[Bug target/114247] New: RISC-V: miscompile at -O3

[Bug target/114247] New: RISC-V: miscompile at -O3

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

            Bug ID: 114247
           Summary: RISC-V: miscompile at -O3
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: patrick at rivosinc dot com
  Target Milestone: ---

Testcase:
int printf(const char *, ...);
union a {
  unsigned short b;
  int c;
  signed short d;
};
int e, f = 1, g;
long h;
const int **i;
void j(union a k, int l, unsigned m) {
  const int *a[100];
  i = &a[0];
  h = k.d;
}
static int o(union a k) {
  k.d = -1;
  while (1)
    if (f)
      break;
  j(k, g, e);
  return 0;
}
int main() {
  union a n = {1};
  o(n);
  printf("dec: %ld\n", h);
  printf("hex: %lX\n", h);
}

Commands:
> riscv64-unknown-linux-gnu-gcc -O3 red.c -o red.out -fno-strict-aliasing -fwrapv -fno-aggressive-loop-optimizations
> qemu-riscv64 red.out
dec: 65535
hex: FFFF

> riscv64-unknown-linux-gnu-gcc -O2 red.c -o red.out -fno-strict-aliasing -fwrapv -fno-aggressive-loop-optimizations
> qemu-riscv64 red.out
dec: -1
hex: FFFFFFFFFFFFFFFF

This testcase looks very suspect but AFAICT it doesn't contain any UB.

Found via fuzzer

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |ABI
   Last reconfirmed|                            |2024-03-05
          Component|target                      |ipa
     Ever confirmed|0                           |1
            Summary|RISC-V: miscompile at -O3   |RISC-V: miscompile at -O3
                   |                            |and IPA SRA

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I think this is an IPA SRA issue.

The IR looks like:
  j.constprop.isra (65535);

That is wrong for signed short ...


If I try manually I get:
  j12 (-1);


```
void j.constprop.isra (short int ISRA.10)
{
...
}
```


IS there another target where the upper bits of the register are defined?

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
So there's a type mismatch of the formal argument type with the actual call
argument as inserted by IPA SRA, possibly confused by the union.

Martin?

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Mine.

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I don't seem to be able to get riscv64 qemu running in reasonable
time.  Can someone please verify that the following patch fixes
the issue?

diff --git a/gcc/ipa-param-manipulation.cc b/gcc/ipa-param-manipulation.cc
index 3e0df6a6f77..b4ca78b652e 100644
--- a/gcc/ipa-param-manipulation.cc
+++ b/gcc/ipa-param-manipulation.cc
@@ -740,6 +740,12 @@ ipa_param_adjustments::modify_call (cgraph_edge *cs,
          }
       if (repl)
        {
+         if (!useless_type_conversion_p(apm->type, repl->typed.type))
+           {
+             repl = force_value_to_type (apm->type, repl);
+             repl = force_gimple_operand_gsi (&gsi, repl,
+                                              true, NULL, true,
GSI_SAME_STMT);
+           }
          vargs.quick_push (repl);
          continue;
        }

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[rdapp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

--- Comment #5 from Robin Dapp <rdapp at gcc dot gnu.org> ---
This fixes the test case for me locally, thanks.
I can run the testsuite with it later if you'd like.

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[rdapp at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

--- Comment #6 from Robin Dapp <rdapp at gcc dot gnu.org> ---
Testsuite looks unchanged on rv64gcv.

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

--- Comment #7 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Thanks, I will bootstrap and test the patch on x86_64 and submit it
for review then.

Can I ask you, can you please modify the testcase so that it does not
use printf but simply calls __builtin_abort in the miscompiled case
and just returns zero from main if it is OK?  That way we could
include it in our test suite.  Thanks a lot.

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[patrick at rivosinc dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

--- Comment #8 from Patrick O'Neill <patrick at rivosinc dot com> ---
Adjusted testcase:
union a {
  unsigned short b;
  int c;
  signed short d;
};
int e, f = 1, g;
long h;
const int **i;
void j(union a k, int l, unsigned m) {
  const int *a[100];
  i = &a[0];
  h = k.d;
}
static int o(union a k) {
  k.d = -1;
  while (1)
    if (f)
      break;
  j(k, g, e);
  return 0;
}
int main() {
  union a n = {1};
  o(n);
  if (h != -1)
    __builtin_abort();
}

Commands:
> /scratch/tc-testing/tc-apr-4/build-rv64gcv/bin/riscv64-unknown-linux-gnu-gcc -O2 test.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv
> /scratch/tc-testing/tc-apr-4/build-rv64gcv/bin/qemu-riscv64 user-config.out

> /scratch/tc-testing/tc-apr-4/build-rv64gcv/bin/riscv64-unknown-linux-gnu-gcc -O3 test.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv
> /scratch/tc-testing/tc-apr-4/build-rv64gcv/bin/qemu-riscv64 user-config.out
zsh: IOT instruction (core dumped) 
/scratch/tc-testing/tc-apr-4/build-rv64gcv/bin/qemu-riscv64 user-config.out

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

--- Comment #9 from Martin Jambor <jamborm at gcc dot gnu.org> ---
On master this has been fixed by r14-9813-g8cd0d29270d4ed where I
unfortunately copy-pasted a wrong bug number :-/

I assume this needs backporting to at least gcc-13 and gcc-12. I'll do
that in a week or two.

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

--- Comment #10 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Martin Jambor
<jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:44191982c6bd41db1c9d126ea2f15febec3c1f81

commit r12-10442-g44191982c6bd41db1c9d126ea2f15febec3c1f81
Author: Martin Jambor <mjambor@suse.cz>
Date:   Tue May 14 14:13:36 2024 +0200

    ipa: Force args obtined through pass-through maps to the expected type (PR
114247)

    Interactions of IPA-CP and IPA-SRA on the same data is a rather big
    source of issues, I'm afraid.  PR 113964 is a situation where IPA-CP
    propagates an unsigned short in a union parameter into a function
    which itself calls a different function which has a same union
    parameter and both these union parameters are split with IPA-SRA.  The
    leaf function however uses a signed short member of the union.

    In the calling function, we get the unsigned constant as the
    replacement for the union and it is then passed in the call without
    any type compatibility checks.  Apparently on riscv64 it matters
    whether the parameter is signed or unsigned short and so the leaf
    function can see different values.

    Fixed by using useless_type_conversion_p at the appropriate place and
    if it fails, use force_value_to type as elsewhere in similar
    situations.

    gcc/ChangeLog:

    2024-04-04  Martin Jambor  <mjambor@suse.cz>

            PR ipa/114247
            * ipa-param-manipulation.cc (ipa_param_adjustments::modify_call):
            Force values obtined through pass-through maps to the expected
            split type.

    gcc/testsuite/ChangeLog:

    2024-04-04  Patrick O'Neill  <patrick@rivosinc.com>
                Martin Jambor  <mjambor@suse.cz>

            PR ipa/114247
            * gcc.dg/ipa/pr114247.c: New test.

    (cherry picked from commit 8cd0d29270d4ed86c69b80c08de66dcb6c1e22fe)

[Bug ipa/114247] RISC-V: miscompile at -O3 and IPA SRA

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114247

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #11 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed.