[Bug tree-optimization/113676] New: Miscompilation tree-vrp __builtin_unreachable

[Bug tree-optimization/113676] New: Miscompilation tree-vrp __builtin_unreachable

[magnus.hegdahl at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113676

            Bug ID: 113676
           Summary: Miscompilation tree-vrp __builtin_unreachable
           Product: gcc
           Version: 12.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: magnus.hegdahl at gmail dot com
  Target Milestone: ---

Compiling the following code with -O1 -ftree-vrp or higher on GCC 10 or 12
results in a program that segfaults when argc >= 2.

#include <bit>
#include <vector>

auto main(int argc, char **) -> int {
    auto rounded_n = std::bit_ceil(static_cast<unsigned>(argc));
    auto a = std::vector<int>(2UL * rounded_n);

    for (std::size_t i = rounded_n; i-- > 1;) {
        if (!(0 < i && i < rounded_n)) __builtin_unreachable();
        a[i] = 0;
    }
}

If __builtin_unreachable is replaced by for example __builtin_trap, there is no
bug.
I could not reproduce this in GCC 11 or 13.

https://godbolt.org/z/dvEWKzWTh

Disassembly of the loop body:
.L6:
        mov     DWORD PTR [rdi+rdx*4], 0
        sub     rdx, 1
        jmp     .L6

[Bug tree-optimization/113676] [11/12 Regression] Miscompilation tree-vrp __builtin_unreachable

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113676

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.4
           Keywords|                            |needs-bisection
            Summary|Miscompilation tree-vrp     |[11/12 Regression]
                   |__builtin_unreachable       |Miscompilation tree-vrp
                   |                            |__builtin_unreachable

[Bug tree-optimization/113676] [12 Regression] Miscompilation tree-vrp __builtin_unreachable

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113676

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |x86_64-*-*
            Summary|[11/12 Regression]          |[12 Regression]
                   |Miscompilation tree-vrp     |Miscompilation tree-vrp
                   |__builtin_unreachable       |__builtin_unreachable

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Needs -std=c++20.  I can't reproduce locally.

[Bug tree-optimization/113676] [12 Regression] Miscompilation tree-vrp __builtin_unreachable

[magnus.hegdahl at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113676

--- Comment #2 from Magnus Hokland Hegdahl <magnus.hegdahl at gmail dot com> ---
Hi, here's a version that doesn't need -std=c++20 or argv:

https://godbolt.org/z/Y9ooY998e

#include <vector>

constexpr auto bit_ceil(unsigned x) -> unsigned {
    if (x <= 1) return 1U;
    int w = 32 - __builtin_clz(x - 1);
    return 1U << w;
}

int main(int argc, char **) {
    auto rounded_n = bit_ceil(static_cast<unsigned>(argc + 1));
    auto a = std::vector<int>(2UL * rounded_n);

    for (std::size_t i = rounded_n; i-- > 1;) {
        if (!(0 < i && i < rounded_n)) __builtin_unreachable();
        a[i] = 0;
    }
}

Exact compile command used with g++-12 (GCC) 12.3.0 on arch linux, x86_64:
g++-12 -O1 -ftree-vrp main.cpp

[Bug tree-optimization/113676] [12 Regression] Miscompilation tree-vrp __builtin_unreachable

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113676

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |jakub at gcc dot gnu.org
           Keywords|needs-bisection             |

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Bisection with -O2 -ftree-vrp
#include <vector>

unsigned
bit_ceil (unsigned x)
{
  if (x <= 1)
    return 1U;
  int w = 32 - __builtin_clz (x - 1);
  return 1U << w;
}

int
main (int argc, char **)
{
  unsigned rounded_n = bit_ceil ((unsigned) (argc + 1));
  auto a = std::vector<int> (2UL * rounded_n);
  for (long unsigned int i = rounded_n; i-- > 1;)
    {
      if (!(0 < i && i < rounded_n))
        __builtin_unreachable();
      a[i] = 0;
    }
}
shows this started with r12-155-gd8e1f1d24179690fd9c0f63c27b12e030010d9ea
and went away with r13-3596-ge7310e24b1c0ca67b1bb507c1330b2bf39e59e32
so nothing really backportable.

[Bug tree-optimization/113676] [12 Regression] Miscompilation tree-vrp __builtin_unreachable

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113676

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
And with --param=vrp1-mode=vrp it segfaulted even with
r13-4276-gce917b0422c145779b83e005afd8433c0c86fb06 but the next revision
removed that parameter, so can't go further.