[Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0

[Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839

            Bug ID: 111839
           Summary: Wrong code at -O3 on x86_64-linux-gnu since
                    r12-2097-g9f34b780b0
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---

gcc at -O3 produced the wrong code.

Bisected to r12-2097-g9f34b780b0

Compiler explorer: https://godbolt.org/z/Ea1hGGnob

$ cat a.c
int printf(const char *, ...);
long a;
int b, c, e, g, i;
long *d, *h;
char f = -26;
int main() {
  long j;
  c = 0;
  for (; c != 7; ++c) {
    long k=0;
    long l = k;
    long **m = &d;
    for (; f + i!=0; i++)
      h = &l;
    g = h != (*m = &j);
    int *n = &b;
    *n = g;
    for (; e;)
      for (; a; a = a + 1)
        ;
  }
  printf("%d\n", b);
}
$
$ gcc -fsanitize=address,undefined a.c && ./a.out
1
$ gcc -O3 a.c && ./a.out
0
$

[Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Wrong code at -O3 on        |[12/13/14 Regression] Wrong
                   |x86_64-linux-gnu since      |code at -O3 on
                   |r12-2097-g9f34b780b0        |x86_64-linux-gnu since
                   |                            |r12-2097-g9f34b780b0
   Target Milestone|---                         |12.4

[Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2023-10-17
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Partition 1: size 8 align 8
        l       j

So another -fstack-reuse= issue.

[Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly cleaned up.
long a, *d, *h;
int b, c, e, g, i;
signed char f = -26;

int
main ()
{
  long j;
  for (c = 0; c != 7; ++c)
    {
      long k = 0;
      long l = k;
      long **m = &d;
      for (; f + i != 0; i++)
        h = &l;
      g = h != (*m = &j);
      int *n = &b;
      *n = g;
      while (e)
        while (a)
          ++a;
    }
  if (b != 1)
    __builtin_abort ();
}

I'd say this is just invalid code.
In the c == 0 iteration, h is set to address of l, local in the loop (many
times).
But when that l var goes out of the scope at the end of the iteration, the h
pointer pointing to it becomes invalid, it doesn't point to any valid object.
In the c == 1 iteration, it isn't reinitialized, so I think using it for the
comparison is UB.
ASan use-after-scope can't catch such sort of thing, it can catch stuff when
such pointer is dereferenced, but that is not the case here.  Plus, when l
starts lifetime in the c == 1 and later iterations, it would be unpoisoned
again and nothing would be reported even if it was dereferenced.

This is essentially
int *p;

int
main ()
{
  for (int i = 0; i < 10; ++i)
    {
      int l = 0;
      if (i == 0)
        p = &l;
      *p = 42;
    }
}
which isn't reported with -fsanitize=address -fsanitize-address-use-after-scope
-g
by either gcc or clang, yet is clearly undefined behavior.  The earlier
testcase
doesn't dereference but IMHO has the same problem.