[Bug target/114284] New: [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice)

[Bug target/114284] New: [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice)

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

            Bug ID: 114284
           Summary: [14 Regression] arm: Load of volatile short gets
                    miscompiled (loaded twice)
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

The following is a wrong code regression in GCC 14:

volatile short x;
short foo() {
  return x;
}

with -march=armv8-m.base -O2 on the trunk we get:

foo:
        movw    r3, #:lower16:.LANCHOR0
        movt    r3, #:upper16:.LANCHOR0
        ldrh    r2, [r3]
        movs    r0, #0
        ldrsh   r0, [r3, r0]
        bx      lr

i.e. x is loaded twice, but with GCC 13 we get:

foo:
        movw    r3, #:lower16:.LANCHOR0
        movt    r3, #:upper16:.LANCHOR0
        ldrh    r0, [r3]
        sxth    r0, r0
        bx      lr

I suppose ideally we would have just one ldrsh, but the GCC 13 code is OK.

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0
           Priority|P3                          |P1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
fold-mem-offsets pass?

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[14 Regression] arm: Load   |[14 Regression] arm: Load
                   |of volatile short gets      |of volatile short gets
                   |miscompiled (loaded twice)  |miscompiled (loaded twice)
                   |                            |since r14-8319
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-03-08
             Status|UNCONFIRMED                 |NEW
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
No, started with r14-8319-g86de9b66480b710202a2898cf513db105d8c432f

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

--- Comment #3 from Alex Coplan <acoplan at gcc dot gnu.org> ---
I think this has been fixed by
r14-9379-ga0e945888d973fc1a4a9d2944aa7e96d2a4d7581

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
+propagating insn 6 into insn 8, replacing:
+(parallel [
+        (set (reg:SI 114 [ <retval> ])
+            (sign_extend:SI (subreg:HI (reg:SI 117 [ x ]) 0)))
+        (clobber (scratch:SI))
+    ])
+successfully matched this instruction to thumb1_extendhisi2:
+(parallel [
+        (set (reg:SI 114 [ <retval> ])
+            (sign_extend:SI (mem/v/c:HI (reg/f:SI 115) [1 x+0 S2 A16])))
+        (clobber (scratch:SI))
+    ])
I believe before that change we'd never propagate MEM/v, classify_result even
correctly explains why:
     4) Creating new (mem/v)s is not correct, since DCE will not remove the old
        ones.
But now that fwprop just ignores that or takes it as a slight hint, we get the
invalid change.
I'd actually say all the 4 reasons why it shouldn't be propagating MEMs should
result in don't actually propagate it rather than just a mere hint:
  /* Allow (subreg (mem)) -> (mem) simplifications with the following
     exceptions:
     1) Propagating (mem)s into multiple uses is not profitable.
     2) Propagating (mem)s across EBBs may not be profitable if the source EBB
        runs less frequently.
     3) Propagating (mem)s into paradoxical (subreg)s is not profitable.
     4) Creating new (mem/v)s is not correct, since DCE will not remove the old
        ones.  */
and punt maybe also on propagating any other MEMs into insns.
Though, when check_mem is called, it is called only on the MEMs which are being
propagated, so not sure how to actually check it in there.
Doing
--- a/gcc/fwprop.cc
+++ b/gcc/fwprop.cc
@@ -211,6 +211,11 @@ fwprop_propagation::fwprop_propagation (insn_info
*use_insn,
 bool
 fwprop_propagation::check_mem (int old_num_changes, rtx mem)
 {
+  if (MEM_VOLATILE_P (mem))
+    {
+      failure_reason = "would propagate volatile MEM";
+      return false;
+    }
   if (!memory_address_addr_space_p (GET_MODE (mem), XEXP (mem, 0),
                                    MEM_ADDR_SPACE (mem)))
     {
doesn't really help, so perhaps I misunderstand what is check_mem used for.

