[Bug c/113479] New: Two equivalent programs have inconsistent output results at the same optimization level

[Bug c/113479] New: Two equivalent programs have inconsistent output results at the same optimization level

[jiajing_zheng at 163 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113479

            Bug ID: 113479
           Summary: Two equivalent programs have inconsistent output
                    results at the same optimization level
           Product: gcc
           Version: 12.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jiajing_zheng at 163 dot com
  Target Milestone: ---

I did the fusion equivalent transformation of the two loops in file1.c to get
file2.c.

Here is file1.c:
jing@jing-ubuntu:~/Desktop/file$ cat file1.c

static unsigned int g_a6[34];
static unsigned long g_b6[34];

static unsigned char g_11 = 1;
static char g_49 = 12;
static char g_81 = 3;
static char g_85 = 0;
static char g_87 = 0x3C;
static char g_119 = (-5);
static char *g_temp = &g_49;
static char **g_122 = &g_temp;
static int g_162 = 0x4E934167;
static int *g_184 = &g_162;
static int **g_183 = &g_184;
static char *g_429 = &g_49;

static void func_31(void);
static int func_108(char *p_112);

static void func_31(void) {
  int l_618 = 1;

  g_119 = ((1 ^ g_11) < g_11) && (g_87 & (1 ^ func_108(&g_49)));

  g_429 = &g_81;

  for (g_85 = (-30); (g_85 <= (-7)); g_85 += 7) {
    (*g_183) = &l_618;
    int ii_0;
    int l_619;
    // mutations.fusion in max execTimes
    for (l_619 = 20, ii_0 = 0; (l_619 > 3); l_619 -= 1, ii_0++) {
      g_a6[ii_0] = (**g_122) * l_619 + g_81;
    }
    int jj_0;
    for (jj_0 = 0; jj_0 < 34; jj_0++) {
      g_b6[jj_0] = g_a6[jj_0];
    }
  }
}

static int func_108(char *p_112) {
  unsigned short l_191 = 1;
  int l_190 = l_191;
  g_122 = &p_112;
  return l_190;
}

int main(void) {
  func_31();
  return 0;
}


Here is file2.c
jing@jing-ubuntu:~/Desktop/file$ cat file2.c

static unsigned int g_a6[34];
static unsigned long g_b6[34];

static unsigned char g_11 = 1;
static char g_49 = 12;
static char g_81 = 3;
static char g_85 = 0;
static char g_87 = 0x3C;
static char g_119 = (-5);
static char *g_temp = &g_49;
static char **g_122 = &g_temp;
static int g_162 = 0x4E934167;
static int *g_184 = &g_162;
static int **g_183 = &g_184;
static char *g_429 = &g_49;

static void func_31(void);
static int func_108(char *p_112);

static void func_31(void) {
  int l_618 = 1;

  g_119 = ((1 ^ g_11) < g_11) && (g_87 & (1 ^ func_108(&g_49)));

  g_429 = &g_81;

  for (g_85 = (-30); (g_85 <= (-7)); g_85 += 7) {
    (*g_183) = &l_618;
    int l_619;
    int ii_0;
    int jj_0;
    int ij_0;
    // mutations.fusion in max execTimes
    for (l_619 = 20, ii_0 = 0, jj_0 = 0, ij_0 = 0; ij_0 <= 34; ij_0++) {
      if (ij_0 <= 17 && (l_619 > 3)) {
        g_a6[ii_0] = (**g_122) * l_619 + g_81;
        l_619 -= 1;
        ii_0++;
      }
      if (ij_0 <= 34 && jj_0 < 34) {
        g_b6[jj_0] = g_a6[jj_0];
        jj_0++;
      }
    }
  }
}

static int func_108(char *p_112) {
  unsigned short l_191 = 1;
  int l_190 = l_191;
  g_122 = &p_112;
  return l_190;
}

int main(void) {
  func_31();
  return 0;
}


I check the -O0, -O1, -O2, -O3, -Os optimization levels of these two files, and
the output showed that they did not seem to have undefined and address
problems.

Here is the command line:
gcc <optimization level> -fsanitize=undefined,address <filename.c> && ./a.out

However, when I compiled and ran the two files with these optimization levels,
the output was inconsistent. 

Here are the command line and output:

jing@jing-ubuntu:~/Desktop/file$ gcc file1.c -O0 && ./a.out
jing@jing-ubuntu:~/Desktop/file$ gcc file2.c -O0 && ./a.out
jing@jing-ubuntu:~/Desktop/file$ gcc file1.c -O1 && ./a.out
Segmentation fault (core dumped)
jing@jing-ubuntu:~/Desktop/file$ gcc file2.c -O1 && ./a.out
jing@jing-ubuntu:~/Desktop/file$ gcc file1.c -O2 && ./a.out
Segmentation fault (core dumped)
jing@jing-ubuntu:~/Desktop/file$ gcc file2.c -O2 && ./a.out
Segmentation fault (core dumped)
jing@jing-ubuntu:~/Desktop/file$ gcc file1.c -O3 && ./a.out
jing@jing-ubuntu:~/Desktop/file$ gcc file2.c -O3 && ./a.out
jing@jing-ubuntu:~/Desktop/file$ gcc file1.c -Os && ./a.out
Segmentation fault (core dumped)
jing@jing-ubuntu:~/Desktop/file$ gcc file2.c -Os && ./a.out
Segmentation fault (core dumped)

First, I want to know why the output results of the two files are inconsistent
at the -O1 optimization level, that is, file2.c has Segmentation fault while
file1.c does not.

Besides, I also want to know why the output of the same file is inconsistent
under different optimization levels. For example, file1.c does not have
Segmentation fault under -O0 and -O3 levels, while it does under -O1,-O2, and
-O3 levels.


Here is the information of GCC:
jing@jing-ubuntu:~$ gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/home/jing/gcc-12.2.0/usr/local/bin/../libexec/gcc/x86_64-pc-linux-gnu/12.2.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure -enable-checking=release -enable-languages=c,c++
-disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.2.0 (GCC)

[Bug tree-optimization/113479] Two equivalent programs have inconsistent output results at the same optimization level

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113479

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |tree-optimization

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC doesn't implement loop fusion (but only the reverse, loop distribution)

[Bug tree-optimization/113479] Two equivalent programs have inconsistent output results at the same optimization level

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113479

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
static int func_108(char *p_112) {
  unsigned short l_191 = 1;
  int l_190 = l_191;
  g_122 = &p_112;

this leaks the address of a stack local.