[Bug tree-optimization/110176] New: wrong code at -Os and above on x86_64-linux-gnu

[Bug tree-optimization/110176] New: wrong code at -Os and above on x86_64-linux-gnu

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

            Bug ID: 110176
           Summary: wrong code at -Os and above on x86_64-linux-gnu
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It seems to affect GCC 10.4 and later.

Compiler Explorer: https://godbolt.org/z/aKfvfxa63


[504] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/home/suz/suz-local/software/local/gcc-trunk/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror
--disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20230607 (experimental) (GCC) 
[505] % 
[505] % gcctk -O1 small.c; ./a.out
[506] % 
[506] % gcctk -O2 small.c
[507] % timeout -s 9 5 ./a.out
Killed
[508] % 
[508] % cat small.c
int a, b;
void c() {}
int d() {
  unsigned f[1];
  int i;
  if (a)
    goto h;
  f[0] = -1;
  while (1) {
    c();
    for (; a < 1; a++) {
      if (0) {
      j:
        continue;
      }
      i = f[0];
      if (a)
        break;
      b = i >= (b == 0);
    }
    if (!b) {
      if (0) {
      h:
        goto j;
      }
      return 0;
    }
  }
}
int main() {
  d();
  return 0;
}

[Bug tree-optimization/110176] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fre turns:
  b.2_4 = b;
  _5 = b.2_4 == 0;
  _6 = (int) _5;
  _7 = _6 <= i_19;
  _8 = (int) _7;
  b = _8;

Into:
  b.2_4 = b;
  _5 = b.2_4 == 0;
  _6 = (int) _5;
  b = 1;

Which is wrong as _6 <= -1 is always 0.

(simplify
(cmp (convert@0 @00) (convert?@1 @10))

...

tree min = lower_bound_in_type (TREE_TYPE (@10), TREE_TYPE (@00));
tree max = upper_bound_in_type (TREE_TYPE (@10), TREE_TYPE (@00));
bool above = integer_nonzerop (const_binop (LT_EXPR, type, max, @10));
bool below = integer_nonzerop (const_binop (LT_EXPR, type, @10, min));
...
(if (above || below)
...
{ constant_boolean_node (above ? true : false, type); }

[Bug tree-optimization/110176] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-06-08

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Here is a testcase which will abort rather than do an infinite loop:
```


int f(_Bool t)
{
        int tt = t;
        unsigned x = -1;
        int xx = x;
        return xx <= tt;
}

int a, b;
void c() {}
[[gnu::noipa]]
void h() {__builtin_abort();}
int d() {
  unsigned f[1];
  int i;
  if (a)
    goto h;
  f[0] = -1;
  while (1) {
    c();
    for (; a < 1; a++) {
      if (0) {
      j:
        continue;
      }
      i = f[0];
      if (a)
        break;
      b = i >= (b == 0);
    }
    if (!b) {
      if (0) {
      h:
        goto j;
      }
      return 0;
    }
    h();
  }
}
int main() {
  d();
  return 0;
}
```

[Bug tree-optimization/110176] [10/11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|wrong code at -Os and above |[10/11/12/13/14 Regression]
                   |on x86_64-linux-gnu         |wrong code at -Os and above
                   |                            |on x86_64-linux-gnu
      Known to fail|                            |10.4.0, 11.1.0
   Target Milestone|---                         |10.5
      Known to work|                            |10.3.0

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The C++ testcase that is:
```
int a, b;
void c() {}
[[gnu::noipa]]
void h() {__builtin_abort();}
int d() {
  unsigned f[1];
  int i;
  if (a)
    goto h;
  f[0] = -1;
  while (1) {
    c();
    for (; a < 1; a++) {
      if (0) {
      j:
        continue;
      }
      i = f[0];
      if (a)
        break;
      b = i >= (b == 0);
    }
    if (!b) {
      if (0) {
      h:
        goto j;
      }
      return 0;
    }
    h();
  }
}
int main() {
  d();
  return 0;
}
```

[Bug tree-optimization/110176] [10/11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
10.4.0:
Value numbering stmt = _8 = _7 <= i_19;
Applying pattern match.pd:4279, gimple-match.c:13484
Match-and-simplified _7 <= i_19 to 1
RHS _7 <= i_19 simplified to 1
Setting value number of _8 to 1


GCC 10.3.0:
Value numbering stmt = _8 = _7 <= i_19;
Applying pattern match.pd:4274, gimple-match.c:7895
Match-and-simplified _7 <= i_19 to 1
RHS _7 <= i_19 simplified to 1
Not changing value number of _8 from VARYING to 1


Maybe r10-9757-gec97d2e842022a3f112e27d6d8

[Bug tree-optimization/110176] [10/11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
           Keywords|                            |needs-bisection
            Version|unknown                     |13.1.1
                 CC|                            |rguenth at gcc dot gnu.org

[Bug tree-optimization/110176] [11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.

[Bug tree-optimization/110176] [11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
            Summary|[11/12/13/14 Regression]    |[11/12/13/14 Regression]
                   |wrong code at -Os and above |wrong code at -Os and above
                   |on x86_64-linux-gnu         |on x86_64-linux-gnu since
                   |                            |r11-2446
           Keywords|needs-bisection             |

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r11-2446-g3e61a2056335ca7d4e2009823efae4ee2dc950ee

[Bug tree-optimization/110176] [11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #6)
> Started with r11-2446-g3e61a2056335ca7d4e2009823efae4ee2dc950ee

Note r10-9757-gec97d2e842022a3f112e27d6d8 is the backported to the GCC 10
branch.

