[Bug middle-end/110431] New: Incorrect disambiguation of wide accesess from store-merging or SLP

[Bug middle-end/110431] New: Incorrect disambiguation of wide accesess from store-merging or SLP

[amonakov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110431

            Bug ID: 110431
           Summary: Incorrect disambiguation of wide accesess from
                    store-merging or SLP
           Product: gcc
           Version: 12.3.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: amonakov at gcc dot gnu.org
  Target Milestone: ---

Inspired by bug 110237 comment 19:

int b, a;

int main()
{
    int *pa = &a, *pb = &b;
    asm("" : "+r"(pa));
    asm("" : "+r"(pb));
    if (pa + 1 == pb) {
        a = 1, b = 2;
        long x;
        __builtin_memcpy(&x, pa, 4);
        __builtin_memcpy(4 + (char *)&x, pa+1, 4);
        return (x - 0x0000000200000001) * 131 >> 32;
    }
}

https://godbolt.org/z/b67zxMv54

On GIMPLE, both store-merging and SLP vectorization are capable of introducing
merged long-sized access in place of individual int-sized memcpy's, which is
then disambiguated against initial stores on the RTL level, leading to a
miscompilation.

[Bug middle-end/110431] Incorrect disambiguation of wide accesess from store-merging or SLP

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110431

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-06-27
                 CC|                            |rguenth at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
I guess the provenance people would say this violates some rules since
pa + 1 is used to access 'b'.  GCC itself is prone to introduce such
issues when propagating equivalences though.