[Bug tree-optimization/106171] New: wrong code at -O1 and above on x86_64-linux-gnu

[Bug tree-optimization/106171] New: wrong code at -O1 and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

            Bug ID: 106171
           Summary: wrong code at -O1 and above on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It appears to be quite long-latent, and affects all versions 7.* and later. 

[560] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-sanitizers
--enable-languages=c,c++ --disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.0 20220703 (experimental) [master r13-1411-ga26f3eb2683] (GCC) 
[561] % 
[561] % gcctk -O0 small.c; ./a.out
1
[562] % gcctk -O1 small.c; ./a.out
0
[563] % gcctk -Os small.c; ./a.out
-2089837456
[564] % gcctk -O2 small.c; ./a.out
0
[565] % gcctk -O3 small.c; ./a.out
0
[566] % 
[566] % cat small.c
int printf(const char *, ...);
int a, b;
int c() {
  int d = 0;
  for (; d < 2; d++) {
    int e[2];
    for (; b < 2; b++)
      e[b] = 1;
    if (d)
      return e[0];
  }
  return 0;
}
int main() {
  a = c();
  printf("%d\n", a);
  return 0;
}

[Bug tree-optimization/106171] wrong code at -O1 and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

--- Comment #1 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Compiler Explorer: https://godbolt.org/z/eEhKn8x9T

[Bug tree-optimization/106171] wrong code at -O1 and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Isn't that UB?  Both e[0] and e[1] initialized in the first loop when d == 0,
but not used there, then e goes out of scope, in the d == 1 iteration e is
uninitialized, nothing initializes it and e[0] is returned.

[Bug tree-optimization/106171] wrong code at -O1 and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

--- Comment #3 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Yes, you're right, Jakub.

Then, it's a false negative for the sanitizers.

[Bug tree-optimization/106171] wrong code at -O1 and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
We don't have uninitialized memory sanitizer.
-fsanitize-address-use-after-scope doesn't trigger because it is use in scope,
just not initialized there.

[Bug tree-optimization/106171] wrong code at -O1 and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
And -O1 -Wall warns:
pr106171.c: In function ‘c’:
pr106171.c:10:15: warning: ‘e[0]’ is used uninitialized [-Wuninitialized]
   10 |       return e[0];
      |              ~^~~
pr106171.c:6:9: note: ‘e’ declared here
    6 |     int e[2];
      |         ^

[Bug tree-optimization/106171] wrong code at -O1 and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

Zhendong Su <zhendong.su at inf dot ethz.ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #6 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
The test has UB.

[Bug tree-optimization/106171] wrong code at -O1 and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106171

--- Comment #7 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
(In reply to Jakub Jelinek from comment #5)
> And -O1 -Wall warns:
> pr106171.c: In function ‘c’:
> pr106171.c:10:15: warning: ‘e[0]’ is used uninitialized [-Wuninitialized]
>    10 |       return e[0];
>       |              ~^~~
> pr106171.c:6:9: note: ‘e’ declared here
>     6 |     int e[2];
>       |         ^

Ah, this is quite clever of GCC :)
Clang fails to detect and warn about it.
CompCert lifts "int e[2]" to the same scope as "int d", thus also misses the
UB.