[Bug c/107212] New: -O2 and -O3 optimizer bug

[Bug c/107212] New: -O2 and -O3 optimizer bug

[aosman9xx9 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

            Bug ID: 107212
           Summary: -O2 and -O3 optimizer bug
           Product: gcc
           Version: 12.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: aosman9xx9 at gmail dot com
  Target Milestone: ---

There seams to be an optimizer bug in the recent gcc version.

=================================

[root@archlinux ~]# gcc --version
gcc (GCC) 12.2.0
(the current gcc version in Archlinux)

[root@archlinux ~]# cat GccError.c
#include <stdio.h>

int main() {
    unsigned int tab[6][2] = { {69, 73}, {36, 40}, {24, 16}, {16, 11}, {4, 5},
{3, 1} };

    int flag = 1;
    int sum_0 = 0;
    int sum_1 = 0;

    for(int t=0; t<6; t++) {
        sum_0 += tab[t][0];
        sum_1 += tab[t][1];
    }

    int x1 = (sum_0 < 100);
    int x2 = (sum_0 > 200);
    int x3 = (x1 || x2);

    if(sum_1 > 200) {
        flag=0;
    }

    printf("sum_0: %d\n", sum_0);
    printf("sum_1: %d\n", sum_1);
    printf("x1: %d\n", x1);
    printf("x2: %d\n", x2);
    printf("x1 || x2: %d\n", x3);
    printf("flag: %d\n", flag);

    return 0;
}

[root@archlinux ~]# gcc -O2 -Wall -Wextra -o GccError GccError.c

[root@archlinux ~]# ./GccError
sum_0: 152
sum_1: 146
x1: 0
x2: 0
x1 || x2: 1
flag: 1

=================================
The expected result of (x1 || x2) is 0, because x1 and x2 is 0. But the result
is 1. This only happens with -O2 or -O3 optimization.

[Bug tree-optimization/107212] [11/12/13 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
            Summary|-O2 and -O3 optimizer bug   |[11/12/13 Regression] Wrong
                   |                            |vectorizer code since
                   |                            |r11-718-gc735929a2503a7d0
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
          Component|c                           |tree-optimization
   Target Milestone|---                         |11.5
           Keywords|                            |wrong-code
   Last reconfirmed|                            |2022-10-11

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
A bit reduced test-case:

$ cat pr107212.c
int main() {
    unsigned int tab[6][2] = { {69, 73}, {36, 40}, {24, 16}, {16, 11}, {4, 5},
{3, 1} };

    int flag = 1;
    int sum_0 = 0;
    int sum_1 = 0;

    for(int t=0; t<6; t++) {
        sum_0 += tab[t][0];
        sum_1 += tab[t][1];
    }

    int x1 = (sum_0 < 100);
    int x2 = (sum_0 > 200);
    int x3 = (x1 || x2);

    if(sum_1 > 200) {
        flag=0;
    }

    __builtin_printf("sum_1: %d\n", sum_1);
    if (x1 || x2)
      __builtin_abort ();

    return 0;
}

With -O3 it started with r11-718-gc735929a2503a7d0.

[Bug tree-optimization/107212] [11/12/13 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  We vectorize the loop and that triggers full constant folding
leading to the wrong result somehow.

Same issue with GCC 11 when you add -ftree-vectorize or use -O3, not observed
with GCC 10.

The reduction epilogue of the SLP reduction looks duplicate wrong.

[Bug tree-optimization/107212] [11/12/13 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug tree-optimization/107212] [11/12/13 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Hmm, have a test-case that is miscompiled since r10-4200-gb7ff7cef5005721e:

$ cat pr107212.c
int sum_1 = 0;

int main() {
  unsigned int tab[6][2] = {{150, 0}, {0, 0}, {0, 0}, {0, 0}, {0, 0}, {0, 0}};

  int sum_0 = 0;

  for (int t = 0; t < 6; t++) {
    sum_0 += tab[t][0];
    sum_1 += tab[t][0];
  }

  if (sum_0 < 100 || sum_0 > 200)
    __builtin_abort();
  return 0;
}

$ gcc pr107212.c -O3 -std=c99 && ./a.out
Aborted (core dumped)

[Bug tree-optimization/107212] [11/12/13 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
So the speciality here is that with the SLP reduction we have the live lanes
split across the sum and the convert.  That wrecks havoc with
vectorizable_reduction following one of the lanes in the loop assigning
STMT_VINFO_REDUC_DEF to the reduction chain.  We simply do

      /* ???  For epilogue generation live members of the chain need
         to point back to the PHI via their original stmt for
         info_for_reduction to work.  */
      if (STMT_VINFO_LIVE_P (vdef))
        STMT_VINFO_REDUC_DEF (def) = phi_info;

but in this case this misses one of the paths.  Also we're not reliably
following the representative here.  Plus vectorizable_live_operation
doesn't get the representative but the actual scalar stmt defining the
live lane (on purpose).  So the fix is to make sure the above setting
of STMT_VINFO_REDUC_DEF covers all live lanes of the SLP node.  For
vectorizable_live_operation the

          else
            /* For SLP reductions the meta-info is attached to
               the representative.  */
            stmt_info = SLP_TREE_REPRESENTATIVE (slp_node);

doing is then wrong and

          /* For SLP reductions we vectorize the epilogue for
             all involved stmts together.  */
          else if (slp_index != 0)
            return true;

is also suspicious then but it seems we cope with the conversions just
fine.  So we're actually vectorizing the epilogue for the live lane 0
in the reduction chain but analysis might end up not following the lane 0
SSA use-def chain and identifying lane > 0 reductions is just to avoid
non-reduction live code gen.

