[Bug tree-optimization/109626] New: forwprop introduces new signed multiplication UB

[Bug tree-optimization/109626] New: forwprop introduces new signed multiplication UB

[kristerw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109626

            Bug ID: 109626
           Summary: forwprop introduces new signed multiplication UB
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kristerw at gcc dot gnu.org
  Target Milestone: ---

Consider the function

int foo(_Bool v0, unsigned v1, unsigned v2)
{
  signed int v5 = v1 >> v2;
  unsigned v6 = -v1;
  unsigned int v7 = v2 - v0;
  return (int)v7 * (int)v6;
}

This does not invoke undefined behavior when called as foo(0, 0x80000000, 1),
but forwprop1 optimizes this to the equivalent of

int foo(_Bool v0, unsigned v1, unsigned v2)
{
  signed int v5 = v1 >> v2;
  unsigned int v7 = v0 - v2;
  return (int)v7 * (int)v1;
}

where the signed multiplication now is calculating -1 * INT_MIN.

[Bug tree-optimization/109626] forwprop introduces new signed multiplication UB

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109626

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
We apply from match.pd (-A) * (-B) -> A * B and -(A - B) -> B - A where
there are no constraints on overflow present for these patterns.

We go

(int) (v2_6(D) - _2) * (int) - v1_5(D)

-> (int) (- (v2_6(D) - _2)) * (int) v1_5(D)

-> (int) (_2 - v2_6(D)) * (int) v1_5(D)

I think the issue must be in (-A) * (-B) -> A * B, but I can't quite nail it.
To result in -1 * INT_MIN we'd have to come from 1 * INT_MIN but then the
negation of INT_MIN would already be problematic.

[Bug tree-optimization/109626] forwprop introduces new signed multiplication UB

[mikael at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109626

Mikael Morin <mikael at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mikael at gcc dot gnu.org

--- Comment #2 from Mikael Morin <mikael at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #1)
> 
> I think the issue must be in (-A) * (-B) -> A * B, but I can't quite nail it.
> To result in -1 * INT_MIN we'd have to come from 1 * INT_MIN but then the
> negation of INT_MIN would already be problematic.

The original negation is made on an unsigned number (before the cast to int),
so it's not problematic.