[Bug tree-optimization/106073] New: wrong code at -O3 on x86_64-linux-gnu

[Bug tree-optimization/106073] New: wrong code at -O3 on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106073

            Bug ID: 106073
           Summary: wrong code at -O3 on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It seems to be a regression from 11.*. The test is still quite complicated, but
seems difficult to be reduced much further. 

[507] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-sanitizers
--enable-languages=c,c++ --disable-werror --disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.0 20220624 (experimental) [master r12-4647-g3f861a5c8fd] (GCC) 
[508] % 
[508] % gcctk -O2 small.c; ./a.out
[509] % 
[509] % gcctk -O3 small.c
[510] % ./a.out
Aborted
[511] % 
[511] % cat small.c
int a, f = 1, h, l, m = 1, o, r = 4, q, s, x, e, aa, ab, ac, *ad, ae = 5, **y,
**af, ag, ah, ai, aj;
static int c[6], d, g[6][5], n, *v = &s, ak;
volatile int p;
const volatile int al;
static volatile int t, u, w = 3, z, am, an;
static int ao();
void ap();
static void aq() {
  int ar[4] = {6, 6, 6, 6}, as[1], i, j;
  as[0] = 0;
  if (m) {
    int at[11] = {4, 4, 6, 5, 7, 0, 7, 6, 7, 6, 6}, *au, *av[7], k;
    au = (int*) &au;
    for (i = 0; i < 1; i++)
      for (j = 0; j < 1; j++)
        for (k = 0; k < 7; k++) {
          (t || n) && u;
          av[k] = 0;
        }
    y = av;
    while (o) {
      int *b[2] = {as, ar};
      *af = at;
    }
    m = 0;
  }
}
inline void ap() {
  for (; l <= 4; l++) {
    *v = 0;
    aq();
    if (a)
      break;
    for (; q; q++)
      ;
  }
}
int ao() {
  int be = 0, j;
  if (n)
    aa = d = 0;
  l = 0;
  for (; be < 2; be++) {
    int bf[7][2];
    for (ai = 0; ai < 7; ai++)
      for (j = 0; j < 2; j++)
        bf[ai][j] = 5;
    if (be) {
      for (; h >= 0; h--) {
        while (z >= w) {
          ap();
          *ad = 0;
        }
        ap();
      }
      return bf[3][0];
    }
    if (bf[3][0])
      continue;
    while (1)
      ;
  }
  return 0;
}
static void aw() {
  for (; ah; ah++) {
    p = 0;
    p = 0;
  }
  int ax = ~e;
 L1:
  e = a = 0;
 L2:
  if (!r)
    goto L3;
  if (!ax)
    goto L2;
  if (d)
    goto L1;
  if (!ae)
    goto L1;
  if (w && x <= 808 && f)
    ag = ao();
  g[0][4] = ag;
  if (a) {
    int bd;
    n++;
    while (n)
      for (bd = 0; bd < 7; bd++) {
        am;
        am;
        am;
        am;
        d = c[d ^ am];
      }
  } else {
  L3:
    an;
    for (; ak; ak++) {
      int bc = 7;
      for (; bc >= 0; bc--) {
        al;
        al;
        d = f && an;
        an;
      }
    }
  }
}
int main() {
  int k;
  for (; aj < 6; aj++)
    c[0] = aj;
  aw();
  for (aj = 0; aj < 6; aj++)
    for (k = 0; k < 5; k++)
      d = c[d ^ g[aj][k]];
  if (d != 5)
    __builtin_abort();
  return 0;
}

[Bug tree-optimization/106073] wrong code at -O3 on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106073

--- Comment #1 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Compiler Explorer: https://godbolt.org/z/o3jq85vYK

[Bug tree-optimization/106073] [12/13 Regression] wrong code at -O3 on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106073

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
           Keywords|                            |needs-bisection, wrong-code
   Last reconfirmed|                            |2022-06-24
            Summary|wrong code at -O3 on        |[12/13 Regression] wrong
                   |x86_64-linux-gnu            |code at -O3 on
                   |                            |x86_64-linux-gnu
   Target Milestone|---                         |12.2

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.
When we remove:
au = (int*) &au;
The testcase works; au is otherwise unused.
I noticed that the major different between with and without that line was a
loop was unrolled and then SLP vectorized.

I have not looked into it any further really.

