From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id E0C823858C30; Thu,  2 Feb 2023 09:58:22 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E0C823858C30
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1675331902;
	bh=y8SjNb9Zd+SwYk4C4KTUlR2QDwLXKyD43J+LxbMPl5A=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=aq/J686XumT5JTE2Tug13tX5r/ekRLUPTLnV5dH5tV1Ol7c/WWylUd+aJg9FG7/g+
	 jbEMbqaD8biZU2FLlR09R7bUqyQrePqStmnz+SnKC6fjN8s0fmG6s0P7YOwJm5gN9Z
	 mgoDRGlnv3Hx9ZHJxCWy1gOWPFyfZ8MtfSJTf/eE=
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/108625] [11/12/13 Regression] forwprop
 introduces new UB
Date: Thu, 02 Feb 2023 09:58:22 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 13.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: rguenth at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 11.4
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_status assigned_to
Message-ID: <bug-108625-4-AV7bOOd2xG@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-108625-4@http.gcc.gnu.org/bugzilla/>
References: <bug-108625-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108625

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot =
gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
we come from

  t_2 =3D -x_1(D);
  t1_3 =3D (unsigned char) t_2;
  t2_4 =3D (unsigned char) t_2;
  _5 =3D t1_3 + t2_4;

where

  t_2 + t_2

"simplifies", but somehow the ! constraint isn't honored.  We do

                res_op->set_op (NOP_EXPR, type, 1);
                {
                  tree _o1[2], _r1;
                  _o1[0] =3D captures[0];
                  _o1[1] =3D captures[1];
                  gimple_match_op tem_op (res_op->cond.any_else (), op,
TREE_TYPE (_o1[0]), _o1[0], _o1[1]);=20
                  tem_op.resimplify (lseq, valueize);
                  _r1 =3D maybe_push_res_to_seq (&tem_op, NULL);
                  if (!_r1) goto next_after_fail1082;
                  res_op->ops[0] =3D _r1;

so the intent is that the maybe_push_res_to_seq (..., NULL) will catch
not simplified operands of the (convert).

The issue is that we go through

 /* A + (-B) -> A - B */
 (simplify
  (plus:c @0 (convert? (negate @1)))=20
  /* Apply STRIP_NOPS on the negate.  */
  (if (tree_nop_conversion_p (type, TREE_TYPE (@1))
       && !TYPE_OVERFLOW_SANITIZED (type))
   (with
    {
     tree t1 =3D type;
     if (INTEGRAL_TYPE_P (type)
         && TYPE_OVERFLOW_WRAPS (type) !=3D TYPE_OVERFLOW_WRAPS (TREE_TYPE =
(@1)))
       t1 =3D TYPE_OVERFLOW_WRAPS (type) ? type : TREE_TYPE (@1);
    }=20=20
    (convert (minus (convert:t1 @0) (convert:t1 @1))))))

and

/* Basic strip-useless-type-conversions / strip_nops.  */
(for cvt (convert view_convert float fix_trunc)
 (simplify
  (cvt @0)
  (if ((GIMPLE && useless_type_conversion_p (type, TREE_TYPE (@0)))
       || (GENERIC && type =3D=3D TREE_TYPE (@0)))
   @0)))

which defeats the check because the

                  tem_op.resimplify (lseq, valueize);

ends up with

  _7 =3D t_2 - x_1(D);

in the 'lseq' and plain _7 in tem_op.  We could fix this by using a
NULL lseq in the resimplification as well at the expense of not
catching some more complicated simplifications to "leafs" or
alternatively do a more complicated check for the force_leaf case,
checking the actual leaf and if SSA name, verify the definition is
not in 'lseq'.

I'm going to test the simpler NULL lseq to resimplify variant.=