[Bug tree-optimization/108164] New: wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu

[Bug tree-optimization/108164] New: wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

            Bug ID: 108164
           Summary: wrong code with "-O3 -fno-tree-dce" on
                    x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It appears to be a regression from 11.*, and affects 12.* and the trunk.

Compiler Explorer: https://godbolt.org/z/Ko61s9WP4


[580] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
--with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.0 20221218 (experimental) [master r13-4763-g92bc3617572] (GCC) 
[581] % 
[581] % gcctk -O3 small.c; ./a.out
[582] % 
[582] % gcctk -O3 -fno-tree-dce small.c
[583] % ./a.out
Floating point exception
[584] % 
[584] % cat small.c
int a, b, c;
int main() {
  int e = -1;
  short f = -1;
  for (; c < 1; c++)
    while (f >= e)
      f++;
  for (; a < 2; a++) {
    short g = ~(~b | ~f);
    int h = -g;
    int i = (3 / ~h) / ~b;
    b = i;
  }
  return 0;
}

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
            Summary|wrong code with "-O3        |[12/13 Regression] wrong
                   |-fno-tree-dce" on           |code with "-O3
                   |x86_64-linux-gnu            |-fno-tree-dce" on
                   |                            |x86_64-linux-gnu
   Target Milestone|---                         |12.3

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-12-18
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |12.1.0
           Keywords|                            |needs-bisection
      Known to work|                            |11.3.0

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Seems vectorizer related ...

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |13.0

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Hmm, I don't see how exactly.

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] wrong    |[12/13 Regression] wrong
                   |code with "-O3              |code with "-O3
                   |-fno-tree-dce" on           |-fno-tree-dce" on
                   |x86_64-linux-gnu            |x86_64-linux-gnu since
                   |                            |r12-5267-g540d92ae9b629eb4
           Keywords|needs-bisection             |
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |marxin at gcc dot gnu.org

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-5267-g540d92ae9b629eb4.

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.  Disabling

t.c:6:14: optimized: loop with 6 iterations completely unrolled (header
execution count 46365075)

fixes the testcase.

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
We vectorize

  <bb 3> [local count: 955630225]:
  # f_33 = PHI <f_27(16), f_36(13)>
  f.1_1 = (unsigned short) f_33;
  _2 = f.1_1 + 1;
  f_27 = (short int) _2;
  if (f_27 >= -1) 
    goto <bb 16>; [89.00%]
  else
    goto <bb 18>; [11.00%]

  <bb 16> [local count: 850510901]:
  goto <bb 3>; [100.00%]

  <bb 18> [local count: 105119324]:
  # f_94 = PHI <f_27(3)>

as

  _70 = (unsigned short) f_36;
  _69 = _70 + 1;
  _68 = _70 + 2;
  _67 = _70 + 3;
  _66 = _70 + 4;
  _65 = _70 + 5;
  _64 = _70 + 6;
  _63 = _70 + 7;
  _62 = {_70, _69, _68, _67, _66, _65, _64, _63};
  _61 = (vector(8) short int) _62;

  <bb 3> [local count: 567644343]:
  # f_33 = PHI <f_27(16), f_36(23)>
  # vect_vec_iv_.21_59 = PHI <_56(16), _61(23)>
  # ivtmp_49 = PHI <ivtmp_48(16), 0(23)>
  _58 = (vector(8) unsigned short) vect_vec_iv_.21_59;
  _57 = _58 + { 8, 8, 8, 8, 8, 8, 8, 8 };
  _56 = (vector(8) short int) _57;
  vect_f.22_55 = VIEW_CONVERT_EXPR<vector(8) unsigned
short>(vect_vec_iv_.21_59); 
  f.1_1 = (unsigned short) f_33; 
  vect__2.23_53 = vect_f.22_55 + { 1, 1, 1, 1, 1, 1, 1, 1 };
  _2 = f.1_1 + 1; 
  vect_f_27.24_52 = VIEW_CONVERT_EXPR<vector(8) short int>(vect__2.23_53);
  f_27 = (short int) _2;
  ivtmp_48 = ivtmp_49 + 1;
  if (ivtmp_48 < bnd.18_75)
    goto <bb 16>; [83.33%]
  else
    goto <bb 25>; [16.67%]

  <bb 16> [local count: 473036953]:
  goto <bb 3>; [100.00%]

  <bb 25> [local count: 94607391]:
  # vect_f_27.24_51 = PHI <vect_f_27.24_52(3)>
  _50 = BIT_FIELD_REF <vect_f_27.24_51, 16, 112>;

that looks wrong.

