[Bug tree-optimization/106032] New: wrong code at -Os and above on x86_64-linux-gnu

[Bug tree-optimization/106032] New: wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

            Bug ID: 106032
           Summary: wrong code at -Os and above on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be a regression from 11.*. 

[640] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-sanitizers
--enable-languages=c,c++ --disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.0 20220619 (experimental) [master r13-1166-g4390e7bfbc6] (GCC) 
[641] % 
[641] % gcctk -O1 small.c; ./a.out
[642] % 
[642] % gcctk -Os small.c
[643] % ./a.out
Segmentation fault
[644] % 
[644] % cat small.c
int a, b, c, *d;
int main() {
  int e = 0, f = 0;
  for (; f < 1; f++)
    if (c < 0)
      e = *d;
  if (a) {
    a = b ? 0 : a;
    e && (b = a);
  }
  return 0;
}

[Bug tree-optimization/106032] wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

--- Comment #1 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Compiler Explorer: https://godbolt.org/z/PnTzaKsf4

[Bug tree-optimization/106032] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |13.0
      Known to work|                            |11.3.0
   Last reconfirmed|                            |2022-06-19
           Keywords|                            |wrong-code
     Ever confirmed|0                           |1
      Known to fail|                            |12.1.0, 13.0
   Target Milestone|---                         |13.0
            Summary|wrong code at -Os and above |[12/13 Regression] wrong
                   |on x86_64-linux-gnu         |code at -Os and above on
                   |                            |x86_64-linux-gnu
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

[Bug rtl-optimization/106032] [12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |rtl-optimization

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The tree level looks ok. THe only difference is 12/13 has:

  if (c.0_1 < 0)
    goto <bb 3>; [67.00%]
  else
    goto <bb 4>; [33.00%]

  <bb 3> [local count: 679839639]:
  e_15 = *d.1_2;

  <bb 4> [local count: 59055800]:

While 11 does:
  if (c.0_1 < 0)
    goto <bb 3>; [67.00%]
  else
    goto <bb 4>; [33.00%]

  <bb 3> [local count: 679839639]:
  d.1_2 = d;
  e_15 = *d.1_2;

  <bb 4> [local count: 59055800]:

That is the load from the global d is now unconditional but the load from *d is
still conditional.

I see ce2 is doing ifcvt on that and changing it to be an unconditional load.
IF-THEN-JOIN block found, pass 1, test 3, then 4, join 5

(insn 57 56 58 2 (parallel [
            (set (reg:SI 89)
                (ashiftrt:SI (reg:SI 90 [ c ])
                    (const_int 31 [0x1f])))
            (clobber (reg:CC 17 flags))
        ]) "/app/example.cpp":7:9 758 {ashrsi3_cvt}
     (expr_list:REG_DEAD (reg:SI 90 [ c ])
        (expr_list:REG_UNUSED (reg:CC 17 flags)
            (expr_list:REG_EQUAL (ashiftrt:SI (mem/c:SI (symbol_ref:DI ("c")
[flags 0x2]  <var_decl 0x7ff174377d80 c>) [1 c+0 S4 A32])
                    (const_int 31 [0x1f]))
                (nil)))))
(insn 58 57 16 2 (parallel [
            (set (reg:SI 91)
                (and:SI (reg:SI 89)
                    (mem:SI (reg/f:DI 83 [ d.1_2 ]) [1 *d.1_2+0 S4 A32])))
            (clobber (reg:CC 17 flags))
        ]) "/app/example.cpp":7:9 533 {*andsi_1}
     (expr_list:REG_DEAD (reg:SI 89)
        (expr_list:REG_DEAD (reg/f:DI 83 [ d.1_2 ])
            (expr_list:REG_UNUSED (reg:CC 17 flags)
                (nil)))))

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] wrong    |[10/11/12/13 Regression]
                   |code at -Os and above on    |wrong code at -Os and above
                   |x86_64-linux-gnu            |on x86_64-linux-gnu
      Known to work|11.3.0                      |6.1.0, 6.4.0
   Target Milestone|13.0                        |10.4
      Known to fail|                            |7.1.0, 8.1.0, 9.1.0