[Bug tree-optimization/110176] [11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
comment#4 suggests the iteration order change just exposes the issue
highlighted in comment#1?

I will eventually investigate.

[Bug tree-optimization/110176] [11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
With all VARYING we simplify

i_19 = (int) _2;
_6 = (int) _5;
Value numbering stmt = _7 = _6 <= i_19;
Applying pattern match.pd:6775, gimple-match-4.cc:1795
Match-and-simplified _6 <= i_19 to 1

where _5 is _Bool and _2 is unsigned int.  We match

 zext <= (int) 4294967295u

note that I see

Value numbering stmt = _2 = f$0_25;
Setting value number of _2 to 4294967295 (changed)
Value numbering stmt = i_19 = (int) _2;
Match-and-simplified (int) _2 to -1
RHS (int) _2 simplified to -1 
Not changing value number of i_19 from VARYING to -1
Making available beyond BB6 i_19 for value i_19

so it's odd we see the constant here, but ... we go

      (if (TREE_CODE (@10) == INTEGER_CST
           && INTEGRAL_TYPE_P (TREE_TYPE (@00))
           && !int_fits_type_p (@10, TREE_TYPE (@00)))
       (with
        {
          tree min = lower_bound_in_type (TREE_TYPE (@10), TREE_TYPE (@00));
          tree max = upper_bound_in_type (TREE_TYPE (@10), TREE_TYPE (@00));
          bool above = integer_nonzerop (const_binop (LT_EXPR, type, max,
@10));
          bool below = integer_nonzerop (const_binop (LT_EXPR, type, @10,
min));
        }
        (if (above || below)

failing to see that we deal with a relational compare and a sign-change.

The original code from fold-const.cc had only INTEGER_TYPE support,
r6-4300-gf6c1575958f7bf made it cover all integral types (it half-way
supported BOOLEAN_TYPE already).  But the issue was latent I think.
One notable difference was that I think get_unwidened made sure to
convert a constant to the wider type while here we have @10 != @1
and the conversion not applied.  We're doing it correct in earlier code:

    /* ???  The special-casing of INTEGER_CST conversion was in the original
       code and here to avoid a spurious overflow flag on the resulting
       constant which fold_convert produces.  */
    (if (TREE_CODE (@1) == INTEGER_CST)

using @1 instead of @10.

Correcting that avoids the pattern from triggering in this wrong way.

[Bug tree-optimization/110176] [11/12/13/14 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

--- Comment #10 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:22dbfbe8767ff4c1d93e39f68ec7c2d5b1358beb

commit r14-8658-g22dbfbe8767ff4c1d93e39f68ec7c2d5b1358beb
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Jan 31 14:40:24 2024 +0100

    middle-end/110176 - wrong zext (bool) <= (int) 4294967295u folding

    The following fixes a wrong pattern that didn't match the behavior
    of the original fold_widened_comparison in that get_unwidened
    returned a constant always in the wider type.  But here we're
    using (int) 4294967295u without the conversion applied.  Fixed
    by doing as earlier in the pattern - matching constants only
    if the conversion was actually applied.

            PR middle-end/110176
            * match.pd (zext (bool) <= (int) 4294967295u): Make sure
            to match INTEGER_CST only without outstanding conversion.

            * gcc.dg/torture/pr110176.c: New testcase.

[Bug tree-optimization/110176] [11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |14.0
            Summary|[11/12/13/14 Regression]    |[11/12/13 Regression] wrong
                   |wrong code at -Os and above |code at -Os and above on
                   |on x86_64-linux-gnu since   |x86_64-linux-gnu since
                   |r11-2446                    |r11-2446

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/110176] [11/12/13 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

--- Comment #12 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:d4216cc2c879ecbdc4df6a2db67f6b6afd7a7d68

commit r13-8287-gd4216cc2c879ecbdc4df6a2db67f6b6afd7a7d68
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Jan 31 14:40:24 2024 +0100

    middle-end/110176 - wrong zext (bool) <= (int) 4294967295u folding

    The following fixes a wrong pattern that didn't match the behavior
    of the original fold_widened_comparison in that get_unwidened
    returned a constant always in the wider type.  But here we're
    using (int) 4294967295u without the conversion applied.  Fixed
    by doing as earlier in the pattern - matching constants only
    if the conversion was actually applied.

            PR middle-end/110176
            * match.pd (zext (bool) <= (int) 4294967295u): Make sure
            to match INTEGER_CST only without outstanding conversion.

            * gcc.dg/torture/pr110176.c: New testcase.

    (cherry picked from commit 22dbfbe8767ff4c1d93e39f68ec7c2d5b1358beb)

[Bug tree-optimization/110176] [11/12 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110176

--- Comment #13 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:65e5547e5468ce404d0f9ebd646a1d63abf3a772

commit r12-10458-g65e5547e5468ce404d0f9ebd646a1d63abf3a772
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Jan 31 14:40:24 2024 +0100

    middle-end/110176 - wrong zext (bool) <= (int) 4294967295u folding

    The following fixes a wrong pattern that didn't match the behavior
    of the original fold_widened_comparison in that get_unwidened
    returned a constant always in the wider type.  But here we're
    using (int) 4294967295u without the conversion applied.  Fixed
    by doing as earlier in the pattern - matching constants only
    if the conversion was actually applied.

            PR middle-end/110176
            * match.pd (zext (bool) <= (int) 4294967295u): Make sure
            to match INTEGER_CST only without outstanding conversion.

            * gcc.dg/torture/pr110176.c: New testcase.

    (cherry picked from commit 22dbfbe8767ff4c1d93e39f68ec7c2d5b1358beb)