[Bug tree-optimization/111293] New: [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[Bug tree-optimization/111293] New: [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[theodort at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

            Bug ID: 111293
           Summary: [14 Regression] Missed Dead Code Elimination since
                    r14-3414-g0cfc9c953d0
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: theodort at inf dot ethz.ch
  Target Milestone: ---

https://godbolt.org/z/9aj7sr5d6

Given the following code:

void foo(void);
static int a, d;
static short e;
static int(f)(int b, int c) { return c == 0 ? b : b / c; }
static char g(char h) {
    char i = 1;
    int j = 8;
    e = 3;
    for (; d; ++d) {
        if (f(0 == j, e)) return a;
        for (; i; i--) {
            if (j) {
                if (e)
                    ;
                else if (a)
                    continue;
                else
                    foo();
                j = -h;
                break;
            }
            __builtin_unreachable();
            break;
        }
    }
    return 1;
}
int main() {
    g(-1);
    a = e;
}

gcc-trunk -O2 does not eliminate the call to foo:

main:
        subq    $8, %rsp
        movl    d(%rip), %ecx
        movl    $3, %edx
        movw    %dx, e(%rip)
        testl   %ecx, %ecx
        je      .L6
        movl    $3, %edx
        .p2align 4,,10
        .p2align 3
.L2:
        testw   %dx, %dx
        jne     .L3
        movl    a(%rip), %eax
        testl   %eax, %eax
        je      .L18
.L5:
        addl    $1, d(%rip)
        jne     .L5
.L6:
        movswl  e(%rip), %eax
        movl    %eax, a(%rip)
        xorl    %eax, %eax
        addq    $8, %rsp
        ret
        .p2align 4,,10
        .p2align 3
.L18:
        call    foo
.L3:
        addl    $1, d(%rip)
        movzwl  e(%rip), %edx
        jne     .L2
        jmp     .L6

gcc-13.2.0 -O2 eliminates the call to foo:

main:
        movl    d(%rip), %edx
        movl    $3, %eax
        movw    %ax, e(%rip)
        testl   %edx, %edx
        je      .L3
        movl    $0, d(%rip)
.L3:
        movl    $3, a(%rip)
        xorl    %eax, %eax
        ret

Bisects to r14-3414-g0cfc9c953d0

[Bug tree-optimization/111293] [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |missed-optimization
   Target Milestone|---                         |14.0

[Bug tree-optimization/111293] [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The difference is the trunk can figure out the range for j_8:
PHI GROUP query for j_8 found : [irange] int [1, 1][8, 8] and adjusted original
range from :[irange] int [1, 1][8, 8] to :[irange] int [1, 1][8, 8]
Global Exported: j_8 = [irange] int [1, 1][8, 8] MASK 0x9 VALUE 0x8

But 13 can't:
Global Exported: j_8 = [irange] int [-INF, +INF] NONZERO 0x9

I have not looked into how 13 can remove the call to foo though.

[Bug tree-optimization/111293] [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-09-05
             Status|UNCONFIRMED                 |NEW

[Bug tree-optimization/111293] [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

--- Comment #2 from Andrew Macleod <amacleod at redhat dot com> ---
It seems like we set 'e' to 3 immediately at the start:
  <bb 2> [local count: 1073741824]:
  e = 3;
  goto <bb 10>; [100.00%]

and it is never changed again. However, when we load from 'e' later in the IL
  <bb 3> [local count: 9485263241]:
  e.1_6 = e;

we simply get varying. Is some pass suppose to propagate this?  This reminds me
of a few other regression PRs where we no longer propagate known values from
loads from memory into ssa-names.

If we knew that e.1_6 was '3', then the call to foo would be folded away as
never executable.

[Bug tree-optimization/111293] [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
                 CC|                            |law at gcc dot gnu.org

[Bug tree-optimization/111293] [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[mikael at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

Mikael Morin <mikael at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mikael at gcc dot gnu.org

--- Comment #3 from Mikael Morin <mikael at gcc dot gnu.org> ---
pre replaces usages of the 'e' global with a set of 'pretmp' and 'prephitmp'
ssa registers.

With gcc-13, the value of 'e' is reloaded directly after the call to 'foo',
and that value is joined with a phi in the next bb:

  <bb 10> [local count: 7761689018]:
  foo ();
  pretmp_25 = e;
  goto <bb 15>; [100.00%]

...

  <bb 15> [local count: 8963573811]:
  # j_28 = PHI <1(10), j_30(24), 1(22), j_30(25), 1(26), j_30(20)>
  # i_29 = PHI <i_20(10), 0(24), i_19(22), 0(25), i_21(26), 0(20)>
  # prephitmp_38 = PHI <pretmp_25(10), prephitmp_26(24), prephitmp_26(22),
prephitmp_26(25), prephitmp_26(26), prephitmp_26(20)>
  d.7_22 = d;
  _23 = d.7_22 + 1;
  d = _23;
  if (_23 != 0)
    goto <bb 27>; [94.50%]
  else
    goto <bb 18>; [5.50%]


With gcc-14, the value of 'e' is reloaded later in the next bb, causing a
dependency on 'e', even on paths not calling 'foo':

  <bb 5> [local count: 7761689018]:
  foo ();
  goto <bb 8>; [100.00%]

...

  <bb 8> [local count: 8963573796]:
  # i_28 = PHI <i_13(5), 0(12), i_13(15)>
  d.7_22 = d;
  _23 = d.7_22 + 1;
  d = _23;
  pretmp_10 = e;
  if (_23 != 0)
    goto <bb 17>; [94.50%]
  else
    goto <bb 11>; [5.50%]


Later on this prevents copyprop from simplifying the 'pretmp' and 'prephitmp'
values to 3 and remove the branch calling 'foo'.

[Bug tree-optimization/111293] [14 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[mikael at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

--- Comment #4 from Mikael Morin <mikael at gcc dot gnu.org> ---
For what's worth adding -fno-tree-vrp "fixes" this and enables removal of the
call to 'foo' with trunk.

Here is a minimal revert of the regressing revision, but it may just make the
problem latent.

diff --git a/gcc/gimple-range-phi.cc b/gcc/gimple-range-phi.cc
index 01900a35b32..9fa9fe83ce0 100644
--- a/gcc/gimple-range-phi.cc
+++ b/gcc/gimple-range-phi.cc
@@ -386,14 +386,6 @@ phi_analyzer::process_phi (gphi *phi)
                  m_work.safe_push (arg);
                  continue;
                }
-             // More than 2 outside names is too complicated.
-             if (m_num_extern >= 2)
-               {
-                 cycle_p = false;
-                 break;
-               }
-             m_external[m_num_extern] = arg;
-             m_ext_edge[m_num_extern++] = gimple_phi_arg_edge (phi_stmt, x);
            }
          else if (code == INTEGER_CST)
            {
@@ -402,12 +394,15 @@ phi_analyzer::process_phi (gphi *phi)
                                wi::to_wide (arg));
              init_range.union_ (val);
            }
-         else
+         // More than 2 outside names/CONST is too complicated.
+         if (m_num_extern >= 2)
            {
-             // Everything else terminates the cycle.
              cycle_p = false;
              break;
            }
+
+         m_external[m_num_extern] = arg;
+         m_ext_edge[m_num_extern++] = gimple_phi_arg_edge (phi_stmt, x);
        }
     }

[Bug tree-optimization/111293] [14/15 Regression] Missed Dead Code Elimination since r14-3414-g0cfc9c953d0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111293

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|14.0                        |14.2

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 14.1 is being released, retargeting bugs to GCC 14.2.