From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 8411B3858C66; Tue,  7 Mar 2023 14:14:34 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8411B3858C66
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1678198474;
	bh=zZXGlQJfdixD4eSPLOopaipGPvKmDNzC/MxKa5EoRl8=;
	h=From:To:Subject:Date:From;
	b=Y0Hml1kmfuTUb2NPa09n4N3qO9fey3UifGGFTedeOWsU2fkTjcRo3HKv4hDPbCLDX
	 y9WbiejgMH1xaLoGTsuagRlq5+1uUtlXhFyfXd2ZhkddPV42KTpLD2fCZBfuBH50r8
	 Gkk5uxqK0XPjBaJC5jaAViy6Vn5oYj/ty+mS2hX0=
From: "avi at scylladb dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/109053] New: [missed optimization]
 value-range tracking fails in simple case with __builtin_unreachable
Date: Tue, 07 Mar 2023 14:14:33 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 13.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: avi at scylladb dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-109053-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D109053

            Bug ID: 109053
           Summary: [missed optimization] value-range tracking fails in
                    simple case with __builtin_unreachable
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: avi at scylladb dot com
  Target Milestone: ---

I'm trying to use __builtin_unreachable() to inject assumptions about value=
s of
variables into this code. In this case, the fact that a reference count mus=
t be
one or greater.

Consider the code:



struct refcounted {
    int* p;
    refcounted() : p(new int(1)) {}
    ~refcounted() {
        assume_stuff();
        if (!--*p) {
            delete p;
        }
    }
    refcounted(const refcounted& x) : p(x.p) {
        assume_stuff();
        ++*p;
        assume_stuff();
    }
    refcounted& operator=3D(const refcounted& x) {
        assume_stuff();
        x.assume_stuff();
        if (this !=3D &x) {
            ++*x.p;
            if (!--*p) {
                delete p;
            }
            p =3D x.p;
        }
        assume_stuff();
        x.assume_stuff();
        return *this;
    }

    void assume_stuff() const {
        if (*p <=3D 0) {
            __builtin_unreachable();
        }
    }
};

refcounted assign(refcounted& a, refcounted& b) {
    auto x =3D a;
    a =3D b;
    return x;
}


In the assign() function, although we assign to `a`, we also return it (as
`x`), so there's never a reason to call operator delete. Yet the code does.

assign(refcounted&, refcounted&):
 mov    %rdi,%rax
 mov    (%rsi),%rdi
 mov    %rdi,(%rax)
 addl   $0x1,(%rdi)

; gcc now knows that (%rdi) is 2 or greater

 cmp    %rdx,%rsi
 je     68 <assign(refcounted&, refcounted&)+0x68>
 push   %rbp
 mov    %rdx,%rbp
 push   %rbx
 mov    %rsi,%rbx
 sub    $0x18,%rsp
 mov    (%rdx),%rcx
 addl   $0x1,(%rcx)
 mov    (%rdi),%edx
 sub    $0x1,%edx

; gcc now knows that (%rdi) is 1 or greater

 je     40 <assign(refcounted&, refcounted&)+0x40>


; so how can it be zero?=20
; if gcc tracked the ranges correctly, it would have eliminated the branch =
and
made assign() a leaf function

 mov    %edx,(%rdi)
 mov    %rcx,(%rbx)
 add    $0x18,%rsp
 pop    %rbx
 pop    %rbp
 ret=20=20=20=20
 cs nopw 0x0(%rax,%rax,1)
 mov    $0x4,%esi
 mov    %rax,0x8(%rsp)
 call   4f <assign(refcounted&, refcounted&)+0x4f>
    R_X86_64_PLT32 operator delete(void*, unsigned long)-0x4
 mov    0x0(%rbp),%rcx
 mov    0x8(%rsp),%rax
 mov    %rcx,(%rbx)
 add    $0x18,%rsp
 pop    %rbx
 pop    %rbp
 ret=20=20=20=20
 nopw   0x0(%rax,%rax,1)
 ret=20=20=20=20


Also on: https://godbolt.org/z/Tnehj86hc=