From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 4B4103858D33; Thu,  1 Feb 2024 11:17:01 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 4B4103858D33
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1706786221;
	bh=cCv9baSqow0kgzmW0uEzDIFDW8yErh56wsZBmZShRJE=;
	h=From:To:Subject:Date:From;
	b=y10pgRlTZUUTf1VlDln0pSGepJYXWNxHqAWSZNLwShAPO4jC8FaOCoANj2jirglY1
	 PAfztOKc1NoRsn3l9ZKz18sRXq5tztklmJoRZbA91j7mnw3GZnMB/j546zFZPZijlO
	 JGa8HcRR37dB3IuM+hl2nkQNmjEgwPF9Lq7Hg3k8=
From: "kristerw at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/113703] New: ivopts miscompiles loop
Date: Thu, 01 Feb 2024 11:17:00 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 14.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: kristerw at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-113703-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D113703

            Bug ID: 113703
           Summary: ivopts miscompiles loop
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kristerw at gcc dot gnu.org
  Target Milestone: ---

The following function (gcc.dg/tree-ssa/ivopts-lt.c) is miscompiled when
compiled with with -O1 for X86_64:

#include "stdint.h"

void
f1 (char *p, uintptr_t i, uintptr_t n)
{
  p +=3D i;
  do
    {
      *p =3D '\0';
      p +=3D 1;
      i++;
    }
  while (i < n);
}


The IR after cunroll looks like:

void f1 (char * p, uintptr_t i, uintptr_t n)
{
  <bb 2>:
  p_6 =3D p_4(D) + i_5(D);

  <bb 3>:
  # p_1 =3D PHI <p_6(2), p_9(5)>
  # i_2 =3D PHI <i_5(D)(2), i_10(5)>
  *p_1 =3D 0;
  p_9 =3D p_1 + 1;
  i_10 =3D i_2 + 1;
  if (i_10 < n_11(D))
    goto <bb 5>;
  else
    goto <bb 4>;

  <bb 5>:
  goto <bb 3>;

  <bb 4>:
  return;
}


This is then changed by ivopts to

void f1 (char * p, uintptr_t i, uintptr_t n)
{
  sizetype _13;
  char * _14;

  <bb 2>:
  p_6 =3D p_4(D) + i_5(D);
  _13 =3D n_11(D) - i_5(D);
  _14 =3D p_6 + _13;

  <bb 3>:
  # p_1 =3D PHI <p_6(2), p_9(5)>
  MEM[(char *)p_1] =3D 0;
  p_9 =3D p_1 + 1;
  if (p_9 < _14)
    goto <bb 5>;
  else
    goto <bb 4>;

  <bb 5>:
  goto <bb 3>;

  <bb 4>:
  return;
}


Suppose the function gets called with the values:

  p =3D 0x0002ffffffffffff
  i =3D 0xffff000000000001
  n =3D 0xdffd7fffffffffff

The original function writes 0 to address 0x0002000000000000, and then exit=
s.

The optimized function overflows when calculating _14, and the function does
the equivalent of
  memset(0x0002000000000000, 0, 0xdffe7ffffffffffe);=