From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 0C6653858D35; Wed, 22 Nov 2023 10:06:30 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 0C6653858D35
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1700647590;
	bh=gIgnFSgD8lBjPvvdINAK5j6voVmlvWLoiQPuaO8LHkA=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=qa7Xe4VuiXNRSJ8PubVJ82tGH5zTWZqHmCM/AdjoB8UNewaTL5crlyMBuCOBdu1DD
	 vbyIoT3/m3HKhXwEnmMBDM4Zw0PBV6VdpA5e0NpH6Zxevht5rn06NYIrL7JcSZ75vX
	 AOHRgjMPq/T6M/Y2jNItMhDgZw6LT91wIV/to0P0=
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/112344] [14 Regression] Wrong code at -O2 on
 x86_64-pc-linux-gnu
Date: Wed, 22 Nov 2023 10:06:28 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 14.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P1
X-Bugzilla-Assigned-To: rguenth at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 14.0
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-112344-4-1JwTRJSIO1@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-112344-4@http.gcc.gnu.org/bugzilla/>
References: <bug-112344-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D112344

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
In particular the final jump is miscalculated somehow, possibly path-ranger
mishandles the situation.  For the loop header we thread through we
first clear dependent ranges (good) but then do compute_ranges_in_phis
(weird, we know the incoming edge?), doing

      Value_Range r (TREE_TYPE (name));
      if (range_defined_in_block (r, name, bb))
        m_cache.set_range (name, r);

where this ends up calling ssa_range_in_phi, resulting in

[irange] int [1, 1]$69 =3D void


Hmm, so we have

_41 : [irange] int [1073741833, 1073741833]
_42 : [irange] int [+INF, +INF]

and

    <bb 4> [local count: 105119324]:
    _37 =3D e_1 + 2;=20
    _38 =3D (unsigned int) e_1;
    _39 =3D 19 - _38;
    _40 =3D _39 / 2;
    _41 =3D (int) _40;
    _42 =3D _41 * 2;

so it's the e_9 replacement that is wrong.

This is chrec_apply, applying the unsigned number of iterations (19 - (unsi=
gned
int) e_31) / 2 to the signed chrec {e_31 + 2, +, 2}_2.  This isn't without
overflow when computing the overall increment from INT_MIN to 19 since that
positive number cannot be represented in a signed integer type.=