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Hmm, it's correct.

short __attribute__((noipa))
foo(short f)
{
  while (f >= -1)
    f++;
  return f;
}

int main ()
{
  if (foo (-1) != -32768)
    __builtin_abort ();
  return 0;
}

shows exactly the same vectorization (-O3 -fno-vect-cost-model --param
vect-epilogues-nomask=0).

With the testcase in the description thread2 performs some threading which
isn't performed on this testcase though and that's a trigger.

-fdbg-cnt=registered_jump_thread:3-4 triggers it (3-3 and 4-4 is broken as
well).

The difference between -fdbg-cnt=registered_jump_thread:3-3 (borken) and
-fdisable-tree-thread2 (OK) is

--- a/a-t.c.254t.optimized      2022-12-19 13:43:00.654410480 +0100
+++ b/a-t.c.254t.optimized      2022-12-19 13:43:08.818523519 +0100
@@ -125,7 +125,7 @@

   <bb 4> [local count: 118111600]:
   # RANGE [irange] short int [-INF, -2]
-  # f_34 = PHI <-32768(3), f_36(5)>
+  # f_34 = PHI <-32767(3), f_36(5)>
   # RANGE [irange] int [-2147483647, 1]
   _4 = c.3_31 + 1;
   if (_4 != 1)

this difference appears at a-t.c.196t.dom3 which follows thread2.  We enter
dom3 with

  <bb 15> [local count: 105119324]:
  # f_71 = PHI <f_87(14), _50(6), f_26(8), f_40(9), f_6(10), f_46(11),
f_104(12), f_108(13)> 

  <bb 16> [local count: 118111600]:
  # RANGE [irange] short int [-INF, -2]
  # f_34 = PHI <f_71(15), f_36(17)>

and the dom3 dump has things like

Optimizing block #9

LKUP STMT f.1_96 = PHI <f.1_60, 32767>
2>>> STMT f.1_96 = PHI <f.1_60, 32767> 
<<<< STMT f.1_96 = PHI <f.1_60, 32767>
Optimizing statement _9 = f.1_96 + 2;
  Replaced 'f.1_96' with constant '32767'
gimple_simplified to _9 = 32769;
  Folded to: _9 = 32769;
_9 : global value re-evaluated to [irange] UNDEFINED
LKUP STMT _9 = 32769
==== ASGN _9 = 32769
Optimizing statement f_40 = (short int) _9;
  Replaced '_9' with constant '32769'
gimple_simplified to f_40 = -32767;
  Folded to: f_40 = -32767;
f_40 : global value re-evaluated to [irange] UNDEFINED
LKUP STMT f_40 = -32767

Something goes wrong here.  For example for

  _9 = 32769;

we have [irange] unsigned short [1, 32768] as global range and
gimple_ranger::update_stmt will update that to UNDEFINED


That bogus value comes from cprop_into_successor_phis where we have
a SSA_NAME_VALUE of -32767 recorded for f_71.  The only place I see is

0>>> COPY f_71 = -32767
0>>> COPY f_34 = -32767
LKUP STMT _4 = c.3_31 plus_expr 1
LKUP STMT _4 ne_expr 1
 Registering killing_def (path_oracle) _4
 Registering value_relation (path_oracle) (_4 > c.3_31) (root: bb9)
<<<< COPY f_34 = -32767
<<<< COPY f_71 = -32767

but as you can see we revert that again.

