From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id EF54B3858C52; Wed, 24 May 2023 08:42:58 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org EF54B3858C52
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1684917778;
	bh=RiENT1NW4n/IK+qS6t0NBa84Bg5rmqBDJGhSAaVYVrw=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=MhyMBfmFhAIjC8m7/VD5tuHuOXimmgt3XZWDMRauMgbd706x0W8dDq09wyrsgsFrb
	 iFg35icg70wI/5mo7Xuj19jU1XeKUfrZtjWqs3DJM/o031S4O/TapgVaHM4iyq855e
	 VtheK0zpe9HP+qxeUmX4cU6tovl/2C/jo9mf6fPQ=
From: "rguenther at suse dot de" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/109945] Escape analysis hates copy elision:
 different result with -O1 vs -O2
Date: Wed, 24 May 2023 08:42:57 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 14.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenther at suse dot de
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: rguenth at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-109945-4-nL0LUcz1xR@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-109945-4@http.gcc.gnu.org/bugzilla/>
References: <bug-109945-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D109945

--- Comment #15 from rguenther at suse dot de <rguenther at suse dot de> ---
On Wed, 24 May 2023, jakub at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D109945
>=20
> --- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
> (In reply to Richard Biener from comment #13)
> > with the former for -m64 and the latter for -m32 only seems to be the
> > only fallout here.
>=20
> It will penalize C and other languages without mandatory NRV in the FEs,
> without that I think the address can't escape (taking address then would =
either
> prevent tree-nrv.cc or
> even if not, would be still considered taking address of a local variable=
).
> Perhaps we could remember in some FUNCTION_DECL bit whether mandatory NRV=
 was
> done and
> least for the cases where we know the callee, we know it hasn't done NRV =
and
> !TREE_ADDRESSABLE (TREE_TYPE (gimple_call_lhs (stmt)))) we could avoid th=
is.
> But perhaps it is an overkill.

Well, but then the gimplifier doesn't look at the functions implementation
but decides based on the call alone.  It does have

              else if (TREE_CODE (*to_p) !=3D SSA_NAME
                      && (!is_gimple_variable (*to_p)
                          || needs_to_live_in_memory (*to_p)))
                /* Don't use the original target if it's already=20
addressable;
                   if its address escapes, and the called function uses=20
the
                   NRV optimization, a conforming program could see *to_p
                   change before the called function returns; see=20
c++/19317.
                   When optimizing, the return_slot pass marks more=20
functions
                   as safe after we have escape info.  */
                use_target =3D false;

but as we've seen TREE_ADDRESSABLE is not consistently set on the LHS
even when it's eventually passed by reference to the call
(aka aggregate_value_p is true).  It also seems that the gimplifier
will apply RSO when the call is in a INIT_EXPR.

Note the C frontend shows the same non-escaping when massaging the
testcase to

typedef struct {
    int i;
    int a[4];
} Widget;
Widget *global;
Widget make2() { Widget w; w.i =3D 1; global =3D &w; return w; }
void g() { global->i =3D 42; }
int main() {
  Widget w =3D make2();
  int i =3D w.i;
  g();
  return (i =3D=3D w.i);
    // Does this need to be reloaded and
    // compared? or is it obviously true?=20=20
}

then we get

int main ()
{
  int w$i;
  int i;
  struct Widget w;
  int _1;
  _Bool _2;
  int _7;

  <bb 2> :
  w =3D make2 (); [return slot optimization]
  w$i_9 =3D w.i;
  i_5 =3D w$i_9;
  g ();
  _1 =3D w$i_9;
  _2 =3D _1 =3D=3D i_5;
  _7 =3D (int) _2;
  w =3D{v} {CLOBBER(eol)};
  return _7;
}

and w not escaped (but it doesn't seem to miscompile then).  Of course
the testcase relies on RSO to be valid in the first place, C doesn't
make any guarantees here and I'm unsure whether C++ guarantees
that for any of the testcases.  As soon as there's a copy involved
the testcases invoke undefined behavior.=