[Bug tree-optimization/111445] New: Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[Bug tree-optimization/111445] New: Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

            Bug ID: 111445
           Summary: Wrong code at -Os on x86_64-linux-gnu since
                    r12-1077-g57bf3751511
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
                CC: aldyh at redhat dot com
  Target Milestone: ---

gcc at -Os produced the wrong code

Bisected to r12-1077-g57bf3751511

Compiler explorer: https://godbolt.org/z/1Ej5jxYPa

$ cat a.c
int printf(const char *, ...);
short a, b;
unsigned char c = 255;
int main() {
  int d;
  unsigned char e;
  d = 0;
  for (; a >= 0; a--) {
    int *f = &d;
    *f = c;
  }
  e = 0;
  for (; (unsigned char)(d - 255) + e <= 1; e++)
    printf("%d\n", b);
}
$
$ gcc -O0 a.c && ./a.out
0
0
$ gcc -Os a.c && ./a.out
$

[Bug tree-optimization/111445] [12/13/14 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Wrong code at -Os on        |[12/13/14 Regression] Wrong
                   |x86_64-linux-gnu since      |code at -Os on
                   |r12-1077-g57bf3751511       |x86_64-linux-gnu since
                   |                            |r12-1077-g57bf3751511
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-09-17
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |12.4

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. Though I think r12-1077-g57bf3751511 just exposed the issue.
-fno-ivopts causes the bug to go away. So does -fwrapv . So I suspect IV-OPTS
is introducing some signed integer overflow for this ...

[Bug tree-optimization/111445] [12/13/14 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Maybe related to PR110243.

[Bug tree-optimization/111445] [12/13/14 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
For the testsuite, not fixed by the fix for PR110243:

/* { dg-do run } */

extern void abort (void);
short a, b;
unsigned char c = 255;
unsigned cnt;
void __attribute__((noipa))
check (int x)
{
  if (x != 0)
    abort ();
  cnt++;
}
int main() 
{ 
  int d;
  unsigned char e;
  d = 0; 
  for (; a >= 0; a--) {
    int *f = &d;
    *f = c;
  } 
  e = 0; 
  for (; (unsigned char)(d - 255) + e <= 1; e++)
    check (b);
  if (cnt != 2)
    abort ();
  return 0;
}

[Bug tree-optimization/111445] [12/13/14 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
-Os -fallow-store-data-races -fdisable-tree-sccp -fno-tree-loop-im

makes the case simpler to look at, IVOPTs only mangles the last loop there:

Analyzing # of iterations of loop 2
  exit condition [d_26 + 1, + , 1](no_overflow) <= 1
  bounds on difference of bases: -255 ... 0
  result:
    zero if d_26 > 1
    # of iterations 1 - (unsigned int) d_26, bounded by 1
  number of iterations 1 - (unsigned int) d_26; zero if d_26 > 1
..
Selected IV set for loop 2 at t.c:22, 2 avg niters, 1 IVs:
Candidate 10:
  Var befor: ivtmp.26_28
  Var after: ivtmp.26_29
  Incr POS: at end
  IV struct:
    Type:       unsigned int
    Base:       (unsigned int) (d_26 + 1)
    Step:       1
    Biv:        N
    Overflowness wrto loop niter:       No-overflow

changing

+  _31 = d_26 + 1;
+  ivtmp.26_30 = (unsigned int) _31;
   goto <bb 6>; [100.00%]

   <bb 5> [local count: 118111600]:
   b.6_7 = b;
   _8 = (int) b.6_7;
   check (_8);
-  e_21 = e_15 + 1;
+  ivtmp.26_29 = ivtmp.26_28 + 1;

   <bb 6> [local count: 236223200]:
-  # e_15 = PHI <0(10), e_21(5)>
+  # ivtmp.26_28 = PHI <ivtmp.26_30(10), ivtmp.26_29(5)>
   _9 = (unsigned char) d_26;
   _10 = _9 + 1;
   _11 = (int) _10;
-  _12 = (int) e_15;
-  _13 = _11 + _12;
-  if (_13 <= 1)
+  _32 = (int) ivtmp.26_28;
+  if (_32 <= 1)
     goto <bb 5>; [50.00%]
   else
     goto <bb 7>; [50.00%]

[Bug tree-optimization/111445] [12/13/14 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
And I think its a SCEV/tree-affine issue.  We have

  <bb 6> [local count: 236223200]:
  # e_15 = PHI <0(10), e_21(5)>
  _9 = (unsigned char) d_26;
  _10 = _9 + 1;
  _11 = (int) _10;
  _12 = (int) e_15;
  _13 = _11 + _12;
  if (_13 <= 1)
    goto <bb 5>; [50.00%]
  else
    goto <bb 7>; [50.00%]

  <bb 5> [local count: 118111600]:
  b.6_7 = b;
  _8 = (int) b.6_7;
  check (_8);
  e_21 = e_15 + 1;
  goto <bb 6>;