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Here is a testcase which shows this was latent but fails in GCC 7+ (so it is
still a regression):
int a, b, c, *d;
int main() {
  int e = 0, f = 0;
  int *dd = d;
  for (; f < 1; f++)
    if (c < 0)
      e = *dd;
  if (a) {
    a = b ? 0 : a;
    e && (b = a);
  }
  return 0;
}

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #4)
> Here is a testcase which shows this was latent but fails in GCC 7+ (so it is
> still a regression):
> int a, b, c, *d;
> int main() {
>   int e = 0, f = 0;
>   int *dd = d;
>   for (; f < 1; f++)
>     if (c < 0)
>       e = *dd;
>   if (a) {
>     a = b ? 0 : a;
>     e && (b = a);
>   }
>   return 0;
> }

This one started with r9-6299-gd7a700e0a701e516.

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #5)
> (In reply to Andrew Pinski from comment #4)
> > Here is a testcase which shows this was latent but fails in GCC 7+ (so it is
> > still a regression):
> > int a, b, c, *d;
> > int main() {
> >   int e = 0, f = 0;
> >   int *dd = d;
> >   for (; f < 1; f++)
> >     if (c < 0)
> >       e = *dd;
> >   if (a) {
> >     a = b ? 0 : a;
> >     e && (b = a);
> >   }
> >   return 0;
> > }
> 
> This one started with r9-6299-gd7a700e0a701e516.

I guess I need to make another testcase since that would have just changed the
gimple level.

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
This one seems to be very old:

__attribute__((noipa, noinline, noclone)) int
foo (int x, int *y)
{
  int a = 0;
  if (x < 0)
    a = *y;
  return a;  
}

int
main ()
{
  int a = 42;
  if (foo (0, 0) != 0 || foo (1, 0) != 0)
    __builtin_abort ();
  if (foo (-1, &a) != 42 || foo (-42, &a) != 42)
    __builtin_abort ();
  return 0;
}

I guess checking may_trap_p or may_trap_or_fault_p in noce_try_sign_mask would
fix this, but we probably should check other noce_* functions how they handle
possibly faulting memory.

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started likely with r0-57085

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 53170
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53170&action=edit
gcc13-pr106032.patch

Untested fix.

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:a0c30fe3b888f20215f3e040d21b62b603804ca9

commit r13-1186-ga0c30fe3b888f20215f3e040d21b62b603804ca9
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 21 11:40:16 2022 +0200

    ifcvt: Don't introduce trapping or faulting reads in noce_try_sign_mask
[PR106032]

    noce_try_sign_mask as documented will optimize
      if (c < 0)
        x = t;
      else
        x = 0;
    into x = (c >> bitsm1) & t;
    The optimization is done if either t is unconditional
    (e.g. for
      x = t;
      if (c >= 0)
        x = 0;
    ) or if it is cheap.  We already check that t doesn't have side-effects,
    but if t is conditional, we need to punt also if it may trap or fault,
    as we make it unconditional.

    I've briefly skimmed other noce_try* optimizations and didn't find one that
    would suffer from the same problem.

    2022-06-21  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/106032
            * ifcvt.cc (noce_try_sign_mask): Punt if !t_unconditional, and
            t may_trap_or_fault_p, even if it is cheap.

            * gcc.c-torture/execute/pr106032.c: New test.

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug rtl-optimization/106032] [10/11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:9e72a522dd9f835dd159fe3aff493eee001be0d4

commit r12-8523-g9e72a522dd9f835dd159fe3aff493eee001be0d4
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 21 11:40:16 2022 +0200

    ifcvt: Don't introduce trapping or faulting reads in noce_try_sign_mask
[PR106032]

    noce_try_sign_mask as documented will optimize
      if (c < 0)
        x = t;
      else
        x = 0;
    into x = (c >> bitsm1) & t;
    The optimization is done if either t is unconditional
    (e.g. for
      x = t;
      if (c >= 0)
        x = 0;
    ) or if it is cheap.  We already check that t doesn't have side-effects,
    but if t is conditional, we need to punt also if it may trap or fault,
    as we make it unconditional.

