[Bug tree-optimization/109138] New: wrong code at -O1 and above on x86_64-linux-gnu

[Bug tree-optimization/109138] New: wrong code at -O1 and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109138

            Bug ID: 109138
           Summary: wrong code at -O1 and above on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

This appears to be long latent, affecting at least 5.* and later. 

Compiler Explorer: https://godbolt.org/z/9rb354E51

[592] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/13.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
--with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 13.0.1 20230315 (experimental) [master r13-6679-gfd42a8fa4b7] (GCC) 
[593] % 
[593] % gcctk -O0 small.c; ./a.out
[594] % 
[594] % gcctk -O1 small.c
[595] % timeout -s 9 5 ./a.out
Killed
[596] % 
[596] % cat small.c
unsigned a = -1;
int main() {
  int b = 0;
  for (; b < 2; b++) {
  L:;
    int d;
    while (a <= 0)
      if (*&d)
        break;
    d = 1;
    a++;
  }
  return 0;
}

[Bug tree-optimization/109138] wrong code at -O1 and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109138

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
   Last reconfirmed|                            |2023-03-15
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
reassoc1 introduces the unconditional use of an unitialized variable.

From:
  <bb 3> [local count: 1014686025]:
  if (d_5(D) != 0)
    goto <bb 5>; [5.50%]
  else
    goto <bb 4>; [94.50%]

  <bb 4> [local count: 1073741824]:
  a.1_1 = a;
  if (a.1_1 == 0)
    goto <bb 3>; [94.50%]
  else
    goto <bb 5>; [5.50%]

To:

  a.1_1 = a;
  _12 = (unsigned int) d_5(D);
  _4 = _12 | a.1_1;
  _3 = _4 == 0;
  if (_3 != 0)
    goto <bb 3>; [94.50%]
  else
    goto <bb 4>; [5.50%]

[Bug tree-optimization/109138] wrong code at -O1 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109138

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |13.0

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
So similar to PR107833, the solution might be similar as well.

[Bug tree-optimization/109138] wrong code at -O1 and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109138

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=68083

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #2)
> So similar to PR107833, the solution might be similar as well.

Actually it is closer related to PR 68083 .

[Bug tree-optimization/109138] [10/11/12/13 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109138

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
                 CC|                            |jakub at gcc dot gnu.org
   Target Milestone|---                         |10.5
            Summary|wrong code at -O1 and above |[10/11/12/13 Regression]
                   |on x86_64-linux-gnu         |wrong code at -O1 and above
                   |                            |on x86_64-linux-gnu

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r5-4606-g956623c1378de3c48e77b

[Bug tree-optimization/109138] [10/11/12/13 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109138

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I don't think this has anything to do with reassoc though.
The testcase looks incorrect to me.
Because d is defined in the scope of the outer loop's body, for b == 0 a is -1U
and
so the inner loop does nothing, d is set to 1, a is set to 0 and then d goes
out of scope.
Then for b = 1, a scope with d variable is entered but the variable is again
uninitialized, a <= 0 is true, and we use the uninitialized variable.
fixup_cfg1 dump shows this nicely with the clobber in there:

  <bb 2> :
  b = 0;
  goto <bb 6>; [INV]

  <bb 3> :
  d.0_1 = d;
  if (d.0_1 != 0)
    goto <bb 5>; [INV]
  else
    goto <bb 4>; [INV]

  <bb 4> :
L:
  a.1_2 = a;
  if (a.1_2 == 0)
    goto <bb 3>; [INV]
  else
    goto <bb 5>; [INV]

  <bb 5> :
  d = 1;
  a.2_3 = a;
  _4 = a.2_3 + 1;
  a = _4;
  d = {CLOBBER(eol)};
  b = b + 1;

  <bb 6> :
  if (b <= 1)
    goto <bb 4>; [INV]
  else
    goto <bb 7>; [INV]

  <bb 7> :
  D.2753 = 0;
  return D.2753;

[Bug tree-optimization/109138] [10/11/12/13 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109138

--- Comment #6 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Oh, good catch, Jakub! And sorry for the noise.