an unconditional move of
the store of a and c while in GCC 12 we get some interesting branches:
  <bb 9> [local count: 35059055]:
  # a_lsm.21_25 = PHI <_20(D)(6), _15(8)>
  # a_lsm_flag.22_8 = PHI <0(6), 1(8)>
  # c_lsm.23_22 = PHI <0(6), _5(8)>
  if (c_lsm.23_22 <= 2)
    goto <bb 17>; [94.50%]
  else
    goto <bb 10>; [5.50%]

  <bb 10> [local count: 1928248]:
  # a_lsm_flag.22_14 = PHI <a_lsm_flag.22_8(9)>
  # a_lsm.21_28 = PHI <a_lsm.21_25(9)>
  c_lsm.23_27 = 3;
  if (a_lsm_flag.22_14 != 0)
    goto <bb 11>; [66.67%]
  else
    goto <bb 12>; [33.33%]

  <bb 11> [local count: 1285499]:
  c = c_lsm.23_27;

  <bb 12> [local count: 1285499]:
  if (a_lsm_flag.22_14 != 0)
    goto <bb 13>; [66.67%]
  else
    goto <bb 14>; [33.33%]

  <bb 13> [local count: 856999]:
  a = a_lsm.21_28;

  <bb 14> [local count: 1928248]:

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |12.0
           Priority|P3                          |P1
                 CC|                            |rguenth at gcc dot gnu.org

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |matz at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #3)
> (In reply to hubicka from comment #2)
> > Needs -O2  -floop-unroll-and-jam   --param early-inlining-insns=14
> > to fail, so I guess it may be issue with unrol-and-jam.
> 
> The major difference I see between GCC 11 and GCC 12 is how tree-loop-im
> handles the load/store of a and c. In GCC 11, it was an unconditional move
> of the store of a and c while in GCC 12 we get some interesting branches:
>   <bb 9> [local count: 35059055]:
>   # a_lsm.21_25 = PHI <_20(D)(6), _15(8)>
>   # a_lsm_flag.22_8 = PHI <0(6), 1(8)>
>   # c_lsm.23_22 = PHI <0(6), _5(8)>
>   if (c_lsm.23_22 <= 2)
>     goto <bb 17>; [94.50%]
>   else
>     goto <bb 10>; [5.50%]
> 
>   <bb 10> [local count: 1928248]:
>   # a_lsm_flag.22_14 = PHI <a_lsm_flag.22_8(9)>
>   # a_lsm.21_28 = PHI <a_lsm.21_25(9)>
>   c_lsm.23_27 = 3;
>   if (a_lsm_flag.22_14 != 0)
>     goto <bb 11>; [66.67%]
>   else
>     goto <bb 12>; [33.33%]
> 
>   <bb 11> [local count: 1285499]:
>   c = c_lsm.23_27;
> 
>   <bb 12> [local count: 1285499]:
>   if (a_lsm_flag.22_14 != 0)
>     goto <bb 13>; [66.67%]
>   else
>     goto <bb 14>; [33.33%]
> 
>   <bb 13> [local count: 856999]:
>   a = a_lsm.21_28;
> 
>   <bb 14> [local count: 1928248]:

That's likely a missed threading / header copying, the stores are conditional
now and thus need protecting against store data races.

What unroll-and-jam does is make the inner loop enter always, only considering
the loop header check for the second iteration and also fails to include the
increment.  That's likely a latent issue, maybe because the latch of the
outer loop is not empty?

Testcase that fails with -O2 -floop-unroll-and-jam:

int a, b[2], c, d, e, f;
int g(int h, int i) { return !i || h && i == 1 ? 0 : h % i; }
static void j() {
  while (1)
    while (1) {
      if (d)
      L:
        if (f)
          break;
      if (e)
        goto L;
      return;
    }
}
int main() {
  j();
  for (c = 0; c < 3; c++)
    for (a = 0; a < 2; a++)
      if (g(0, b[a]++))
        while (1)
          ;
  if (b[1] != 3)
    __builtin_abort();
  return 0;
}

Micha?

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu since r12-4526-gd8edfadfc7a9795b

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12 Regression] wrong code  |[12 Regression] wrong code
                   |at -O3 on x86_64-linux-gnu  |at -O3 on x86_64-linux-gnu
                   |                            |since
                   |                            |r12-4526-gd8edfadfc7a9795b
                 CC|                            |marxin at gcc dot gnu.org
           Keywords|needs-bisection             |

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Exposed by r12-4526-gd8edfadfc7a9795b.

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu since r12-4526-gd8edfadfc7a9795b

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

--- Comment #6 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Another test likely for the same issue:

[652] % gcctk -O3 small.c; ./a.out
Aborted
[653] % gcctk -O2 -floop-unroll-and-jam small.c; ./a.out
Aborted
[654] % cat small.c
int printf(const char *, ...);
int a[2], b, c, d, e;
int main() {
  if (b) {
    printf("0");
    goto L2;
  }
L1:
  b = 0;
L2:
  if (d)
  L3:
    goto L1;
  if (e)
    goto L3;
  if (c)
    goto L2;
  for (b = 0; b < 3; b++)
    for (d = 0; d < 2; d++)
      a[d] ^= 1;
  if (a[1] != 1)
    __builtin_abort();
  return 0;
}

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu since r12-4526-gd8edfadfc7a9795b

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Zhendong Su from comment #6)
> Another test likely for the same issue:
> 
> [652] % gcctk -O3 small.c; ./a.out
> Aborted
> [653] % gcctk -O2 -floop-unroll-and-jam small.c; ./a.out
> Aborted
> [654] % cat small.c
> int printf(const char *, ...);
> int a[2], b, c, d, e;
> int main() {
>   if (b) {
>     printf("0");
>     goto L2;
>   }
> L1:
>   b = 0;
> L2:
>   if (d)
>   L3:
>     goto L1;
>   if (e)
>     goto L3;
>   if (c)
>     goto L2;
>   for (b = 0; b < 3; b++)
>     for (d = 0; d < 2; d++)
>       a[d] ^= 1;
>   if (a[1] != 1)
>     __builtin_abort();
>   return 0;
> }

Yes, started with the same revision.

[Bug tree-optimization/103300] [12 Regression] wrong code at -O3 on x86_64-linux-gnu since r12-4526-gd8edfadfc7a9795b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103300

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|NEW                         |RESOLVED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed by the fix for PR104543.  Likely caused by less aggressive jump threading
in the end.

*** This bug has been marked as a duplicate of bug 104543 ***