From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id B63613858C1F; Mon, 14 Aug 2023 11:34:56 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B63613858C1F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692012896; bh=EfkBnDWMGmeA3x206PzM6Big8kZk3XEKeyFKAvecwTQ=; h=From:To:Subject:Date:In-Reply-To:References:From; b=QtbeRC9IxZ/2i/wlxcdU7CNTIHQnPfbcFd0bSaVGrfMwTejjkGM+6+dYu3BpVSjDl 5mAHSMFqVKboh1fsVgCzmjNENZBSlx9IWrnM6cWF4xq58Djm9Ddgk4rOzILToO3FYw SbyDkN3jLWNYNkAzbVadB1VouXuUQFitPFfQw+EU= From: "rguenth at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug middle-end/111009] [12/13/14 regression] -fno-strict-overflow erroneously elides null pointer checks and causes SIGSEGV on perf from linux-6.4.10 Date: Mon, 14 Aug 2023 11:34:55 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: middle-end X-Bugzilla-Version: 14.0 X-Bugzilla-Keywords: wrong-code X-Bugzilla-Severity: normal X-Bugzilla-Who: rguenth at gcc dot gnu.org X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: 12.4 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_status cc priority target_milestone cf_reconfirmed_on everconfirmed Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D111009 Richard Biener changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW CC| |amacleod at redhat dot com, | |rguenth at gcc dot gnu.org Priority|P3 |P2 Target Milestone|--- |12.4 Last reconfirmed| |2023-08-14 Ever confirmed|0 |1 --- Comment #2 from Richard Biener --- There's nothing really wrong with lifting the &dso->maj computation, on GIM= PLE &dso->maj is just address arithmetic. Interestingly we unswitch the loop but only with -fwrapv-pointer. OK, so the bug looks like we have if (&dso->maj !=3D 0) for (;;) { if (!dso) return 1; if (dso =3D=3D curr) return 1; ... } and the if (!dso) test is optimized away since &dso->maj !=3D 0. That's done by DOM3 here: Optimizing statement _21 =3D dso_8(D) =3D=3D _11; LKUP STMT _21 =3D dso_8(D) eq_expr _11 2>>> STMT _21 =3D dso_8(D) eq_expr _11 Optimizing statement _22 =3D _21 | _13; Replaced '_13' with constant '0' Applying pattern match.pd:201, gimple-match-10.cc:6318 gimple_simplified to _22 =3D _21; Folded to: _22 =3D _21; I don't see where _13 =3D 0 is entered, this is possibly ranger related: _13 : CACHE: BB 9 DOM query for _13, found [irange] _Bool VARYING at BB3 797 GORI recomputation attempt on edge 3->16 for _13 =3D dso_8(D) =3D= =3D 0B; 798 GORI outgoing_edge for dso_8(D) on edge 3->16 799 GORI compute op 1 (a_9) at if (a_9 =3D=3D 0B) GORI LHS =3D[irange] _Bool [1, 1] GORI Computes a_9 =3D [irange] int * [0, 0] intersect Known = range : [irange] int * VARYING GORI TRUE : (799) produces (a_9) [irange] int * [0, 0] 800 GORI compute op 1 (dso_8(D)) at a_9 =3D &dso_8(D)->maj; GORI LHS =3D[irange] int * [0, 0] GORI Computes dso_8(D) =3D [irange] struct dso * [0, 0] inte= rsect Known range : [irange] struct dso * VARYING GORI TRUE : (800) produces (dso_8(D)) [irange] struct dso * [= 0, 0] GORI TRUE : (798) outgoing_edge (dso_8(D)) [irange] struct dso *= [0, 0] GORI TRUE : (797) recomputation (_13) [irange] _Bool [1, 1] I don't think we can do this. Andrew?=