[Bug tree-optimization/106073] [12/13 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106073

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
            Version|unknown                     |12.1.1

[Bug tree-optimization/106073] [12/13 Regression] wrong code at -O3 on x86_64-linux-gnu since r12-3903-g0288527f47cec669

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106073

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |marxin at gcc dot gnu.org
            Summary|[12/13 Regression] wrong    |[12/13 Regression] wrong
                   |code at -O3 on              |code at -O3 on
                   |x86_64-linux-gnu            |x86_64-linux-gnu since
                   |                            |r12-3903-g0288527f47cec669

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-3903-g0288527f47cec669.

[Bug tree-optimization/106073] [12/13 Regression] wrong code at -O3 on x86_64-linux-gnu since r12-3903-g0288527f47cec669

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106073

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=90348

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Options reduced to

-O2 -funroll-loops -fno-tree-vectorize -fdisable-tree-cunrolli
-fdbg-cnt=gimple_unroll:3-6:8-8

in particular reducing late unrolling more will no longer reproduce the issue.
Disabling all threading after cunroll still reproduces the issue, thus
adding

-fdisable-tree-thread2 -fdisable-tree-threadfull2 -fdisable-tree-vrp2
-fdisable-tree-dom3

disabling IVOPTs hides the issue.  Making all functions but main static also
still reproduces the issue (so there's just one function left for late opts).
With that simplification

-O2 -funroll-loops -fno-tree-vectorize -fdisable-tree-cunrolli
-fdbg-cnt=gimple_unroll:3-6:8-8 -fdisable-tree-thread2
-fdisable-tree-threadfull2 -fdisable-tree-dom3 -fno-tree-vrp -fdump-tree-all
-fdbg-cnt=ivopts_loop:13-13:15-15

reproduces it, less IVOPTs does not.

So one difference triggering the issue is (good vs bad in .optimized):

@@ -328,20 +326,21 @@

   <bb 19> [local count: 60532]:
   l = 0;
+  ivtmp.151_212 = (unsigned long) &bf;
+  _507 = ivtmp.151_212 + 56;

   <bb 20> [local count: 412224]:
-  # ai_lsm.108_510 = PHI <d.13_27(19), _516(21)>
-  # ivtmp_511 = PHI <8(19), ivtmp_512(21)>
-  ivtmp_512 = ivtmp_511 - 1;
-  if (ivtmp_512 != 0)
+  # ivtmp.151_254 = PHI <ivtmp.151_212(19), ivtmp.151_380(21)>
+  if (ivtmp.151_254 != _507)
     goto <bb 21>; [89.00%]
   else
     goto <bb 22>; [11.00%]

   <bb 21> [local count: 366880]:
-  bf[ai_lsm.108_510][0] = 5;
-  bf[ai_lsm.108_510][1] = 5;
-  _516 = ai_lsm.108_510 + 1;
+  _506 = (void *) ivtmp.151_254;
+  MEM[(int *)_506] = 5;
+  MEM[(int *)_506 + 4B] = 5;
+  ivtmp.151_380 = ivtmp.151_254 + 8;
   goto <bb 20>; [100.00%]

   <bb 22> [local count: 45347]:
@@ -353,8 +352,6 @@

   <bb 23> [local count: 40253]:
   bf ={v} {CLOBBER(eol)};
-  ivtmp.132_498 = (unsigned long) &bf;
-  _480 = ivtmp.132_498 + 56;
   goto <bb 25>; [100.00%]

   <bb 24> [local count: 325681]:
@@ -364,8 +361,8 @@
   ivtmp.132_245 = ivtmp.132_383 + 8;

   <bb 25> [local count: 365933]:
-  # ivtmp.132_383 = PHI <ivtmp.132_498(23), ivtmp.132_245(24)>
-  if (ivtmp.132_383 != _480)
+  # ivtmp.132_383 = PHI <ivtmp.151_212(23), ivtmp.132_245(24)>
+  if (ivtmp.151_254 != ivtmp.132_383)
     goto <bb 24>; [89.00%]
   else
     goto <bb 26>; [11.00%]

that already causes quite some assembler changes :/

It's still not clear what goes wrong here.

Interestingly again, -fstack-reuse=none avoids the issue.  So maybe the
above hints at 'bf' being the issue here:

Partition 3: size 56 align 16
        av      au      bf
Partition 5: size 56 align 16
        av
Partition 1: size 44 align 16
        at
Partition 2: size 8 align 8
        au

[Bug tree-optimization/106073] [12/13/14 Regression] wrong code at -O3 on x86_64-linux-gnu since r12-3903-g0288527f47cec669

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106073

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.