(get_scalar_evolution
  (scalar = e_15)
  (scalar_evolution = {0, +, 1}_2))

that's OK if the niter bound is correct

(get_scalar_evolution
  (scalar = _12)
  (scalar_evolution = {0, +, 1}_2))

likewise

(get_scalar_evolution
  (scalar = _13)
  (scalar_evolution = {(int) ((unsigned char) d_26 + 1), +, 1}_2))

also OK.  But from that we get

IV struct:
  SSA_NAME:     _13
  Type: int
  Base: d_26 + 1
  Step: 1
  Biv:  N
  Overflowness wrto loop niter: No-overflow

That's because simple_iv_with_niters does, getting the correct iv->base
(int) ((unsigned char) d_26 + 1)

  /* Try to simplify iv base:

       (signed T) ((unsigned T)base + step) ;; TREE_TYPE (base) == signed T
         == (signed T)(unsigned T)base + step
         == base + step

     If we can prove operation (base + step) doesn't overflow or underflow.
     Specifically, we try to prove below conditions are satisfied: 

             base <= UPPER_BOUND (type) - step  ;;step > 0
             base >= LOWER_BOUND (type) - step  ;;step < 0

     This is done by proving the reverse conditions are false using loop's
     initial conditions.

     The is necessary to make loop niter, or iv overflow analysis easier
     for below example:

       int foo (int *a, signed char s, signed char l)
         {
           signed char i;
           for (i = s; i < l; i++)
             a[i] = 0;
           return 0;
          }

     Note variable I is firstly converted to type unsigned char, incremented,
     then converted back to type signed char.  */

where we end up querying

  d_26 > 2147483646

but the comment also doesn't match us skipping a narrowing conversion here
(besides failing to use the limit based on the narrowed type).

[Bug tree-optimization/111445] [12/13/14 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:9692309ed6b625f0fb358c0e230404b5603f69a6

commit r14-4790-g9692309ed6b625f0fb358c0e230404b5603f69a6
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 20 15:08:49 2023 +0200

    tree-optimization/111445 - simple_iv simplification fault

    The following fixes a missed check in the simple_iv attempt
    to simplify (signed T)((unsigned T) base + step) where it
    allows a truncating inner conversion leading to wrong code.

            PR tree-optimization/111445
            * tree-scalar-evolution.cc (simple_iv_with_niters):
            Add missing check for a sign-conversion.

            * gcc.dg/torture/pr111445.c: New testcase.

[Bug tree-optimization/111445] [12/13 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |14.0
           Priority|P3                          |P2
            Summary|[12/13/14 Regression] Wrong |[12/13 Regression] Wrong
                   |code at -Os on              |code at -Os on
                   |x86_64-linux-gnu since      |x86_64-linux-gnu since
                   |r12-1077-g57bf3751511       |r12-1077-g57bf3751511

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/111445] [12/13 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:bd7800a3a73fa07b4688c75edcaaaf923802f020

commit r13-8038-gbd7800a3a73fa07b4688c75edcaaaf923802f020
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 20 15:08:49 2023 +0200

    tree-optimization/111445 - simple_iv simplification fault

    The following fixes a missed check in the simple_iv attempt
    to simplify (signed T)((unsigned T) base + step) where it
    allows a truncating inner conversion leading to wrong code.

            PR tree-optimization/111445
            * tree-scalar-evolution.cc (simple_iv_with_niters):
            Add missing check for a sign-conversion.

            * gcc.dg/torture/pr111445.c: New testcase.

    (cherry picked from commit 9692309ed6b625f0fb358c0e230404b5603f69a6)

[Bug tree-optimization/111445] [12 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
*** Bug 111572 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/111445] [12 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

--- Comment #10 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:948c4616e504b656278cd47f8b96ad3fb47db626

commit r12-10011-g948c4616e504b656278cd47f8b96ad3fb47db626
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 20 15:08:49 2023 +0200

    tree-optimization/111445 - simple_iv simplification fault

    The following fixes a missed check in the simple_iv attempt
    to simplify (signed T)((unsigned T) base + step) where it
    allows a truncating inner conversion leading to wrong code.

            PR tree-optimization/111445
            * tree-scalar-evolution.cc (simple_iv_with_niters):
            Add missing check for a sign-conversion.

            * gcc.dg/torture/pr111445.c: New testcase.

    (cherry picked from commit 9692309ed6b625f0fb358c0e230404b5603f69a6)

[Bug tree-optimization/111445] [12 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |12.3.1
      Known to fail|                            |12.3.0
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/111445] [12 Regression] Wrong code at -Os on x86_64-linux-gnu since r12-1077-g57bf3751511

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111445

--- Comment #12 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ce653fa683643d4e5a7146181954358f1060dfed

commit r11-11526-gce653fa683643d4e5a7146181954358f1060dfed
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 20 15:08:49 2023 +0200

    tree-optimization/111445 - simple_iv simplification fault

    The following fixes a missed check in the simple_iv attempt
    to simplify (signed T)((unsigned T) base + step) where it
    allows a truncating inner conversion leading to wrong code.

            PR tree-optimization/111445
            * tree-scalar-evolution.c (simple_iv_with_niters):
            Add missing check for a sign-conversion.

            * gcc.dg/torture/pr111445.c: New testcase.

    (cherry picked from commit 9692309ed6b625f0fb358c0e230404b5603f69a6)