The value pops in again from record_equivalences_from_phis when visiting BB 15
via

      /* If we managed to iterate through each PHI alternative without
         breaking out of the loop, then we have a PHI which may create
         a useful equivalence.  We do not need to record unwind data for
         this, since this is a true assignment and not an equivalence
         inferred from a comparison.  All uses of this ssa name are dominated
         by this assignment, so unwinding just costs time and space.  */
      if (i == gimple_phi_num_args (phi))
        {
          if (may_propagate_copy (lhs, rhs)) 
            set_ssa_name_value (lhs, rhs);

because just one edge is marked EDGE_EXECUTABLE (9 -> 15).  That means
the value computed in BB9 is wrong.  That's exactly that with the
UNDEFINED global range result.

I _think_ what may go wrong is that we emit

  <bb 6> [local count: 94607391]:
  _50 = BIT_FIELD_REF <vect_f_27.24_52, 16, 112>;
  niters_vector_mult_vf.19_74 = bnd.18_75 << 3;
  _72 = (short int) niters_vector_mult_vf.19_74;
  tmp.20_73 = f_36 + _72;
  if (niters_vector_mult_vf.19_74 == niters.17_100)
    goto <bb 15>; [12.50%]
  else
    goto <bb 7>; [87.50%]

  <bb 7> [local count: 82781467]:
  # f_92 = PHI <tmp.20_73(6)>
  # RANGE [irange] unsigned short [0, 32767][+INF, +INF]
  f.1_98 = (unsigned short) f_92;

see how we replace the final value with something computed in signed
arithmetic.  This is also visible in my shorter testcase.

I have a patch.

[Bug tree-optimization/108164] [12/13 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ec459469f8a75d96a9b26694554efcc900d411de

commit r13-4794-gec459469f8a75d96a9b26694554efcc900d411de
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Dec 19 14:55:45 2022 +0100

    tree-optimization/108164 - undefined overflow with IV vectorization

    vect_update_ivs_after_vectorizer can end up emitting a signed
    IV update when the loop body performed an unsigned computation.
    The following makes sure to perform that update in the type
    of the loop update type to avoid undefined behavior on overflow.

            PR tree-optimization/108164
            * tree-vect-loop-manip.cc (vect_update_ivs_after_vectorizer):
            Perform vect_step_op_add update in the appropriate type.

            * gcc.dg/pr108164.c: New testcase.

[Bug tree-optimization/108164] [12 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |13.0
            Summary|[12/13 Regression] wrong    |[12 Regression] wrong code
                   |code with "-O3              |with "-O3 -fno-tree-dce" on
                   |-fno-tree-dce" on           |x86_64-linux-gnu since
                   |x86_64-linux-gnu since      |r12-5267-g540d92ae9b629eb4
                   |r12-5267-g540d92ae9b629eb4  |
           Priority|P3                          |P2

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/108164] [12 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:50ef4fc8c848929ee79af97ac445a45baab7d575

commit r12-9065-g50ef4fc8c848929ee79af97ac445a45baab7d575
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Dec 19 14:55:45 2022 +0100

    tree-optimization/108164 - undefined overflow with IV vectorization

    vect_update_ivs_after_vectorizer can end up emitting a signed
    IV update when the loop body performed an unsigned computation.
    The following makes sure to perform that update in the type
    of the loop update type to avoid undefined behavior on overflow.

            PR tree-optimization/108164
            * tree-vect-loop-manip.cc (vect_update_ivs_after_vectorizer):
            Perform vect_step_op_add update in the appropriate type.

            * gcc.dg/pr108164.c: New testcase.

    (cherry picked from commit ec459469f8a75d96a9b26694554efcc900d411de)

[Bug tree-optimization/108164] [12 Regression] wrong code with "-O3 -fno-tree-dce" on x86_64-linux-gnu since r12-5267-g540d92ae9b629eb4

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108164

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |12.2.0
             Status|ASSIGNED                    |RESOLVED
      Known to work|                            |12.2.1
         Resolution|---                         |FIXED

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.