[Bug tree-optimization/111408] New: [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[Bug tree-optimization/111408] New: [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

            Bug ID: 111408
           Summary: [14 Regression] Wrong code at -O2/3 on
                    x86_64-linux-gnu since r14-2866-ge68a31549d9
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
  Target Milestone: ---

gcc at -O2/s produced the wrong code.

Bisected to r14-2866-ge68a31549d9

Compiler explorer: https://godbolt.org/z/secjqP8ao

$ cat a.c
int printf(const char *, ...);
int a, b, c, d;
short e;
int f() {
  c = a % (sizeof(int) * 8);
  if (b & 1 << c)
    return -1;
  return 0;
}
int main() {
  for (; e != 1; e++) {
    int g = f();
    if (g + d - 9 + d)
      continue;
    for (;;)
      __builtin_abort();
  }
}
$
$ gcc -O0 a.c && ./a.out
$
$ gcc -O2 a.c && ./a.out
[2]    1281121 abort      ./a.out
$

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0
             Target|                            |x86_64-linux-nug
           Keywords|                            |wrong-code
          Component|tree-optimization           |target

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-09-13
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
GCC 13.2:
        sarl    %cl, %eax
        movl    d(%rip), %ecx
        andl    $1, %eax
        andl    $31, %edx
        leal    -9(%rcx,%rcx), %ecx
        cmpl    %eax, %ecx

While the trunk:
        movl    a(%rip), %eax
        movl    b(%rip), %ecx
        movl    %eax, %edx
        andl    $31, %edx
        btl     %eax, %ecx

The trunk somehow missed the whole 2*d - 9 part ...

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Last reconfirmed|2023-09-13 00:00:00         |2023-10-17

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Re-confirmed.

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 56680
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56680&action=edit
gcc14-pr111408.patch

Untested fix.  That said, I think at least latently this bug exists all the way
to r0-87899-g88b9490b3361c8e7a901134936cd5013abc85158 - unfortunately the md
file readers don't complain if a binary match_operator doesn't have two
operands in the syntax.  I've quickly skimmed all of i386.md match_operator
uses and didn't spot other bugs (extract_operator uses 3 arguments in all
cases, all others after this patch use 2 arguments).

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:9866c98e1015d98b8fc346d7cf73a0070cce5f69

commit r14-5841-g9866c98e1015d98b8fc346d7cf73a0070cce5f69
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Nov 25 10:31:55 2023 +0100

    i386: Fix up *jcc_bt*_mask{,_1} [PR111408]

    The following testcase is miscompiled in GCC 14 because the
    *jcc_bt<mode>_mask and *jcc_bt<SWI48:mode>_mask_1 patterns have just
    one argument in (match_operator 0 "bt_comparison_operator" [...])
    but as bt_comparison_operator is eq,ne, we need two.
    The md readers don't warn about it, after all, some checks can
    be done in the predicate rather than specified explicitly, and the
    behavior is that anything is accepted as the second argument.

    I went through all other i386.md match_operator uses and all others
    looked right (extract_operator using 3 operands, all others 2).

    I think we'll want to fix this at different spots in older releases
    because I think the bug was introduced already in 2008, though most
    likely just latent.

    2023-11-25  Jakub Jelinek  <jakub@redhat.com>

            PR target/111408
            * config/i386/i386.md (*jcc_bt<mode>_mask,
            *jcc_bt<SWI48:mode>_mask_1): Add (const_int 0) as expected
            second operand of bt_comparison_operator.

            * gcc.c-torture/execute/pr111408.c: New test.

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed, eventhough backports are planned (but just for latent issue).

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:0dd097f6a0951c386233fc0b96584ebe4144ea65

commit r13-8122-g0dd097f6a0951c386233fc0b96584ebe4144ea65
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Nov 25 10:31:55 2023 +0100

    i386: Fix up *jcc_bt*_mask{,_1} [PR111408]

    The following testcase is miscompiled in GCC 14 because the
    *jcc_bt<mode>_mask and *jcc_bt<SWI48:mode>_mask_1 patterns have just
    one argument in (match_operator 0 "bt_comparison_operator" [...])
    but as bt_comparison_operator is eq,ne, we need two.
    The md readers don't warn about it, after all, some checks can
    be done in the predicate rather than specified explicitly, and the
    behavior is that anything is accepted as the second argument.

