[Bug tree-optimization/105337] New: wrong code at -Os and above on x86_64-linux-gnu

[Bug tree-optimization/105337] New: wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

            Bug ID: 105337
           Summary: wrong code at -Os and above on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

[586] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.1 20220421 (experimental) [master r12-8217-g605a80bb733] (GCC) 
[587] % 
[587] % gcctk -O1 small.c; ./a.out
[588] % 
[588] % gcctk -Os small.c
[589] % ./a.out
Aborted
[590] % 
[590] % cat small.c
int printf(const char *, ...);
int a;
int f() {
  int b, c;
  for (b = 0; b < 3; b++) {
    if (!a)
      break;
    c--;
    printf("%d", c);
  }
  return b;
}
int main() {
  if (f())
    __builtin_abort ();
  return 0;
}

[Bug tree-optimization/105337] wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

--- Comment #1 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Compiler Explorer: https://godbolt.org/z/1bds4P7c7

[Bug tree-optimization/105337] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |12.0
                 CC|                            |aoliva at gcc dot gnu.org,
                   |                            |mpolacek at gcc dot gnu.org
     Ever confirmed|0                           |1
           Keywords|                            |wrong-code
   Last reconfirmed|                            |2022-04-21
            Summary|wrong code at -Os and above |[12 Regression] wrong code
                   |on x86_64-linux-gnu         |at -Os and above on
                   |                            |x86_64-linux-gnu

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.  Started with r12-397-gda9e6e63d1ae22, in particular this hunk:

--- a/gcc/passes.def
+++ b/gcc/passes.def
@@ -336,8 +336,9 @@ along with GCC; see the file COPYING3.  If not see
       NEXT_PASS (pass_thread_jumps);
       NEXT_PASS (pass_vrp, false /* warn_array_bounds_p */);
       /* Threading can leave many const/copy propagations in the IL.
-    Clean them up.  */
-      NEXT_PASS (pass_copy_prop);
+    Clean them up.  Instead of just copy_prop, we use ccp to
+    compute alignment and nonzero bits.  */
+      NEXT_PASS (pass_ccp, true /* nonzero_p */);
       NEXT_PASS (pass_warn_restrict);
       NEXT_PASS (pass_dse);
       NEXT_PASS (pass_cd_dce, true /* update_address_taken_p */);

[Bug tree-optimization/105337] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Ah, but the testcase has UB: c is used uninitialized.

[Bug tree-optimization/105337] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

--- Comment #4 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Eh, disregard previous comment, sorry.

[Bug tree-optimization/105337] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
printf isn't really needed.  This fails even with -O2, doesn't with -O1 or -O0:

__attribute__((noipa)) void
bar (int x)
{
  (void) x;
}

int a;

int
foo (void)
{
  int b, c;
  for (b = 0; b < 3; b++)
    {
      if (!a)
        break;
      c--;
      bar (c);
    }
  return b;
}

int
main ()
{
  if (foo ())
    __builtin_abort ();
  return 0;
}

[Bug tree-optimization/105337] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I'd say that ivopts is at fault here.  Before that we have:
  <bb 2> [local count: 312727306]:

  <bb 3> [local count: 805306369]:
  # b_14 = PHI <b_9(6), 0(2)>
  # c_15 = PHI <c_7(6), c_5(D)(2)>
  # ivtmp_3 = PHI <ivtmp_2(6), 3(2)>
  a.0_1 = a;
  if (a.0_1 == 0)
    goto <bb 7>; [5.50%]
  else
    goto <bb 4>; [94.50%]
...
  <bb 7> [local count: 44291850]:
  # b_4 = PHI <b_14(3)>

  <bb 5> [local count: 312727306]:
  # b_10 = PHI <b_4(7), 3(8)>
  return b_10;
as the path actually taken at runtime, yes, we use uninitialized c in the PHI,
but that doesn't correspond to UB at runtime.
But ivopts changes that to:
  <bb 2> [local count: 312727306]:
  _19 = (unsigned int) c_5(D);
  _20 = _19 + 4294967293;
  _21 = (int) _20;

  <bb 3> [local count: 805306369]:
  # c_15 = PHI <c_7(6), c_5(D)(2)>
  _13 = (unsigned int) c_5(D);
  _12 = (unsigned int) c_15;
  _11 = -_12;
  _18 = _11 + _13;
  b_14 = (int) _18;
  a.0_1 = a;
  if (a.0_1 == 0)
    goto <bb 7>; [5.50%]
  else
    goto <bb 4>; [94.50%]
...
  <bb 7> [local count: 44291850]:
  # b_4 = PHI <b_14(3)>

  <bb 5> [local count: 312727306]:
  # b_10 = PHI <b_4(7), 3(8)>
  return b_10;
and now it uses the uninitialized value in arithmetics in the actually executed
code.  And, even the return value which gets a copy of b_14 now depends on that
uninitialized value.  I think we had some other PR about this...
Then comes ccp4 and figures out that many values are UNDEFINED and optimizes it
into return 3;

[Bug tree-optimization/105337] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Perhaps similar or dup of PR100810?

[Bug tree-optimization/105337] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105337

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|NEW                         |RESOLVED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
I can confirm that both the original and the reduced testcase work fine with
the yet unreviewed patch for PR100810 installed.  I've added the reduced
testcase to the pending patch.

*** This bug has been marked as a duplicate of bug 100810 ***