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Alex Coplan from comment #3)
> I think this has been fixed by
> r14-9379-ga0e945888d973fc1a4a9d2944aa7e96d2a4d7581

Maybe the volatile MEM case yes, but I don't see how it would avoid the
undesirable MEM propagation when it is used multiple times, across EBBs or into
paradoxical subregs.

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Perhaps we should simply punt on trying to propagate src which is MEM or
contains MEM anywhere in it unless likely_profitable_p ().
--- gcc/fwprop.cc.jj    2024-03-08 09:07:29.371626376 +0100
+++ gcc/fwprop.cc       2024-03-08 16:18:16.125853619 +0100
@@ -451,6 +451,7 @@ try_fwprop_subst_pattern (obstack_waterm

   if (!prop.likely_profitable_p ()
       && (prop.changed_mem_p ()
+         || contains_mem_rtx_p (src)
          || use_insn->is_asm ()
          || !single_set (use_rtl)))
     {
That will ensure we honor the classify_result decisions if MEMs are being
propagated (so pretty much restore previous behavior in that case).

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:3e3e4156a5f93e6d62101594ca6660ee9ce9c10e

commit r14-9412-g3e3e4156a5f93e6d62101594ca6660ee9ce9c10e
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Mar 9 13:04:26 2024 +0100

    fwprop: Restore previous behavior for forward propagation of RTL with MEMs
[PR114284]

    Before the recent PR111267 r14-8319 fwprop changes, fwprop would never try
    to propagate what was not considered PROFITABLE, where the profitable part
    actually was partly about profitability, partly about very good reasons
    not to actually propagate and partly for cases where propagation is
    completely incorrect.
    In particular, classify_result has:
      /* Allow (subreg (mem)) -> (mem) simplifications with the following
         exceptions:
         1) Propagating (mem)s into multiple uses is not profitable.
         2) Propagating (mem)s across EBBs may not be profitable if the source
EBB
            runs less frequently.
         3) Propagating (mem)s into paradoxical (subreg)s is not profitable.
         4) Creating new (mem/v)s is not correct, since DCE will not remove the
old
            ones.  */
      if (single_use_p
          && single_ebb_p
          && SUBREG_P (old_rtx)
          && !paradoxical_subreg_p (old_rtx)
          && MEM_P (new_rtx)
          && !MEM_VOLATILE_P (new_rtx))
        return PROFITABLE;
    and didn't mark any other MEM_P (new_rtx) or rtxes which contain
    a MEM in its subrtxes as PROFITABLE.  Now, since r14-8319 profitable_p
    method has been renamed to likely_profitable_p and has just a minor role.
    Now, rule 4) above is something that isn't about profitability, but about
    correct behavior, if you propagate mem/v, the code is miscompiled.
    This particular case has been fixed elsewhere by Haochen in r14-9379.
    But I think even the 1) and 2) and maybe 3) are a strong don't do it,
    don't rely solely on rtx costs, increasing the number of loads of the same
    memory, even when cached, is undesirable, canceling load hoisting can
    be undesirable as well.

    So, the following patch restores previous behavior of src contains any
MEMs,
    in that case likely_profitable_p () is taken as the old profitable_p ()
    as a requirement rather than just a hint.  For propagation of something
    which doesn't load from memory this keeps the r14-8319 behavior.

    2024-03-09  Jakub Jelinek  <jakub@redhat.com>

            PR target/114284
            * fwprop.cc (try_fwprop_subst_pattern): Don't propagate
            src containing MEMs unless prop.likely_profitable_p ().

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #8 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Fixed on the trunk.

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #9 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Actually change the state this time :-0

[Bug target/114284] [14 Regression] arm: Load of volatile short gets miscompiled (loaded twice) since r14-8319

[roger at nextmovesoftware dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114284

Roger Sayle <roger at nextmovesoftware dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |roger at nextmovesoftware dot com

--- Comment #10 from Roger Sayle <roger at nextmovesoftware dot com> ---
Thanks Jakub.  My apologies for the unintentional breakage.