[Bug tree-optimization/111738] New: incorrect code when PGO is enabled

[Bug tree-optimization/111738] New: incorrect code when PGO is enabled

[iamanonymous.cs at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111738

            Bug ID: 111738
           Summary: incorrect code when PGO is enabled
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: iamanonymous.cs at gmail dot com
  Target Milestone: ---

*******************************************************************************
OS and Platform:
$ uname -a:
Linux ubuntu 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023
x86_64 x86_64 x86_64 GNU/Linux
*******************************************************************************
gcc version:
$ gcc -v
Using built-in specs.
COLLECT_GCC=/root/gcc_set/new_gcc/bin/gcc
COLLECT_LTO_WRAPPER=/root/gcc_set/new_gcc/libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc/configure --prefix=/root/gcc_set/new_gcc
--with-gmp=/root/build_essential --with-mpfr=/root/build_essential
--with-mpc=/root/build_essential --enable-languages=c,c++ --disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20230719 (experimental) (GCC)

git version:85da0b40538fb0d17d89de1e7905984668e3dfef
*******************************************************************************
Program:
$ cat a.c
a = 4, b = 0, d = 0, e = 0, f = 0;
**c = &b;
*g = &a;
h() {
  i();
  if (f)
    e = 0;
}
i() {
  float j = 0;
  int **k = &b;
  *k = &j;
  *g |= **c;
  if (*g)
    ;
  else {
    long *l = d = (*l)++;
  }
}
main() {
  h();
  printf("%d\n", a);
}
*******************************************************************************
Command Lines:
# The profile directory is used to save profile information.
$ gcc -O3 -w -fprofile-generate=profile a.c -o a.out
$ ./a.out
4
$ gcc -O3 -w -fprofile-use=profile -Wno-missing-profile -fprofile-correction
a.c  
 -o a.out
$ ./a.out
32764

We can found that, the output of the executable is incorrect when the profile
guided optimization is enabled.

[Bug tree-optimization/111738] incorrect code when PGO is enabled

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111738

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
I can't reproduce.  Your git version is quite old, it translates to
r14-2634-g85da0b40538fb0 for me.  It doesn't reproduce with r14-2282 either
though.

Current is r14-4486-g873586ebc565b6

[Bug tree-optimization/111738] incorrect code when PGO is enabled

[iamanonymous.cs at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111738

--- Comment #2 from Anonymous <iamanonymous.cs at gmail dot com> ---
(In reply to Richard Biener from comment #1)
> I can't reproduce.  Your git version is quite old, it translates to
> r14-2634-g85da0b40538fb0 for me.  It doesn't reproduce with r14-2282 either
> though.
> 
> Current is r14-4486-g873586ebc565b6

Thank you very much for providing the feedback. To ensure the later reported
bugs can be reproduced, we will update our GCC version to the latest trunk.

[Bug tree-optimization/111738] incorrect code when PGO is enabled

[iamanonymous.cs at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111738

--- Comment #3 from Anonymous <iamanonymous.cs at gmail dot com> ---
(In reply to Richard Biener from comment #1)
> I can't reproduce.  Your git version is quite old, it translates to
> r14-2634-g85da0b40538fb0 for me.  It doesn't reproduce with r14-2282 either
> though.
> 
> Current is r14-4486-g873586ebc565b6

Hi, Richard. According to your suggestion, we have updated our gcc to the
latest trunk as:
$ gcc -v
Using built-in specs.
COLLECT_GCC=/root/gcc_set/202310092007/bin/gcc
COLLECT_LTO_WRAPPER=/root/gcc_set/202310092007/libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc/configure --prefix=/root/gcc_set/202310092007
--with-gmp=/root/build_essential --with-mpfr=/root/build_essential
--with-mpc=/root/build_essential --enable-languages=c,c++ --disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20231009 (experimental) (GCC)

git version: dee55cf59ceea989f47e7605205c6644b27a1f78


Then, we compiled the same test program with/without PGO enabled and found that
the results are inconsistent as:
$ gcc -O3 -w -fprofile-generate=profile a.c -o a.out
$ ./a.out
4
$ gcc -O3 -w -fprofile-use=profile -Wno-missing-profile -fprofile-correction
a.c -o a.out
$ ./a.out
32765

[Bug tree-optimization/111738] incorrect code when PGO is enabled

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111738

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
=================================================================
==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000004043e0
at pc 0x0000004012a3 bp 0x7ffd3315e4b0 sp 0x7ffd3315e4a8
WRITE of size 8 at 0x0000004043e0 thread T0
    #0 0x4012a2 in i (/app/output.s+0x4012a2) (BuildId:
4eb338bebafc71b3519003fd1b76487cfb8fb27b)
    #1 0x4011c3 in h (/app/output.s+0x4011c3) (BuildId:
4eb338bebafc71b3519003fd1b76487cfb8fb27b)
    #2 0x40146f in main (/app/output.s+0x40146f) (BuildId:
4eb338bebafc71b3519003fd1b76487cfb8fb27b)
    #3 0x7f28b75e2082 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId:
1878e6b475720c7c51969e69ab2d276fae6d1dee)
    #4 0x4010fd in _start (/app/output.s+0x4010fd) (BuildId:
4eb338bebafc71b3519003fd1b76487cfb8fb27b)

0x0000004043e4 is located 0 bytes after global variable 'b' defined in
'/app/example.cpp:1:8' (0x4043e0) of size 4
SUMMARY: AddressSanitizer: global-buffer-overflow (/app/output.s+0x4012a2)
(BuildId: 4eb338bebafc71b3519003fd1b76487cfb8fb27b) in i
Shadow bytes around the buggy address:
  0x000000404100: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x000000404180: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9
  0x000000404200: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x000000404280: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x000000404300: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
=>0x000000404380: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00[04]f9 f9 f9
  0x000000404400: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
  0x000000404480: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x000000404500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000000404580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x000000404600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1==ABORTING


In this case:
```
**c = &b;
```
...
  int **k = &b;
  *k = &j;
  *g |= **c;
```

Basically once I fixed the size issue (or use -m32) there is profile
difference.