From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 216643858C5E; Wed,  5 Jul 2023 11:10:21 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 216643858C5E
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1688555421;
	bh=+Uws1LTZp1eAz3oVT8e0rr6DDwIZOb4KAxdIui4RmOs=;
	h=From:To:Subject:Date:From;
	b=TqONBOixBUZd0E588LP3BDTs8U7nNnmwUviypn53awZQLAUGfi/Ef3JTAcV4LfSUU
	 sk1/HxrbyVQcSi2LR7hIe/11SwMW4ilO3svbPvIC/N3MKh5h1D8Mz0pCIEHEaeIaxe
	 w3Gu9GbxTrYvyn3dpmwl9Wj1vHfrP3rszEjXfEL4=
From: "xry111 at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/110557] New: Wrong code for x86_64-linux-gnu with -O3
 -mavx2: vectorized loop mishandles signed bit-fields
Date: Wed, 05 Jul 2023 11:10:20 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 14.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: xry111 at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-110557-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D110557

            Bug ID: 110557
           Summary: Wrong code for x86_64-linux-gnu with -O3 -mavx2:
                    vectorized loop mishandles signed bit-fields
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: xry111 at gcc dot gnu.org
  Target Milestone: ---

$ cat test.cc

#include <cstddef>

size_t max(size_t a, size_t b) { return a < b ? b : a; }

struct Item {
  int x : 8;
  std::ptrdiff_t y : 56;
};

__attribute__((noipa)) std::size_t test(Item *a, int cnt) {
  std::size_t size =3D 0;
  for (int i =3D 0; i < cnt; i++)
    size =3D max(static_cast<size_t>(-(a[i].y * 4)), size);
  return size;
}

int main() {
  struct Item items[] =3D {
      {1, -1},
      {2, -2},
      {3, -3},
      {4, -4},
  };

  if (test(items, 4) !=3D 16)
    __builtin_trap();
}

$ g++ test.cc -Wall -Wextra -O3 -fsanitize=3Dundefined
$ ./a.out && echo ok
ok
$ g++ test.cc -Wall -Wextra -O3 -mavx2
$ ./a.out && echo ok
Illegal instruction (core dumped)

Reproducible with GCC 13.1 and trunk.  Interestingly if I convert the test =
case
to  C (instead of C++) the issue won't reproduce.

This test case is reduced from WebKit, it crashes with GCC 13.1 and -O3 -ma=
vx2.
 The WebKit code has "<< 2" instead of "* 4", thus invoking an undefined
behavior.  But it still crashes even if I change "<< 2" to "* 4".=