[Bug c/109318] New: csmith: -fipa-cp seems to cause trouble

[Bug c/109318] New: csmith: -fipa-cp seems to cause trouble

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

            Bug ID: 109318
           Summary: csmith: -fipa-cp seems to cause trouble
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

Created attachment 54779
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54779&action=edit
C source code

The attached C code, produced by csmith, does this:

$ ../results/bin/gcc -w -O1 bug903.c
$ ./a.out
checksum = FC4F321
$ ../results/bin/gcc -w -O1 -fipa-cp bug903.c
$ ./a.out
Segmentation fault (core dumped)
$ ./a.out 1
Segmentation fault (core dumped)
$ 

The bug seems to have existed since before 20220403.

[Bug tree-optimization/109318] csmith: -fipa-cp seems to cause trouble

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #1 from David Binderman <dcb314 at hotmail dot com> ---
In gdb:

gdb) r 1
Starting program: /home/dcb36/csmith/a.out 1
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x0000000000401630 in func_14 (p_15=-3035) at runData/keep/in.46087.c:217
217         (*l_1508) = func_16(l_22[0][6],
(safe_add_func_uint64_t_u_u((~((safe_div_func_uint64_t_u_u(func_28(&g_7,
g_12.f0, func_32(l_34[0][1])), ((l_1506[6] != (+(p_15 || l_1506[6]))) ||
p_15))) < 0xCFA7L)), p_15)), l_1508, l_1509, p_15);
Missing separate debuginfos, use: dnf debuginfo-install
glibc-2.35-20.fc36.x86_64
(gdb) bt
#0  0x0000000000401630 in func_14 (p_15=-3035) at runData/keep/in.46087.c:217
#1  func_1 () at runData/keep/in.46087.c:177
#2  main (argc=<optimized out>, argv=<optimized out>)
    at runData/keep/in.46087.c:764
(gdb)

[Bug tree-optimization/109318] csmith: -fipa-cp seems to cause trouble

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #2 from David Binderman <dcb314 at hotmail dot com> ---
Program seems fine with gcc-11-20210404, but goes wrong with gcc-12-20220403.

$ ~/gcc/results.20210404/bin/gcc -w -O1 -fipa-cp bug903.c
$ ./a.out
checksum = FC4F321
$ ~/gcc/results.20220403/bin/gcc -w -O1 -fipa-cp bug903.c
$ ./a.out
Segmentation fault (core dumped)
$ 

Git hashes are g:c3d3bb0f03dbd025 and
g:0364465e3708249ece810ca5d65164552595538c

[Bug tree-optimization/109318] csmith: -fipa-cp seems to cause trouble

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #3 from David Binderman <dcb314 at hotmail dot com> ---
Seems broken with gcc-12-20211003.

Git hashes seem to be g:c3d3bb0f03dbd025 and g:d91056851c5c60f2

[Bug tree-optimization/109318] csmith: -fipa-cp seems to cause trouble

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection,
                   |                            |needs-reduction

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
Seems to break sometime between 20210704, with git hash d07092a61d5a6907
and 20211003, with git hash d91056851c5c60f2.

[Bug ipa/109318] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|csmith: -fipa-cp seems to   |csmith: -fipa-cp seems to
                   |cause trouble               |cause trouble since
                   |                            |r12-2523-g13586172d0b70c
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-03-29
           Keywords|needs-bisection             |

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-2523-g13586172d0b70c.

[Bug ipa/109318] [12/13 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Target Milestone|---                         |12.3
           Keywords|needs-reduction             |
            Summary|csmith: -fipa-cp seems to   |[12/13 Regression] csmith:
                   |cause trouble since         |-fipa-cp seems to cause
                   |r12-2523-g13586172d0b70c    |trouble since
                   |                            |r12-2523-g13586172d0b70c

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
Reduced test-case:

$ cat pr109318.c
#pragma pack(1)
struct S {
  signed : 31;
  unsigned f4 : 20;
};

int tmp, g;
static struct S global;

static struct S func_16(struct S *ptr) {
  for (; g > 0; g+= 8)
    tmp &= 8;
  return *ptr;
}

int
main()
{
  struct S *local = &global;
  *local = func_16(local);

  return 0;
}

$ gcc pr109318.c -O2 && ./a.out
Segmentation fault (core dumped)