    I've briefly skimmed other noce_try* optimizations and didn't find one that
    would suffer from the same problem.

    2022-06-21  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/106032
            * ifcvt.cc (noce_try_sign_mask): Punt if !t_unconditional, and
            t may_trap_or_fault_p, even if it is cheap.

            * gcc.c-torture/execute/pr106032.c: New test.

    (cherry picked from commit a0c30fe3b888f20215f3e040d21b62b603804ca9)

[Bug rtl-optimization/106032] [10/11 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11/12/13 Regression]    |[10/11 Regression] wrong
                   |wrong code at -Os and above |code at -Os and above on
                   |on x86_64-linux-gnu         |x86_64-linux-gnu

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 12.2+ and 13+ so far.

[Bug rtl-optimization/106032] [10/11 Regression] wrong code at -Os and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

--- Comment #14 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:fe6e8a09a5338c0acda23ab2d3ef4433fb83637f

commit r11-10354-gfe6e8a09a5338c0acda23ab2d3ef4433fb83637f
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 21 11:40:16 2022 +0200

    ifcvt: Don't introduce trapping or faulting reads in noce_try_sign_mask
[PR106032]

    noce_try_sign_mask as documented will optimize
      if (c < 0)
        x = t;
      else
        x = 0;
    into x = (c >> bitsm1) & t;
    The optimization is done if either t is unconditional
    (e.g. for
      x = t;
      if (c >= 0)
        x = 0;
    ) or if it is cheap.  We already check that t doesn't have side-effects,
    but if t is conditional, we need to punt also if it may trap or fault,
    as we make it unconditional.

    I've briefly skimmed other noce_try* optimizations and didn't find one that
    would suffer from the same problem.

    2022-06-21  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/106032
            * ifcvt.c (noce_try_sign_mask): Punt if !t_unconditional, and
            t may_trap_or_fault_p, even if it is cheap.

            * gcc.c-torture/execute/pr106032.c: New test.

    (cherry picked from commit a0c30fe3b888f20215f3e040d21b62b603804ca9)

[Bug rtl-optimization/106032] [10 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11 Regression] wrong    |[10 Regression] wrong code
                   |code at -Os and above on    |at -Os and above on
                   |x86_64-linux-gnu            |x86_64-linux-gnu

--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 11.4+ too.

[Bug rtl-optimization/106032] [10 Regression] wrong code at -Os and above on x86_64-linux-gnu

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

--- Comment #16 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:99d9cdbd0135b97df8c5aa9cd008683c86d42dc4

commit r10-11333-g99d9cdbd0135b97df8c5aa9cd008683c86d42dc4
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 21 11:40:16 2022 +0200

    ifcvt: Don't introduce trapping or faulting reads in noce_try_sign_mask
[PR106032]

    noce_try_sign_mask as documented will optimize
      if (c < 0)
        x = t;
      else
        x = 0;
    into x = (c >> bitsm1) & t;
    The optimization is done if either t is unconditional
    (e.g. for
      x = t;
      if (c >= 0)
        x = 0;
    ) or if it is cheap.  We already check that t doesn't have side-effects,
    but if t is conditional, we need to punt also if it may trap or fault,
    as we make it unconditional.

    I've briefly skimmed other noce_try* optimizations and didn't find one that
    would suffer from the same problem.

    2022-06-21  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/106032
            * ifcvt.c (noce_try_sign_mask): Punt if !t_unconditional, and
            t may_trap_or_fault_p, even if it is cheap.

            * gcc.c-torture/execute/pr106032.c: New test.

    (cherry picked from commit a0c30fe3b888f20215f3e040d21b62b603804ca9)

[Bug rtl-optimization/106032] [10 Regression] wrong code at -Os and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106032

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #17 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 10.5 too.