    I went through all other i386.md match_operator uses and all others
    looked right (extract_operator using 3 operands, all others 2).

    I think we'll want to fix this at different spots in older releases
    because I think the bug was introduced already in 2008, though most
    likely just latent.

    2023-11-25  Jakub Jelinek  <jakub@redhat.com>

            PR target/111408
            * config/i386/i386.md (*jcc_bt<mode>_mask,
            *jcc_bt<mode>_mask_1): Add (const_int 0) as expected
            second operand of bt_comparison_operator.

            * gcc.c-torture/execute/pr111408.c: New test.

    (cherry picked from commit 9866c98e1015d98b8fc346d7cf73a0070cce5f69)

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

--- Comment #8 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:9cb9cecdb582b44b04e9c49532ddf0065b5c3612

commit r12-10050-g9cb9cecdb582b44b04e9c49532ddf0065b5c3612
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Nov 25 10:31:55 2023 +0100

    i386: Fix up *jcc_bt*_mask{,_1} [PR111408]

    The following testcase is miscompiled in GCC 14 because the
    *jcc_bt<mode>_mask and *jcc_bt<SWI48:mode>_mask_1 patterns have just
    one argument in (match_operator 0 "bt_comparison_operator" [...])
    but as bt_comparison_operator is eq,ne, we need two.
    The md readers don't warn about it, after all, some checks can
    be done in the predicate rather than specified explicitly, and the
    behavior is that anything is accepted as the second argument.

    I went through all other i386.md match_operator uses and all others
    looked right (extract_operator using 3 operands, all others 2).

    I think we'll want to fix this at different spots in older releases
    because I think the bug was introduced already in 2008, though most
    likely just latent.

    2023-11-25  Jakub Jelinek  <jakub@redhat.com>

            PR target/111408
            * config/i386/i386.md (*jcc_bt<mode>_mask): Add (const_int 0) as
            expected second operand of bt_comparison_operator.

            * gcc.c-torture/execute/pr111408.c: New test.

    (cherry picked from commit 9866c98e1015d98b8fc346d7cf73a0070cce5f69)

[Bug target/111408] [14 Regression] Wrong code at -O2/3 on x86_64-linux-gnu since r14-2866-ge68a31549d9

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111408

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:1fdae54453d115d73d5a4bfa0257e88000ab18b8

commit r11-11150-g1fdae54453d115d73d5a4bfa0257e88000ab18b8
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Nov 25 10:31:55 2023 +0100

    i386: Fix up *jcc_bt*_mask{,_1} [PR111408]

    The following testcase is miscompiled in GCC 14 because the
    *jcc_bt<mode>_mask and *jcc_bt<SWI48:mode>_mask_1 patterns have just
    one argument in (match_operator 0 "bt_comparison_operator" [...])
    but as bt_comparison_operator is eq,ne, we need two.
    The md readers don't warn about it, after all, some checks can
    be done in the predicate rather than specified explicitly, and the
    behavior is that anything is accepted as the second argument.

    I went through all other i386.md match_operator uses and all others
    looked right (extract_operator using 3 operands, all others 2).

    I think we'll want to fix this at different spots in older releases
    because I think the bug was introduced already in 2008, though most
    likely just latent.

    2023-11-25  Jakub Jelinek  <jakub@redhat.com>

            PR target/111408
            * config/i386/i386.md (*jcc_bt<mode>_mask): Add (const_int 0) as
            expected second operand of bt_comparison_operator.

            * gcc.c-torture/execute/pr111408.c: New test.

    (cherry picked from commit 9866c98e1015d98b8fc346d7cf73a0070cce5f69)