[Bug ipa/109318] [12/13 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P1                          |P2
      Known to fail|                            |12.1.0, 12.2.0

[Bug ipa/109318] [12/13 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
With -O2 -fno-early-inlining it can be simplified:

#pragma pack(1)
struct S {
  signed : 31;
  unsigned f4 : 20;
};

static struct S global;

static struct S func_16(struct S *ptr) { return *ptr; }

int
main()
{
  struct S *local = &global;
  *local = func_16(local);
  return 0;
}

assembly:

main:
.LFB1:
        .cfi_startproc
        movl    global(%rip), %eax
        movl    %eax, -7(%rsp)
        movl    global+3(%rip), %eax
        movl    %eax, -4(%rsp)
        movl    -7(%rsp), %edx
        movl    %edx, -14(%rsp)
        movl    %eax, -11(%rsp)
        movl    -14(%rsp), %eax
        movl    %eax, global(%rip)  <--- this faults, global was promoted R/O
        xorl    %eax, %eax
        ret

note the #pragma pack is required to avoid optimizing everything away.

[Bug ipa/109318] [12/13 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Mine

[Bug ipa/109318] [12/13 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #9 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Most likely a duplicate of PR 107769.

[Bug ipa/109318] [12/13 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #10 from Martin Jambor <jamborm at gcc dot gnu.org> ---
The problem is actually slightly different, I have just attached a possible fix
to both to PR 107769.

[Bug ipa/109318] [12/13 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:8e08c7886eed5824bebd0e011526ec302d622844

commit r13-7206-g8e08c7886eed5824bebd0e011526ec302d622844
Author: Martin Jambor <mjambor@suse.cz>
Date:   Mon Apr 17 12:59:51 2023 +0200

    ipa: Fix double reference-count decrements for the same edge (PR 107769, PR
109318)

    It turns out that since addition of the code that can identify globals
    which are only read from, the code that keeps track of the references
    can decrement their count for the same calls, once during IPA-CP and
    then again during inlining.  Fixed by adding a special flag to the
    pass-through variant and simply wiping out the reference to the
    refdesc structure from the constant ones.

    Moreover, during debugging of the issue I have discovered that the
    code removing references could remove a reference associated with the
    same statement but of a wrong type.  In all cases it wanted to remove
    an IPA_REF_ADDR reference so removing a lesser one instead should do
    no harm in practice, but we should try to be consistent and so this
    patch extends symtab_node::find_reference so that it searches for a
    reference of a given type only.

    gcc/ChangeLog:

    2023-04-14  Martin Jambor  <mjambor@suse.cz>

            PR ipa/107769
            PR ipa/109318
            * cgraph.h (symtab_node::find_reference): Add parameter use_type.
            * ipa-prop.h (ipa_pass_through_data): New flag refdesc_decremented.
            (ipa_zap_jf_refdesc): New function.
            (ipa_get_jf_pass_through_refdesc_decremented): Likewise.
            (ipa_set_jf_pass_through_refdesc_decremented): Likewise.
            * ipa-cp.cc (ipcp_discover_new_direct_edges): Provide a value for
            the new parameter of find_reference.
            (adjust_references_in_caller): Likewise. Make sure the constant
jump
            function is not used to decrement a refdec counter again.  Only
            decrement refdesc counters when the pass_through jump function
allows
            it.  Added a detailed dump when decrementing refdesc counters.
            * ipa-prop.cc (ipa_print_node_jump_functions_for_edge): Dump new
flag.
            (ipa_set_jf_simple_pass_through): Initialize the new flag.
            (ipa_set_jf_unary_pass_through): Likewise.
            (ipa_set_jf_arith_pass_through): Likewise.
            (remove_described_reference): Provide a value for the new parameter
of
            find_reference.
            (update_jump_functions_after_inlining): Zap refdesc of new jfunc if
            the previous pass_through had a flag mandating that we do so.
            (propagate_controlled_uses): Likewise.  Only decrement refdesc
            counters when the pass_through jump function allows it.
            (ipa_edge_args_sum_t::duplicate): Provide a value for the new
            parameter of find_reference.
            (ipa_write_jump_function): Assert the new flag does not have to be
            streamed.
            * symtab.cc (symtab_node::find_reference): Add parameter use_type,
use
            it in searching.

    gcc/testsuite/ChangeLog:

    2023-04-06  Martin Jambor  <mjambor@suse.cz>

            PR ipa/107769
            PR ipa/109318
            * gcc.dg/ipa/pr109318.c: New test.
            * gcc.dg/lto/pr107769_0.c: Likewise.

