[Bug middle-end/104067] New: wrong code compiling QEMU

[Bug middle-end/104067] New: wrong code compiling QEMU

[bonzini at gnu dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

            Bug ID: 104067
           Summary: wrong code compiling QEMU
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: blocker
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bonzini at gnu dot org
  Target Milestone: ---
            Target: x86_64-pc-linux-gnu

Compiling QEMU's tests/unit/rcutorture.c file with GCC 12 causes an incorrect
optimization

Here is a reduced testcase:

extern void abort();
struct rcu_stress {
    int x;
};

struct rcu_stress rcu_stress_array[10] = { { 0 } };
struct rcu_stress *rcu_stress_current;

int main(int argc, char *argv[])
{
    int i, rcu_stress_idx = 0;
    struct rcu_stress *cp = rcu_stress_array;

    for (i = 100; --i > 0; ) {
        struct rcu_stress *p;
        rcu_stress_idx++;
        if (rcu_stress_idx >= 10) {
            rcu_stress_idx = 0;
        }
        p = &rcu_stress_array[rcu_stress_idx];

       if (p == cp) abort();
        __atomic_thread_fence(5);
        cp = p;
    }
}

$ /opt/gcc-latest/bin/gcc -m64 -mcx16 -std=gnu11 -O2 -fno-strict-aliasing
-fno-common -fwrapv gccbug.c -o gccbug  -pthread  && ./gccbug
Aborted (core dumped)
$ gcc -m64 -mcx16 -std=gnu11 -O2 -fno-strict-aliasing -fno-common -fwrapv
gccbug.c -o gccbug  -pthread  && ./gccbug

The issue seems to be that when "p" is assigned &rcu_stress_array[10], gcc
decides it's undefined behavior and triggers the abort.  The first problematic
dump is .194t.threadfull2:

  <bb 5> [count: 0]:
  abort ();

...
  <bb 7> [local count: 1052374367]:
  # rcu_stress_idx_21 = PHI <rcu_stress_idx_2(6)>
  # cp_7 = PHI <prephitmp_16(6)>
  # ivtmp_12 = PHI <ivtmp_3(6)>
  rcu_stress_idx_20 = rcu_stress_idx_21 + 1;
  if (rcu_stress_idx_20 == 10)
    goto <bb 8>; [34.00%]
  else
    goto <bb 3>; [66.00%]

  <bb 8> [local count: 357807289]:
  # rcu_stress_idx_5 = PHI <0(7)>
  # prephitmp_9 = PHI <&rcu_stress_array(7)>
  goto <bb 5>; [100.00%]

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-01-17
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |marxin at gcc dot gnu.org
            Summary|wrong code compiling QEMU   |[12 Regression] wrong code
                   |                            |compiling QEMU since
                   |                            |r12-4790-g4b3a325f07acebf4
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-4790-g4b3a325f07acebf4.

One needs only -O2 option.

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=103721

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Likely dup of PR103721.

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
                 CC|                            |jakub at gcc dot gnu.org
   Target Milestone|---                         |12.0

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
extern void abort ();
struct S { int x; } a[10];
struct S *b;

int
main ()
{
  int i, j = 0;
  struct S *q = a;

  for (i = 100; --i > 0; )
    {
      struct S *p;
      j++;
      if (j >= 10)
        j = 0;
      p = &a[j];

      if (p == q)
        abort ();
      __atomic_thread_fence (__ATOMIC_SEQ_CST);
      q = p;
    }
  return 0;
}

This goes wrong in threadfull2, strlen1 looks correct to me:
  <bb 2> [local count: 10737416]:

  <bb 3> [local count: 1063004409]:
  # j_17 = PHI <j_2(9), 0(2)>
  # q_18 = PHI <prephitmp_16(9), &a(2)>
  # ivtmp_4 = PHI <ivtmp_3(9), 99(2)>
  j_8 = j_17 + 1;
  if (j_8 == 10)
    goto <bb 5>; [34.00%]
  else
    goto <bb 4>; [66.00%]