[Bug tree-optimization/107212] [11/12/13 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Yes, the issue is latent for longer I think.

[Bug tree-optimization/107212] [11/12/13 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ee467644c53ee2f7d633a8e1f53603feafab4351

commit r13-3226-gee467644c53ee2f7d633a8e1f53603feafab4351
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Oct 11 11:34:55 2022 +0200

    tree-optimization/107212 - SLP reduction of reduction paths

    The following fixes an issue with how we handle epilogue generation
    for SLP reductions of reduction paths where the actual live lanes
    are not "canonical".  We need to make sure to identify all live
    lanes as reductions and thus have to iterate over all participating
    SLP lanes when walking the reduction SSA use-def chain.  Also the
    previous attempt likely to mitigate such issue in
    vectorizable_live_operation is misguided and has to be removed.

            PR tree-optimization/107212
            * tree-vect-loop.cc (vectorizable_reduction): Make sure to
            set STMT_VINFO_REDUC_DEF for all live lanes in a SLP
            reduction.
            (vectorizable_live_operation): Do not pun to the SLP
            node representative for reduction epilogue generation.

            * gcc.dg/vect/pr107212-1.c: New testcase.
            * gcc.dg/vect/pr107212-2.c: Likewise.

[Bug tree-optimization/107212] [11/12 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
      Known to work|                            |13.0
            Summary|[11/12/13 Regression] Wrong |[11/12 Regression] Wrong
                   |vectorizer code since       |vectorizer code since
                   |r11-718-gc735929a2503a7d0   |r11-718-gc735929a2503a7d0

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar, many thanks for the report and the nice testcase.

[Bug tree-optimization/107212] [11/12 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:d127348d7711e148e5ddd205a8c3409b37fae64c

commit r12-8840-gd127348d7711e148e5ddd205a8c3409b37fae64c
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Oct 11 11:34:55 2022 +0200

    tree-optimization/107212 - SLP reduction of reduction paths

    The following fixes an issue with how we handle epilogue generation
    for SLP reductions of reduction paths where the actual live lanes
    are not "canonical".  We need to make sure to identify all live
    lanes as reductions and thus have to iterate over all participating
    SLP lanes when walking the reduction SSA use-def chain.  Also the
    previous attempt likely to mitigate such issue in
    vectorizable_live_operation is misguided and has to be removed.

            PR tree-optimization/107212
            * tree-vect-loop.cc (vectorizable_reduction): Make sure to
            set STMT_VINFO_REDUC_DEF for all live lanes in a SLP
            reduction.
            (vectorizable_live_operation): Do not pun to the SLP
            node representative for reduction epilogue generation.

            * gcc.dg/vect/pr107212-1.c: New testcase.
            * gcc.dg/vect/pr107212-2.c: Likewise.

    (cherry picked from commit ee467644c53ee2f7d633a8e1f53603feafab4351)

[Bug tree-optimization/107212] [11 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:2461fa40fc24a403dc8149338f44b0e4aef4f173

commit r11-10480-g2461fa40fc24a403dc8149338f44b0e4aef4f173
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Oct 11 11:34:55 2022 +0200

    tree-optimization/107212 - SLP reduction of reduction paths

    The following fixes an issue with how we handle epilogue generation
    for SLP reductions of reduction paths where the actual live lanes
    are not "canonical".  We need to make sure to identify all live
    lanes as reductions and thus have to iterate over all participating
    SLP lanes when walking the reduction SSA use-def chain.  Also the
    previous attempt likely to mitigate such issue in
    vectorizable_live_operation is misguided and has to be removed.

            PR tree-optimization/107212
            * tree-vect-loop.c (vectorizable_reduction): Make sure to
            set STMT_VINFO_REDUC_DEF for all live lanes in a SLP
            reduction.
            (vectorizable_live_operation): Do not pun to the SLP
            node representative for reduction epilogue generation.

            * gcc.dg/vect/pr107212-1.c: New testcase.
            * gcc.dg/vect/pr107212-2.c: Likewise.

    (cherry picked from commit ee467644c53ee2f7d633a8e1f53603feafab4351)

[Bug tree-optimization/107212] [11 Regression] Wrong vectorizer code since r11-718-gc735929a2503a7d0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107212

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|11.5                        |11.4
      Known to work|                            |11.3.1
      Known to fail|                            |11.3.0

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.