[Bug ipa/109318] [12 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 Regression]       |[12 Regression] csmith:
                   |csmith: -fipa-cp seems to   |-fipa-cp seems to cause
                   |cause trouble since         |trouble since
                   |r12-2523-g13586172d0b70c    |r12-2523-g13586172d0b70c

--- Comment #12 from Martin Jambor <jamborm at gcc dot gnu.org> ---
This has been fixed on master just in time to get into gcc 13 RC.  Backport to
gcc-12 will follow.

[Bug ipa/109318] [12 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Martin Jambor
<jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:bea3885200c549419567ad3a43ac71642619ad1a

commit r12-9476-gbea3885200c549419567ad3a43ac71642619ad1a
Author: Martin Jambor <mjambor@suse.cz>
Date:   Wed Apr 26 18:38:39 2023 +0200

    ipa: Fix double reference-count decrements for the same edge (PR 107769, PR
109318)

    It turns out that since addition of the code that can identify globals
    which are only read from, the code that keeps track of the references
    can decrement their count for the same calls, once during IPA-CP and
    then again during inlining.  Fixed by adding a special flag to the
    pass-through variant and simply wiping out the reference to the
    refdesc structure from the constant ones.

    Moreover, during debugging of the issue I have discovered that the
    code removing references could remove a reference associated with the
    same statement but of a wrong type.  In all cases it wanted to remove
    an IPA_REF_ADDR reference so removing a lesser one instead should do
    no harm in practice, but we should try to be consistent and so this
    patch extends symtab_node::find_reference so that it searches for a
    reference of a given type only.

    gcc/ChangeLog:

    2023-04-14  Martin Jambor  <mjambor@suse.cz>

            PR ipa/107769
            PR ipa/109318
            * cgraph.h (symtab_node::find_reference): Add parameter use_type.
            * ipa-prop.h (ipa_pass_through_data): New flag refdesc_decremented.
            (ipa_zap_jf_refdesc): New function.
            (ipa_get_jf_pass_through_refdesc_decremented): Likewise.
            (ipa_set_jf_pass_through_refdesc_decremented): Likewise.
            * ipa-cp.cc (ipcp_discover_new_direct_edges): Provide a value for
            the new parameter of find_reference.
            (adjust_references_in_caller): Likewise. Make sure the constant
jump
            function is not used to decrement a refdec counter again.  Only
            decrement refdesc counters when the pass_through jump function
allows
            it.  Added a detailed dump when decrementing refdesc counters.
            * ipa-prop.cc (ipa_print_node_jump_functions_for_edge): Dump new
flag.
            (ipa_set_jf_simple_pass_through): Initialize the new flag.
            (ipa_set_jf_unary_pass_through): Likewise.
            (ipa_set_jf_arith_pass_through): Likewise.
            (remove_described_reference): Provide a value for the new parameter
of
            find_reference.
            (update_jump_functions_after_inlining): Zap refdesc of new jfunc if
            the previous pass_through had a flag mandating that we do so.
            (propagate_controlled_uses): Likewise.  Only decrement refdesc
            counters when the pass_through jump function allows it.
            (ipa_edge_args_sum_t::duplicate): Provide a value for the new
            parameter of find_reference.
            (ipa_write_jump_function): Assert the new flag does not have to be
            streamed.
            * symtab.cc (symtab_node::find_reference): Add parameter use_type,
use
            it in searching.

    gcc/testsuite/ChangeLog:

    2023-04-06  Martin Jambor  <mjambor@suse.cz>

            PR ipa/107769
            PR ipa/109318
            * gcc.dg/ipa/pr109318.c: New test.
            * gcc.dg/lto/pr107769_0.c: Likewise.

    (cherry picked from commit 8e08c7886eed5824bebd0e011526ec302d622844)

[Bug ipa/109318] [12 Regression] csmith: -fipa-cp seems to cause trouble since r12-2523-g13586172d0b70c

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109318

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #14 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed.