[Bug tree-optimization/111668] New: vrp2 introduces invalid wide Boolean values

[Bug tree-optimization/111668] New: vrp2 introduces invalid wide Boolean values

[kristerw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

            Bug ID: 111668
           Summary: vrp2 introduces invalid wide Boolean values
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kristerw at gcc dot gnu.org
  Target Milestone: ---

The vrp2 pass introduces an invalid wide Boolean when compiling the function

  int *a, b, c, d;
  void
  foo (void)
  {
    for (; d <= 0; d++)
      b &= ((a || d) ^ c) == 1;
  }

What is happening is that vrp2 changes the IR

  _Bool _16;
  <signed-boolean:32> _66;

  gimple_assign <cond_expr, _66, _16, -1, 0>

to the incorrect

  _Bool _16;
  <signed-boolean:32> _38;
  <signed-boolean:32> _66;

  gimple_assign <nop_expr, _38, _16, NULL, NULL>
  gimple_assign <negate_expr, _66, _38, NULL, NULL>

[Bug tree-optimization/111668] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|vrp2 introduces invalid     |vrp2 (match and simplify)
                   |wide Boolean values         |introduces invalid wide
                   |                            |signed Boolean values
   Last reconfirmed|                            |2023-10-02
             Status|UNCONFIRMED                 |NEW
                 CC|                            |jakub at gcc dot gnu.org
     Ever confirmed|0                           |1
           Keywords|                            |wrong-code

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This was broken by r14-4125-g5c5851bd93b8 .


Before VRP:
```
  # RANGE [irange] <signed-boolean:32> [-1, 0]
  _66 = _16 ? -1 : 0;
  vect_cst__67 = {_66, _66, _66, _66};
```

VRP2 dump:
```
Folding statement: _66 = _16 ? -1 : 0;
Applying pattern match.pd:5115, gimple-match-2.cc:16882
gimple_simplified to _38 = (<signed-boolean:32>) _16;
_66 = -_38;
```

This is was the reasoning for the build_nonstandard_integer_type there. 


With r14-4125-g5c5851bd93b8 reverted:
```
Folding statement: _66 = _16 ? -1 : 0;
Applying pattern match.pd:5118, gimple-match-1.cc:16933
gimple_simplified to _38 = (signed int) _16;
_43 = -_38;
_66 = (<signed-boolean:32>) _43;
Global Exported: _66 = [irange] <signed-boolean:32> [-1, 0]
Folded into: _66 = (<signed-boolean:32>) _43;
```


Note the testcase needs to compiled at -O3 on x86_64.

[Bug tree-optimization/111668] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=110487

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #1)
> This was broken by r14-4125-g5c5851bd93b8 .

Basically that reintroduced PR 110487 .

[Bug tree-optimization/111668] [12/13/14 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0
            Summary|vrp2 (match and simplify)   |[12/13/14 Regression]  vrp2
                   |introduces invalid wide     |(match and simplify)
                   |signed Boolean values       |introduces invalid wide
                   |                            |signed Boolean values

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Since PR 110487  is a regression, this is a regression.

[Bug tree-optimization/111668] [12/13/14 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
So, for the a ? -1 : 0 case (and similarly for a ? 0 : -1) we have 3 distinct
cases.
One is signed 1-bit precision type, for which we jump through the unnecessary
hops of
trying to optimize e.g. the first one as (lshift (convert:type
(convert:boolean_type_node @0) { integer_zero_node; }) and then optimizing away
the shift.  Then the signed boolean case of larger precision, where we can
choose what
exactly we want it to simplify to, one is the negation in signed integer type
of the same precision and another one would be to cast to signed boolean type
rather than unsigned.  And finally the case where both 1 and -1 are valid,
where we should use the negation.
If we go the negation route for the second subcase, that is the only case where
we need build_nonstandard_integer_type.  If we go with the casts, we don't need
it anywhere.

[Bug tree-optimization/111668] [12/13/14 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 56033
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56033&action=edit
gcc14-pr111668.patch

Untested fix which avoids jumping through << 0 and uses the negations for the
larger precision signed boolean cases.

[Bug tree-optimization/111668] [12/13/14 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:7ab01269396203d5200fff8579768da54dcfde5d

commit r14-4391-g7ab01269396203d5200fff8579768da54dcfde5d
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Oct 4 09:27:40 2023 +0200

    match.pd: Fix up a ? cst1 : cst2 regression on signed bool [PR111668]

    My relatively recent changes to these simplifiers to avoid
    doing build_nonstandard_integer_type (primarily for BITINT_TYPE)
    broke PR111668, a recurrence of the PR110487 bug.
    I thought the build_nonstandard_integer_type isn't ever needed there,
    but there is one special case where it is.
    For the a ? -1 : 0 and a ? 0 : -1 simplifications there are actually
    3 different cases.  One is for signed 1-bit precision types (signed
    kind of implied from integer_all_onesp, because otherwise it would
    match integer_onep earlier), where the simplifier wierdly was matching
    them using the a ? powerof2cst : 0 -> a << (log2(powerof2cst))
    simplification and then another simplifier optimizing away the left shift
    when log2(powerof2cst) was 0.  Another one is signed BOOLEAN_TYPE with
    precision > 1, where indeed we shouldn't be doing the negation in type,
    because it isn't well defined in that type, the type only has 2 valid
    values, 0 and -1.  As an alternative, we could also e.g. cast to
    signed 1-bit precision BOOLEAN_TYPE and then extend to type.
    And the last case is what we were doing for types which have both 1 and -1
    (all all ones) as valid values (i.e. all signed/unsigned ENUMERAL_TYPEs,
    INTEGRAL_TYPEs and BITINT_TYPEs with precision > 1).

    The following patch avoids the hops through << 0 for 1-bit precision
    and uses build_nonstandard_integer_type solely for the BOOLEAN_TYPE types
    (where we have a guarantee the precision is reasonably small, nothing ought
    to be created 129+ bit precision BOOLEAN_TYPEs).

    2023-10-04  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/111668
            * match.pd (a ? CST1 : CST2): Handle the a ? -1 : 0 and
            a ? 0 : -1 cases before the powerof2cst cases and differentiate
            between 1-bit precision types, larger precision boolean types
            and other integral types.  Fix comment pastos and formatting.

[Bug tree-optimization/111668] [12/13 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 Regression]  vrp2 |[12/13 Regression]  vrp2
                   |(match and simplify)        |(match and simplify)
                   |introduces invalid wide     |introduces invalid wide
                   |signed Boolean values       |signed Boolean values

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk.  No idea about 12/13, I think the problem there is in
phiopt instead and we don't really have a reproducer.

[Bug tree-optimization/111668] [12/13 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |14.0
   Target Milestone|14.0                        |12.4

[Bug tree-optimization/111668] [12/13 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[kristerw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

--- Comment #8 from Krister Walfridsson <kristerw at gcc dot gnu.org> ---
I still see negation of a wide signed Boolean in the IR for this function. But
now it is forwprop4 that changes

  _38 = (signed int) _16;
  _43 = -_38;
  _66 = (<signed-boolean:32>) _43;

to

  _56 = (<signed-boolean:32>) _16;
  _66 = -_56;

[Bug tree-optimization/111668] [12/13 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[kristerw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

--- Comment #9 from Krister Walfridsson <kristerw at gcc dot gnu.org> ---
I opened PR 112738 for the issue mentioned in comment 8.

[Bug tree-optimization/111668] [12/13 Regression] vrp2 (match and simplify) introduces invalid wide signed Boolean values

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111668

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2