[Bug tree-optimization/105665] New: wrong code at -Os and above on x86_64-linux-gnu

[Bug tree-optimization/105665] New: wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

            Bug ID: 105665
           Summary: wrong code at -Os and above on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be a regression from 11.3.

[599] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.0 20220519 (experimental) [master r13-673-gd863ba23fb1] (GCC) 
[600] % 
[600] % gcctk -O1 small.c; ./a.out
[601] % 
[601] % gcctk -Os small.c
[602] % ./a.out
Segmentation fault
[603] % 
[603] % cat small.c
int a, b, c[1], d[2], *e = c;
int main() {
  int f = 0;
  for (; b < 2; b++) {
    int g;
    if (f)
      b = 40;
    a = d[b * b];
    for (f = 0; f < 3; f++) {
      if (e)
        break;
      g--;
      if (a)
        a = g;
    }
  }
  return 0;
}

[Bug tree-optimization/105665] wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

--- Comment #1 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Compiler Explorer: https://godbolt.org/z/jsT5Evv54

[Bug tree-optimization/105665] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-05-19
   Target Milestone|---                         |12.2
             Status|UNCONFIRMED                 |NEW
                 CC|                            |aoliva at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
            Summary|wrong code at -Os and above |[12/13 Regression] wrong
                   |on x86_64-linux-gnu         |code at -Os and above on
                   |                            |x86_64-linux-gnu since
                   |                            |r12-397-gda9e6e63d1ae22

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Likely started with r12-397-gda9e6e63d1ae22.

[Bug tree-optimization/105665] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r12-398-g5fbe6a8e73b52c6ebc28b9 because r12-397 didn't compile,
but yes, it is r12-397.

[Bug tree-optimization/105665] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |12.1.0
           Keywords|                            |wrong-code
           Priority|P3                          |P2

[Bug tree-optimization/105665] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #3)
> Started with r12-398-g5fbe6a8e73b52c6ebc28b9 because r12-397 didn't compile,
> but yes, it is r12-397.

And it is very similar to PR 100810 in the sense there is an not-executed use
of an uninitialized variable too.

[Bug tree-optimization/105665] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[aoliva at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

Alexandre Oliva <aoliva at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |aoliva at gcc dot gnu.org

--- Comment #5 from Alexandre Oliva <aoliva at gcc dot gnu.org> ---
Mine.  The problem is that the undef name may appear deep in a chain of phis,
instead of appearing directly in the base expr.

[Bug tree-optimization/105665] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Alexandre Oliva <aoliva@gcc.gnu.org>:

https://gcc.gnu.org/g:be2861fe8c527a5952257462ceca899bb43b1452

commit r13-972-gbe2861fe8c527a5952257462ceca899bb43b1452
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Fri Jun 3 03:59:03 2022 -0300

    [PR105665] ivopts: check defs of names in base for undefs

    The patch for PR 100810 tested for undefined SSA_NAMEs appearing
    directly in the base expression of the potential IV candidate, but
    that's not enough.  The testcase for PR105665 shows an undefined
    SSA_NAME has the same ill effect if it's referenced as an PHI_NODE arg
    in the referenced SSA_NAME.  The variant of that test shows it can be
    further removed from the referenced SSA_NAME.

    To avoid deep recursion, precompute maybe-undefined SSA_NAMEs: start
    from known-undefined nonvirtual default defs, and propagate them to
    any PHI nodes reached by a maybe-undefined arg, as long as there
    aren't intervening non-PHI uses, that would imply the maybe-undefined
    name must be defined at that point, otherwise it would invoke
    undefined behavior.  Also test for intervening non-PHI uses of DEFs in
    the base expr.

    The test for intervening uses implemented herein relies on dominance;
    this could be further extended, regarding conditional uses in every
    path leading to a point as an unconditional use dominating that point,
    but I haven't implemented that.


    for  gcc/ChangeLog

            PR tree-optimization/105665
            PR tree-optimization/100810
            * tree-ssa-loop-ivopts.cc
            (ssa_name_maybe_undef_p, ssa_name_set_maybe_undef): New.
            (ssa_name_any_use_dominates_bb_p, mark_ssa_maybe_undefs): New.
            (find_ssa_undef): Check precomputed flag and intervening uses.
            (tree_ssa_iv_optimize): Call mark_ssa_maybe_undefs.

    for  gcc/testsuite/ChangeLog

            PR tree-optimization/105665
            PR tree-optimization/100810
            * gcc.dg/torture/pr105665.c: New.

[Bug tree-optimization/105665] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:4ca164a6372412a1b3dc62b6fbde77d338e22bd4

commit r12-8624-g4ca164a6372412a1b3dc62b6fbde77d338e22bd4
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Fri Jun 3 03:59:03 2022 -0300

    [PR105665] ivopts: check defs of names in base for undefs

    The patch for PR 100810 tested for undefined SSA_NAMEs appearing
    directly in the base expression of the potential IV candidate, but
    that's not enough.  The testcase for PR105665 shows an undefined
    SSA_NAME has the same ill effect if it's referenced as an PHI_NODE arg
    in the referenced SSA_NAME.  The variant of that test shows it can be
    further removed from the referenced SSA_NAME.

    To avoid deep recursion, precompute maybe-undefined SSA_NAMEs: start
    from known-undefined nonvirtual default defs, and propagate them to
    any PHI nodes reached by a maybe-undefined arg, as long as there
    aren't intervening non-PHI uses, that would imply the maybe-undefined
    name must be defined at that point, otherwise it would invoke
    undefined behavior.  Also test for intervening non-PHI uses of DEFs in
    the base expr.

    The test for intervening uses implemented herein relies on dominance;
    this could be further extended, regarding conditional uses in every
    path leading to a point as an unconditional use dominating that point,
    but I haven't implemented that.

    for  gcc/ChangeLog

            PR tree-optimization/105665
            PR tree-optimization/100810
            * tree-ssa-loop-ivopts.cc
            (ssa_name_maybe_undef_p, ssa_name_set_maybe_undef): New.
            (ssa_name_any_use_dominates_bb_p, mark_ssa_maybe_undefs): New.
            (find_ssa_undef): Check precomputed flag and intervening uses.
            (tree_ssa_iv_optimize): Call mark_ssa_maybe_undefs.

    for  gcc/testsuite/ChangeLog

            PR tree-optimization/105665
            PR tree-optimization/100810
            * gcc.dg/torture/pr105665.c: New.

    (cherry picked from commit be2861fe8c527a5952257462ceca899bb43b1452)

[Bug tree-optimization/105665] [12 Regression] wrong code at -Os and above on x86_64-linux-gnu since r12-397-gda9e6e63d1ae22

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105665

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |12.1.0
      Known to work|                            |12.1.1
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.