  <bb 4> [local count: 701582906]:
  _1 = (sizetype) j_8;
  _15 = _1 * 4;
  _14 = &a + _15;

  <bb 5> [local count: 1063004409]:
  # j_2 = PHI <j_8(4), 0(3)>
  # prephitmp_16 = PHI <_14(4), &a(3)>
  if (prephitmp_16 == q_18)
    goto <bb 6>; [0.00%]
  else
    goto <bb 7>; [100.00%]

  <bb 6> [count: 0]:
  abort ();

  <bb 7> [local count: 1063004409]:
  __atomic_thread_fence (5);
  ivtmp_3 = ivtmp_4 - 1;
  if (ivtmp_3 != 0)
    goto <bb 9>; [99.00%]
  else
    goto <bb 8>; [1.00%]

  <bb 9> [local count: 1052374367]:
  goto <bb 3>; [100.00%]

  <bb 8> [local count: 10737416]:
  return 0;

but threadfull2 turns that into something that weirdly starts with:
  <bb 2> [local count: 10737416]:
  j_8 = 1;
  if (j_8 == 10)
    goto <bb 4>; [34.00%]
  else
    goto <bb 3>; [66.00%]

  <bb 3> [local count: 701582906]:
  # ivtmp_22 = PHI <99(2), ivtmp_12(7)>
  # j_24 = PHI <j_8(2), j_20(7)>
  # q_25 = PHI <&a(2), q_7(7)>
  _1 = (sizetype) j_24;
  _15 = _1 * 4;
  _14 = &a + _15;

  <bb 4> [local count: 705197120]:
  # j_2 = PHI <j_24(3), 0(2)>
  # prephitmp_16 = PHI <_14(3), &a(2)>
  # ivtmp_23 = PHI <ivtmp_22(3), 99(2)>
  # q_26 = PHI <q_25(3), &a(2)>
  if (prephitmp_16 == q_26)
    goto <bb 5>; [0.00%]
  else
    goto <bb 6>; [100.00%]

  <bb 5> [count: 0]:
  abort ();

and for j == 10 turns it into unconditional abort:
  j_20 = j_21 + 1;
  if (j_20 == 10)
    goto <bb 8>; [34.00%]
  else
    goto <bb 3>; [66.00%]

  <bb 8> [local count: 357807289]:
  # j_5 = PHI <0(7)>
  # prephitmp_9 = PHI <&a(7)>
  goto <bb 5>; [100.00%]

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

--- Comment #4 from Andrew Macleod <amacleod at redhat dot com> ---
(In reply to Martin Liška from comment #2)
> Likely dup of PR103721.

I think so too. It looks eerily familiar.   Aldy will be back this week and
will have a look.

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

--- Comment #5 from Jeffrey A. Law <law at gcc dot gnu.org> ---
I briefly looked at the other BZ last week, but didn't make much headway.  The
first thing that stood out was why are we threading around the loop.  I thought
that was disabled.  Anyway, Aldy and/or I will take both of these in the coming
days.

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

--- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Jeffrey A. Law from comment #5)
> I briefly looked at the other BZ last week, but didn't make much headway. 
> The first thing that stood out was why are we threading around the loop.  I
> thought that was disabled.  Anyway, Aldy and/or I will take both of these in
> the coming days.

This is the threadfull2 pass which is the most aggressive of the threaders. 
Loop optimizations have completed, so anything goes wrt loops (as per
jt_path_registry::cancel_invalid_paths).

Note that the issue here is not exactly a backedge problem as in PR103721, but
a domination problem.  I will comment in the other PR as they are related.

[Bug middle-end/104067] [12 Regression] wrong code compiling QEMU since r12-4790-g4b3a325f07acebf4

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104067

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|NEW                         |RESOLVED

--- Comment #7 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
dup

*** This bug has been marked as a duplicate of bug 103721 ***