[Bug rtl-optimization/103431] New: [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts

[Bug rtl-optimization/103431] New: [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

            Bug ID: 103431
           Summary: [12 Regression] wrong code with -O -fno-tree-bit-ccp
                    -fno-tree-dominator-opts
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu

Created attachment 51874
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51874&action=edit
reduced testcase

Output:
$ x86_64-pc-linux-gnu-gcc -O -fno-tree-bit-ccp -fno-tree-dominator-opts
testcase.c
$ ./a.out
Aborted

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64//bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r12-5528-20211125184355-g9488d242066-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r12-5528-20211125184355-g9488d242066-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.0.0 20211125 (experimental) (GCC)

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
          Component|rtl-optimization            |middle-end
   Last reconfirmed|                            |2021-11-25

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.
reduced testcase (removing the globals):
typedef unsigned __int128 B;

__attribute__((noipa))
void f(unsigned short a)
{
  B b = 5;
  int size = (sizeof(b)*8)-1;
  a /= 0xfffffffd;
  B b1 = (b << (a & size) | b >> (-(a & size) & size));
  if (b1 != 5)
    __builtin_abort ();
}
int
main (void)
{
    f(0);
}

----- CUT ---
The gimple level does not change. In GCC 11 and the trunk, we have:
  _1 = (unsigned intD.9) a_8(D);
  _2 = _1 / 4294967293;
  a_9 = (short unsigned intD.18) _2;
  _13 = a_9 & 127;
  _3 = (intD.6) _13;
  b1_10 = 5 r<< _3;
  if (b1_10 != 5)

It looks like the expansion from gimple to RTL of the rotate is different
between the two versions.

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
           Keywords|                            |needs-bisection
   Target Milestone|---                         |12.0

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts since r12-4853-g2a83259f837e5cbd

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-4853-g2a83259f837e5cbd .

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts since r12-4853-g2a83259f837e5cbd

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I'll have a look.

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts since r12-4853-g2a83259f837e5cbd

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The bug is in the x86*_shld and x86*_shrd patterns.
  [(set (match_operand:SI 0 "nonimmediate_operand" "+r*m")
        (ior:SI (ashift:SI (match_dup 0)
                  (match_operand:QI 2 "nonmemory_operand" "Ic"))
                (lshiftrt:SI (match_operand:SI 1 "register_operand" "r")
                  (minus:QI (const_int 32) (match_dup 2)))))
   (clobber (reg:CC FLAGS_REG))]
doesn't correctly describe what the instructions do if operands[2] is zero,
because 32 - 0 is an out of bounds shift.

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts since r12-4853-g2a83259f837e5cbd

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 51881
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51881&action=edit
gcc12-pr103431-wip.patch

I've tried this, but that is actually incorrect too.
Because for operands[1], what we actually want for operands[2] of 0 is not
shift by 0, but actually not or the operand in.

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts since r12-4853-g2a83259f837e5cbd

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #51881|0                           |1
        is obsolete|                            |

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 51883
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51883&action=edit
gcc12-pr103431.patch

This patch seems to work though.  Untested so far.

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts since r12-4853-g2a83259f837e5cbd

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:f7e4f57f1c7883721b6f5ad48953e10ebfb5a756

commit r12-5558-gf7e4f57f1c7883721b6f5ad48953e10ebfb5a756
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Nov 27 13:02:06 2021 +0100

    x86: Fix up x86_{,64_}sh{l,r}d patterns [PR103431]

    The following testcase is miscompiled because the x86_{,64_}sh{l,r}d
    patterns don't properly describe what the instructions do.  One thing
    is left out, in particular that there is initial count &= 63 for
    sh{l,r}dq and initial count &= 31 for sh{l,r}d{l,w}.  And another thing
    not described properly, in particular the behavior when count (after the
    masking) is 0.  The pattern says it is e.g.
    res = (op0 << op2) | (op1 >> (64 - op2))
    but that triggers UB on op1 >> 64.  For op2 0 we actually want
    res = (op0 << op2) | 0
    When constants are propagated to these patterns during RTL optimizations,
    both such problems trigger wrong-code issues.
    This patch represents the patterns as e.g.
    res = (op0 << (op2 & 63)) | (unsigned long long) ((uint128_t) op1 >> (64 -
(op2 & 63)))
    so there is both the initial masking and op2 == 0 behavior results in
    zero being ored.
    The patch introduces alternate patterns for constant op2 where
    simplify-rtx.c will fold those expressions into simple numbers,
    and define_insn_and_split pre-reload splitter for how the patterns
    looked before into the new form, so that it can pattern match during
    combine even computations that assumed the shift amount will be in
    the range of 1 .. bitsize-1.

    2021-11-27  Jakub Jelinek  <jakub@redhat.com>

            PR middle-end/103431
            * config/i386/i386.md (x86_64_shld, x86_shld, x86_64_shrd,
x86_shrd):
            Change insn pattern to accurately describe the instructions.
            (*x86_64_shld_1, *x86_shld_1, *x86_64_shrd_1, *x86_shrd_1): New
            define_insn patterns.
            (*x86_64_shld_2, *x86_shld_2, *x86_64_shrd_2, *x86_shrd_2): New
            define_insn_and_split patterns.
            (*ashl<dwi>3_doubleword_mask, *ashl<dwi>3_doubleword_mask_1,
            *<insn><dwi>3_doubleword_mask, *<insn><dwi>3_doubleword_mask_1,
            ix86_rotl<dwi>3_doubleword, ix86_rotr<dwi>3_doubleword): Adjust
            splitters for x86_{,64_}sh{l,r}d pattern changes.

            * gcc.dg/pr103431.c: New test.

[Bug middle-end/103431] [12 Regression] wrong code with -O -fno-tree-bit-ccp -fno-tree-dominator-opts since r12-4853-g2a83259f837e5cbd

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103431

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.