[Bug target/114200] New: [14] RISC-V fixed-length vector miscompile at -O3

[Bug target/114200] New: [14] RISC-V fixed-length vector miscompile at -O3

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114200

            Bug ID: 114200
           Summary: [14] RISC-V fixed-length vector miscompile at -O3
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: patrick at rivosinc dot com
  Target Milestone: ---

Testcase:
int printf(const char *, ...);
short a, e = 1;
_Bool b, d;
short c[300];
int main() {
  for (int f = 0; f < 19; f++) {
    for (int g = 0; g < 14; g++)
      for (int h = 0; h < 10; h++)
        a += c[g] + e;
    b += d;
  }
  printf("%d\n", a);
}

Commands:
> /scratch/tc-testing/tc-feb-20/build-rv64gcv/bin/riscv64-unknown-linux-gnu-gcc -march=rv64gcv -O3 --param=riscv-autovec-preference=fixed-vlmax red.c -o red.out
> /scratch/tc-testing/tc-feb-20-llvm/build/bin/qemu-riscv64 red.out
2318
> /scratch/tc-testing/tc-feb-20/build-rv64gcv/bin/riscv64-unknown-linux-gnu-gcc -march=rv64gcv -O2 --param=riscv-autovec-preference=fixed-vlmax red.c -o red.out
> /scratch/tc-testing/tc-feb-20-llvm/build/bin/qemu-riscv64 red.out
2660

Tested/found using r14-9084-g61ab046a327 (not bisected)

Found using fuzzer

[Bug target/114200] [14] RISC-V fixed-length vector miscompile at -O3

[rdapp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114200

--- Comment #1 from Robin Dapp <rdapp at gcc dot gnu.org> ---
Took me a while to analyze this... needed more time than I'd like to admit to
make sense of the somewhat weird code created by fully unrolling and peeling.

I believe the problem is that we reload the output register of a vfmacc/fma via
vmv.v.v (subject to length masking) but we should be using vmv1r.v.  The result
is used by a reduction which always operates on the full length.  As annoying
as it was to find - it's definitely a good catch.

I'm testing a patch.  PR114202 is indeed a duplicate.  Going to add its test
case to the patch.

[Bug target/114200] [14] RISC-V fixed-length vector miscompile at -O3

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114200

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Robin Dapp <rdapp@gcc.gnu.org>:

https://gcc.gnu.org/g:59554a50be8ebbd52e8a6348a92110af182e1874

commit r14-9345-g59554a50be8ebbd52e8a6348a92110af182e1874
Author: Robin Dapp <rdapp@ventanamicro.com>
Date:   Wed Mar 6 12:15:40 2024 +0100

    RISC-V: Use vmv1r.v instead of vmv.v.v for fma output reloads [PR114200].

    Three-operand instructions like vmacc are modeled with an implicit
    output reload when the output does not match one of the operands.  For
    this we use vmv.v.v which is subject to length masking.

    In a situation where the current vl is less than the full vlenb
    and the fma's result value is used as input for a vector reduction
    (which is never length masked) we effectively only reduce vl
    elements.  The masked-out elements are relevant for the
    reduction, though, leading to a wrong result.

    This patch replaces the vmv reloads by full-register reloads.

    gcc/ChangeLog:

            PR target/114200
            PR target/114202

            * config/riscv/vector.md: Use vmv[1248]r.v instead of vmv.v.v.

    gcc/testsuite/ChangeLog:

            * gcc.target/riscv/rvv/autovec/pr114200.c: New test.
            * gcc.target/riscv/rvv/autovec/pr114202.c: New test.

[Bug target/114200] [14] RISC-V fixed-length vector miscompile at -O3

[rdapp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114200

--- Comment #3 from Robin Dapp <rdapp at gcc dot gnu.org> ---
*** Bug 114202 has been marked as a duplicate of this bug. ***

[Bug target/114200] [14] RISC-V fixed-length vector miscompile at -O3

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114200

Patrick O'Neill <patrick at rivosinc dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Patrick O'Neill <patrick at rivosinc dot com> ---
Thanks for the fix!
Once the other ICEs (pr114196, pr114195) get resolved I'll be able to turn on
the yarpgen fuzzer without getting overwhelmed with duplicates.
The failures from the existing csmith fuzzer are getting more rare :)

[Bug target/114200] [14] RISC-V fixed-length vector miscompile at -O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114200

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0