[Bug rtl-optimization/110791] New: [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[Bug rtl-optimization/110791] New: [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

            Bug ID: 110791
           Summary: [12/13/14 Regression] arm: Wrong code with -Os
                    -march=armv8.1-m.main
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

The following testcase is miscompiled since at least GCC 12 with -Os
-march=armv8.1-m.main:

void __attribute__ ((noinline))
foo (char *path, int *result)
{
  char *p = path;
  while (p >= path && *p != '/')
    p--;
  while (p > path && p[-1] == '/')
    p--;

  if (p < path)
    *result = 1;
}

int main(void)
{
  char path[4] = "usr";
  int x = 0;
  foo (path + 2, &x);
  if (!x)
    __builtin_abort ();
}

Below is the assembly we currently generate together with comments showing how
this goes wrong at runtime:

foo:
        mov     r3, r0         @ r3 <- (p = path)
        ldrb    r2, [r3], #-1  @ r2 <- *p; p--;
        cmp     r2, #47
        it      eq
        moveq   r3, r0         @ if (r2 == 47)  p <- path
        subs    r2, r3, r0
        cmp     r0, r3
        add     r2, r2, #1
        bhi     .L9            @ if (path > p) goto .L9 [taken]
        adds    r0, r0, #1
        bne     .L6
.L9:
        movs    r2, #1
.L6:
        subs    r2, r2, #1     @ r2 <- 0 [fall through from above]
        bne     .L3            @ [not taken, r2 was #1]
        bcc     .L4            @ [not taken]
        bx      lr             @ [return without setting *result = 1]
.L3:
        ldrb    r0, [r3, #-1]!
        cmp     r0, #47
        beq     .L6
        bx      lr
.L4:
        movs    r3, #1
        str     r3, [r1]
        bx      lr

At -O2 the code is both correct and much better quality:

foo:
        ldrb    r3, [r0]        @ zero_extendqisi2
        cmp     r3, #47
        itt     ne
        movne   r3, #1
        strne   r3, [r1]
        bx      lr

[Bug rtl-optimization/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
                 CC|                            |xry111 at gcc dot gnu.org
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-07-24

--- Comment #1 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
Isn't this a UB?

  while (p >= path && *p != '/')
    p--;

This will cause p to become "&main::path[0] - 1".  C23 6.5.6p9:

If the pointer operand and the result do not point to elements of the same
array object or one past the last element of the array object, the behavior is
undefined.

[Bug rtl-optimization/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

--- Comment #2 from Alex Coplan <acoplan at gcc dot gnu.org> ---
(In reply to Xi Ruoyao from comment #1)
> Isn't this a UB?
> 
>   while (p >= path && *p != '/')
>     p--;
> 
> This will cause p to become "&main::path[0] - 1".  C23 6.5.6p9:

In this case, with the input given in main, I think p should end up pointing to
main::path + 1 (since we pass in main::path + 2, and foo can only ever
decrement p at most one below its parameter path).

[Bug rtl-optimization/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |UNCONFIRMED
     Ever confirmed|1                           |0

--- Comment #3 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
(In reply to Alex Coplan from comment #2)
> (In reply to Xi Ruoyao from comment #1)
> > Isn't this a UB?
> > 
> >   while (p >= path && *p != '/')
> >     p--;
> > 
> > This will cause p to become "&main::path[0] - 1".  C23 6.5.6p9:
> 
> In this case, with the input given in main, I think p should end up pointing
> to main::path + 1 (since we pass in main::path + 2, and foo can only ever
> decrement p at most one below its parameter path).

Sorry, I misread the code.  I guess I need to drink some coffee now...

[Bug rtl-optimization/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[wilco at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

Wilco <wilco at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |wilco at gcc dot gnu.org

--- Comment #4 from Wilco <wilco at gcc dot gnu.org> ---
Simpler example:

void f(void);

void bug (char *path, char *p)
{
  while( p > path && p[-1] == '/' )
    p--;
  if (p < path)
    f();
}

bug:
        subs    r3, r1, r0
        cmp     r0, r1
        add     r3, r3, #1
        bhi     .L7
        adds    r0, r0, #1
        bne     .L5
.L7:
        movs    r3, #1
.L5:
        subs    r3, r3, #1
        bne     .L2
        bcc     .L3   ** this is obviously never taken
        bx      lr
.L2:
        ldrb    r2, [r1, #-1]!  @ zero_extendqisi2
        cmp     r2, #47
        beq     .L5
        bx      lr
.L3:
        b       f

[Bug rtl-optimization/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.4
           Keywords|                            |needs-bisection

[Bug rtl-optimization/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

Alex Coplan <acoplan at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |

--- Comment #5 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Thanks Wilco for the simpler example.

It seems to have started with
r13-1268-g8c99e307b20c502e55c425897fb3884ba8f05882 with both of these
testcases, but it's probably a latent issue elsewhere (since it doesn't seem to
show up on other targets). Needs more analysis.

[Bug middle-end/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main

[wilco at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

Wilco <wilco at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
          Component|rtl-optimization            |middle-end
             Status|UNCONFIRMED                 |NEW

--- Comment #6 from Wilco <wilco at gcc dot gnu.org> ---
(In reply to Alex Coplan from comment #5)
> Thanks Wilco for the simpler example.
> 
> It seems to have started with
> r13-1268-g8c99e307b20c502e55c425897fb3884ba8f05882 with both of these
> testcases, but it's probably a latent issue elsewhere (since it doesn't seem
> to show up on other targets). Needs more analysis.

The bug happens on all targets with -fmodulo-sched -Os, eg. AArch64:

bug:
        sub     x2, x1, x0
        add     x2, x2, 1
        cmp     x0, x1
        bhi     .L7
        cmn     x0, #1
        bne     .L9
.L7:
        mov     x2, 1
.L9:
        subs    x2, x2, #1
        beq     .L1
        ldrb    w0, [x1, -1]
        cmp     w0, 47
        beq     .L6
.L1:
        ret
.L6:
        sub     x1, x1, #1
        b       .L9

[Bug rtl-optimization/110791] [12/13/14 Regression] arm: Wrong code with -Os -march=armv8.1-m.main (maybe fmodulo-sched related)

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110791

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P4
                 CC|                            |law at gcc dot gnu.org