[Bug tree-optimization/110931] New: [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[Bug tree-optimization/110931] New: [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[theodort at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

            Bug ID: 110931
           Summary: [14 Regression] Dead Code Elimination Regression since
                    r14-2890-gcc2003cd875
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: theodort at inf dot ethz.ch
  Target Milestone: ---

https://godbolt.org/z/zPTeo8Mj9

Given the following code:

void foo(void);
static int a = 7, c;
static int *d = &a, *e;
static int **f = &e;
static short g;
static char(h)(char b) {
    if (!(((b) >= 1) && ((b) <= 1))) {
        __builtin_unreachable();
    }
    return 0;
}
static void k(unsigned i) {
    short j = i;
    if (j)
        ;
    else {
        h(i);
        if ((e && i) <= 0)
            ;
        else
            foo();
        *f = &c;
    }
    h(0 >= 0);
}
int main() {
    int l = *d;
    g = l;
    k(g);
}

gcc-trunk -O3 does not eliminate the call to foo:

main:
        cmpw    $0, a(%rip)
        jne     .L5
        cmpq    $0, e(%rip)
        je      .L6
        pushq   %rax
        call    foo
        xorl    %eax, %eax
        movq    $c, e(%rip)
        popq    %rdx
        ret
.L6:
        movq    $c, e(%rip)
.L5:
        xorl    %eax, %eax
        ret

gcc-13.2.0 -O3 eliminates the call to foo:

main:
        xorl    %eax, %eax
        ret

Bisects to r14-2890-gcc2003cd875

[Bug tree-optimization/110931] [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |missed-optimization
   Target Milestone|---                         |14.0

[Bug tree-optimization/110931] [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-08-07
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:
```
void foo(void);
int l=1000;

int main(void)
{
  short t = l;
  unsigned t1 = t;
  if (t1 == 0) {
#if 1
    char b = t1;
#else
    char b = l;
#endif
    if (b != 1) __builtin_unreachable();
    foo();
  }
}
```

Changing 1 to 0 in the #if, shows the missed optimization too.

[Bug tree-optimization/110931] [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Basically there is a missing VRP happening here:
l.0_1   [irange] int [-INF, -65536][0, 0][65536, +INF]
Partial equiv (b_6 pe8 l.0_1)
    <bb 3> :
    b_6 = (char) l.0_1;
...
Obvious that b_6 will have the range [0,0] as the other parts of l.0_1 is
outside of that range. But for some reason VRP didn't figure that out here ...

I don't understand how this is supposed to work

[Bug tree-optimization/110931] [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Here is one that has always failed due to a similar issue where the inner cast
was removed:
```
void foo(void);
int l=1000;

int main(void)
{
  short t = l;
  int t1 = t;
  if (t1 == 0) {
    signed char b = t1;
    if (b != 1) __builtin_unreachable();
    foo();
  }
}
```

[Bug tree-optimization/110931] [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |85316

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #2)
> Basically there is a missing VRP happening here:
> l.0_1	[irange] int [-INF, -65536][0, 0][65536, +INF]
> Partial equiv (b_6 pe8 l.0_1)
>     <bb 3> :
>     b_6 = (char) l.0_1;
> ...
> Obvious that b_6 will have the range [0,0] as the other parts of l.0_1 is
> outside of that range. But for some reason VRP didn't figure that out here
> ...

Oh it looks like we don't prop NONZERO back and I missed that when I first
looked at this.

In this case we have:
l&(short)(-1) == 0

But we don't record that in the above, only a range ...


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85316
[Bug 85316] [meta-bug] VRP range propagation missed cases

[Bug tree-optimization/110931] [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org
           Priority|P3                          |P2

[Bug tree-optimization/110931] [14 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

--- Comment #5 from Jeffrey A. Law <law at gcc dot gnu.org> ---
One could also look at this as a failure to propagate.

  l.0_1 = l;
  t_4 = (short int) l.0_1;
  if (t_4 == 0)
    goto <bb 3>; [50.00%]
  else
    goto <bb 6>; [50.00%]


We ought to be able to propagate l.0_1 into the conditional for t_4.  If we do
that, then we'll be able to propagate 0 for l.0_1 in this block:

;;   basic block 3, loop depth 0, count 536870912 (estimated locally, freq
0.5000)
;;    prev block 2, next block 4, flags: (NEW, VISITED)
;;    pred:       2 [50.0% (guessed)]  count:536870912 (estimated locally, freq
0.5000) (TRUE_VALUE,EXECUTABLE)
  b_5 = (char) l.0_1;
  if (b_5 != 1)
    goto <bb 4>; [0.00%]
  else
    goto <bb 5>; [100.00%]


And once we propagate the value 0 that will make the make bb5 (containing the
call to foo) unreachable.

IIRC we have (had?) some code to do these kinds of propagations through
conversions.  IIRC it was fairly conservative, perhaps overly so.

[Bug tree-optimization/110931] [14/15 Regression] Dead Code Elimination Regression since r14-2890-gcc2003cd875

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110931

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|14.0                        |14.2

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 14.1 is being released, retargeting bugs to GCC 14.2.