[Bug tree-optimization/103581] New: [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[Bug tree-optimization/103581] New: [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

            Bug ID: 103581
           Summary: [12 Regression] 403.gcc miscompiled since
                    r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---

Since the revision -Ofast -march=znver3 -flto=auto configuration fails:

$ valgrind ./gcc cccp.in 
==14547== Memcheck, a memory error detector
==14547== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==14547== Using Valgrind-3.17.0.GIT and LibVEX; rerun with -h for copyright
info
==14547== Command: ./gcc cccp.in
==14547== 
==14547== Invalid read of size 4
==14547==    at 0x653EC3: UnknownInlinedFun (dominance.c:615)
==14547==    by 0x653EC3: UnknownInlinedFun (dominance.c:590)
==14547==    by 0x653EC3: ssa_eliminate_dead_code (ssa-dce.c:519)
==14547==    by 0x61DEF5: rest_of_compilation (in
/home/marxin/Programming/cpu2006/benchspec/CPU2006/403.gcc/build/wdir/gcc)
==14547==    by 0x40D887: c_expand_body.part.0 (in
/home/marxin/Programming/cpu2006/benchspec/CPU2006/403.gcc/build/wdir/gcc)
==14547==    by 0x415EFD: finish_function (in
/home/marxin/Programming/cpu2006/benchspec/CPU2006/403.gcc/build/wdir/gcc)
==14547==    by 0x405FEE: yyparse_1 (in
/home/marxin/Programming/cpu2006/benchspec/CPU2006/403.gcc/build/wdir/gcc)
==14547==    by 0x61ED6D: toplev_main (in
/home/marxin/Programming/cpu2006/benchspec/CPU2006/403.gcc/build/wdir/gcc)
==14547==    by 0x49A25BF: __libc_start_call_main (libc_start_call_main.h:58)
==14547==    by 0x49A267B: __libc_start_main@@GLIBC_2.34 (libc-start.c:409)
==14547==    by 0x401BE4: _start (start.S:116)
==14547==    by 0x1FFEFFFD57: ???
==14547==    by 0x1B: ???
==14547==    by 0x1: ???
==14547==  Address 0x58 is not stack'd, malloc'd or (recently) free'd

LTO is needed for 2 object files that cause the segfault:
dominance.c ssa-dce.c

[Bug tree-optimization/103581] [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 51933
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51933&action=edit
test-case

One can see the difference here:

$ gcc dominance.i ssa-dce.i -shared -fPIC -flto=auto -flto-partition=one -Ofast
-march=znver3 -flto=auto -o xxx -fdump-tree-vect

...
$ diff -u xxx.ltrans0.ltrans.169t.vect.good xxx.ltrans0.ltrans.169t.vect.bad

[Bug tree-optimization/103581] [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-12-06
             Blocks|                            |26163
      Known to fail|                            |12.0
             Status|UNCONFIRMED                 |NEW
           Priority|P3                          |P1
      Known to work|                            |11.2.0
   Target Milestone|---                         |12.0
     Ever confirmed|0                           |1


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=26163
[Bug 26163] [meta-bug] missed optimization in SPEC (2k17, 2k and 2k6 and 95)

[Bug tree-optimization/103581] [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Also reproducible on Zen2 with -mtune-ctrl=use_gather

[Bug tree-optimization/103581] [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Btw, it's this loop being vectorized:

      int i;
      for (i = 0; i < n_basic_blocks; i++)
        {
          basic_block b = BASIC_BLOCK (i);
          TBB d = di.dom[di.dfs_order[b->index]];

          /* The old code didn't modify array elements of nodes having only
             itself as dominator (d==0) or only ENTRY_BLOCK (resp. EXIT_BLOCK)
             (d==1).  */
          if (d > 1)
            idom[i] = di.dfs_to_bb[d]->index;
        }

di.dom[] and di.dfs_order[] are unsigned int, b->index is int, the blocks
are fetched from an array of pointers.  But the relevant difference is in
the vectorization of the masked (d > 1) gathers where di.dfs_to_bb is
basic_block *[].

struct basic_block { int index; };
void foo (int * __restrict idom, int n_basic_blocks, 
          unsigned int *indices, struct basic_block **dfs_to_bb)
{
  for (int i = 0; i < n_basic_blocks; ++i)
    {
      unsigned int d = indices[i];
      if (d > 1)
        idom[i] = dfs_to_bb[d]->index;
    }
}

does not vectorize because of alias issues, the .MASK_{LOAD,STORE} generated
by if-conversion do not carry along restrict info ...

Even making the store unconditional does not fix this particular issue.

Even simplified as

struct basic_block { int index; };
void foo (struct basic_block *__restrict *idom, int n_basic_blocks,
          unsigned int *indices, struct basic_block * __restrict *dfs_to_bb)
{
  for (int i = 0; i < n_basic_blocks; ++i)
    {
      unsigned int d = indices[i];
      struct basic_block *tem;
      if (d > 1)
        tem = dfs_to_bb[d];
      else
        tem = 0;
      idom[i] = tem;
    }
}

does not work :/

[Bug tree-optimization/103581] [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
A reproducer needs to trigger masked NARROW case in
vect_build_gather_load_calls.
I wasn't able to build a reproducer sofar.  The following vectorizes with
a masked store & masked gather load, side-stepping alias issues:

unsigned long long * __attribute__((noipa))
maskgatherdisi (int n, unsigned int *indices, unsigned long long *data)
{
  unsigned long long *out
    = __builtin_malloc (sizeof (unsigned long long) * n);
  for (int i = 0; i < n; ++i)
    {
      unsigned int d = indices[i];
      if (d > 1)
        out[i] = data[d];
    }
  return out;
}

testing a fix.

[Bug tree-optimization/103581] [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:0dc77a0c4942d3b264f8f8cfc2c509ecc02c3634

commit r12-5805-g0dc77a0c4942d3b264f8f8cfc2c509ecc02c3634
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Dec 6 15:13:49 2021 +0100

    tree-optimization/103581 - fix masked gather on x86

    The recent fix to PR103527 exposed an issue with how the various
    special casing for AVX512 masks in vect_build_gather_load_calls
    are handled.  The following makes that more obvious, fixing the
    miscompile of 403.gcc.

    2021-12-06  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/103581
            * tree-vect-stmts.c (vect_build_gather_load_calls): Properly
            guard all the AVX512 mask cases.

            * gcc.dg/vect/pr103581.c: New testcase.

[Bug tree-optimization/103581] [12 Regression] 403.gcc miscompiled since r12-5708-g70ece2d4ca403dfc6a837d876642378a8d4d3dce

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103581

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.