[Bug c/111000] New: Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[Bug c/111000] New: Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

            Bug ID: 111000
           Summary: Wrong code at -O3 on x86_64-linux-gnu since
                    r14-2944-g3d48c11ad08
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
  Target Milestone: ---

gcc at -O3 produces the wrong code.

Bisected to r14-2944-g3d48c11ad08

Compiler explorer: https://godbolt.org/z/b67W17Gvb

$ cat a.c
int printf(const char *, ...);
long a = 68;
int b, d, e;
int main() {
  for (; d <= 6; d++) {
    b = 0;
    for (; b <= 6; b++) {
      int c = a;
      e = c >= 32 || d > 647 >> c ? d : 0;
    }
  }
  printf("%d\n", e);
}
$
$ gcc -O0 a.c &&./a.out
6
$ gcc -O3 a.c && ./a.out
4
$

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |tree-optimization
   Target Milestone|---                         |14.0
           Keywords|                            |wrong-code
            Summary|Wrong code at -O3 on        |[14 Regression] Wrong code
                   |x86_64-linux-gnu since      |at -O3 on x86_64-linux-gnu
                   |r14-2944-g3d48c11ad08       |since r14-2944-g3d48c11ad08

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-08-13
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, changed to make it self contained testcase and maybe understand what
is going wrong:
```
int printf(const char *, ...);
volatile int a = 68;
int b, d, e;
int main() {
  int t = a;
  for (; d <= 6; d++) {
    for (b = 0; b <= 6; b++) {
      if (t >= 31)
        e = d;
      else if (d > (647 >> t))
        e = d;
      else
        e = 0;
    }
  }
  printf("%d\n", e);
  if (e != 6)
    __builtin_abort();
}
```

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
we are computing 647 >> t even when that would invoke undefined behavior (but
LIM does this already).  Disabling either loop splitting or final value
replacement avoids the miscompile.

The only "interesting" replacement is the PHI defining the guard of the
second loop, thus 'd' after the first loop:

final value replacement:
  _54 = PHI <_4(10)>
 with expr: (d.6_22 + 1) + (d.6_22 <= _53 ? (int) ((unsigned int) _53 -
(unsigned int) d.6_22) : 0)
 final stmt:
  _54 = _67 + _73;

d.6_22 is 'd' at the start of the program, _53 is the loop split adjusted
exit test value, MIN (647 >> t, 7 - (d + 1)).

When disabling vectorization we instead get

0
Aborted (core dumped)

likewise when disabling unswitching.  When disabling early invariant motion
splitting is disabled.  Changing the test to the following, avoiding the
undefined behavior resolves the miscompile.

int printf(const char *, ...);
volatile int a = 31;
int b, d, e;
int main()
{
  int t = a;
  for (; d <= 6; d++) {
      for (b = 0; b <= 6; b++) {
          if (t >= 30)
            e = d;
          else if (d > (647 >> t))
            e = d;
          else
            e = 0;
      }
  }
  printf("%d\n", e);
  if (e != 6)
    __builtin_abort();
}

so in the end I think we see the effect of hoisting the shift and then
involving it in a complex computation + comparison, eventually enabling
folding that's "invalid" (taking advantage of the undefined behavior).

I will need to see to avoid hoisting shifts (we already rewrite undefined
signed overflow to unsigned arithmetic).  Unfortunately there's no "safe"
way to write shifts without adding computation (but maybe we should do
that, rewrite it to 647 >> min (t, 31)).

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:d118738e71cf4615f170fff8dabe66442206d008

commit r14-4786-gd118738e71cf4615f170fff8dabe66442206d008
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 20 11:54:07 2023 +0200

    tree-optimization/111000 - restrict invariant motion of shifts

    The following restricts moving variable shifts to when they are
    always executed in the loop as we currently do not have an efficient
    way to rewrite them to something that is unconditionally
    well-defined and value range analysis will otherwise compute
    invalid ranges for the shift operand.

            PR tree-optimization/111000
            * stor-layout.h (element_precision): Move ..
            * tree.h (element_precision): .. here.
            * tree-ssa-loop-im.cc (movement_possibility_1): Restrict
            motion of shifts and rotates.

            * gcc.dg/torture/pr111000.c: New testcase.

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed, the issue is latent though.

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000
Bug 111000 depends on bug 111950, which changed state.

Bug 111950 Summary: [14 Regression] ICE in compute_live_loop_exits, at tree-ssa-loop-manip.cc:250 since r14-4786-gd118738e71c
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111950

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

[Bug tree-optimization/111000] [14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r14-2944-g3d48c11ad08

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111000

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:a0b2abef4e62d816f669df478a3cc320647c3b31

commit r14-5391-ga0b2abef4e62d816f669df478a3cc320647c3b31
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Nov 13 13:38:57 2023 +0100

    tree-optimization/111792 - new testcase

    This was fixed as part of the PR111000 fix.

            PR tree-optimization/111792
            PR tree-optimization/111000
            * gcc.dg/torture/pr111792.c: New testcase.