[Bug tree-optimization/115154] New: [13/14 Regression] wrong code at optimization levels -O2, -O3, -Os

[Bug tree-optimization/115154] New: [13/14 Regression] wrong code at optimization levels -O2, -O3, -Os

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

            Bug ID: 115154
           Summary: [13/14 Regression] wrong code at optimization levels
                    -O2, -O3, -Os
           Product: gcc
           Version: 13.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bic60176 at gmail dot com
  Target Milestone: ---

Created attachment 58242
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58242&action=edit
testcase

OS: Ubuntu 22.04.3 LTS

We found that there are discrepancies when compiling with gcc-13.2.0,
gcc-14.1.0 at optimization levels -O2, -O3, and -Os.

$ ../compiler-builds/gcc-13.2.0_build/bin/gcc -fsanitize=undefined -g -lgcc_s
-I/home/csmith/include/csmith-2.3.0 -O2 testcase.c -o exec

$ timeout 1s ./exec 2>exec.err
f.b=0

$ ../compiler-builds/gcc-12.3.0_build/bin/gcc -fsanitize=undefined -g -lgcc_s
-I/home/csmith/include/csmith-2.3.0 -O2 testcase.c -o exec

$ timeout 1s ./exec 2>exec.err
f.b=-1

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14 Regression] wrong    |[13 Regression] wrong code
                   |code at optimization levels |at optimization levels -O2,
                   |-O2, -O3, -Os               |-O3, -Os

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This is fixed in GCC 14. I think it was one of my match.pd patches and it might
be backported already to the GCC 13 branch. Let me look.

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |13.1.0, 14.1.0
           Keywords|                            |needs-bisection
   Target Milestone|---                         |13.3
      Known to fail|                            |13.2.0

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
It was caused by something that was backported to GCC 13 for GCC 13.2.0 too.
It works in GCC 14.1.0 and the trunk for me.

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I wonder if my r13-7434-g682bbd364708fe exposed the issue.
And then r14-3432-gddd64a6ec3b38e "fixed" it (on accident).

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #4 from Sam James <sjames at gcc dot gnu.org> ---
I'm bisecting.

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu.org
            Summary|[13 Regression] wrong code  |[13 Regression] wrong code
                   |at optimization levels -O2, |at optimization levels -O2,
                   |-O3, -Os                    |-O3, -Os since
                   |                            |r13-7434-g682bbd364708fe

--- Comment #5 from Sam James <sjames at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #3)
> I wonder if my r13-7434-g682bbd364708fe exposed the issue.
> And then r14-3432-gddd64a6ec3b38e "fixed" it (on accident).

Yeah, r13-7434-g682bbd364708fe is the first bad commit on releases/gcc-13.

I'll bisect for the "fix" now.

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #6 from Sam James <sjames at gcc dot gnu.org> ---
yep, r14-3432-gddd64a6ec3b38e fixed it on trunk

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |wrong-code
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2024-05-19
           Assignee|unassigned at gcc dot gnu.org      |pinskia at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Sam James from comment #6)
> yep, r14-3432-gddd64a6ec3b38e fixed it on trunk

So that is not the correct fix really. It just works around the bad ir/bug.
Tomorrow I will look into the correct fix. -a is not well defined for signed:1
and something created it which was wrong. There was a few other fixes in this
area that fixed stuff like this too which was done due to detection of lowering
vectors.

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
```
Optimizing statement _5 = (<unnamed-signed:1>) _2;
LKUP STMT _5 = nop_expr _2
2>>> STMT _5 = nop_expr _2
Optimizing statement _3 = -_5;
LKUP STMT _3 = negate_expr _5
2>>> STMT _3 = negate_expr _5
Optimizing statement f.b = _3;
  Replaced '_3' with constant '0'
```

So Dom decided it was always 0 as -signed:1 is undefined otherwise. 

The IR is fine in .ccp:
```
  _27 = (int) si1_34;
  _36 = _27 * 5;
  _29 = (<unnamed-signed:1>) _36;
  f.b = _29;
```

Then in forwprop it is broken:
```
  _32 = (<unnamed-signed:1>) _2;
  _29 = -_32;
  f.b = _29;
```

[Bug tree-optimization/115154] [13 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Matching expression match.pd:2310, gimple-match-3.cc:90
Matching expression match.pd:2310, gimple-match-3.cc:90
Applying pattern match.pd:4890, gimple-match-2.cc:4798
Matching expression match.pd:160, gimple-match-10.cc:33
Matching expression match.pd:2243, gimple-match-5.cc:20
Matching expression match.pd:160, gimple-match-10.cc:33
Applying pattern match.pd:5024, gimple-match-7.cc:13241
Applying pattern match.pd:2404, gimple-match-2.cc:4387
gimple_simplified to _32 = (<unnamed-signed:1>) _2;
_29 = -_32;

The problem match pattern (r13-1162-g9991d84d2a8435) is:
```
/* Narrow integer multiplication by a zero_one_valued_p operand.
   Multiplication by [0,1] is guaranteed not to overflow.  */
(simplify
 (convert (mult@0 zero_one_valued_p@1 INTEGER_CST@2))
 (if (INTEGRAL_TYPE_P (type)
      && INTEGRAL_TYPE_P (TREE_TYPE (@0))
      && TYPE_PRECISION (type) < TYPE_PRECISION (TREE_TYPE (@0)))
  (mult (convert @1) (convert @2))))
```

  _36 = _27 * 5;
  _29 = (<unnamed-signed:1>) _36;

We go from `(<unnamed-signed:1>)(_27 *5)` to `((<unnamed-signed:1>)_27) * -1`
which does overflow.

The only case where is an overflow is `signed:1` so we should reject that I
think.

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|14.1.0                      |
            Summary|[13 Regression] wrong code  |[13/14/15 Regression] wrong
                   |at optimization levels -O2, |code at optimization levels
                   |-O3, -Os since              |-O2, -O3, -Os since
                   |r13-7434-g682bbd364708fe    |r13-7434-g682bbd364708fe

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This works and might be the best for GCC 13/14 but maybe I think we can do
better.

```
diff --git a/gcc/match.pd b/gcc/match.pd
index 0f9c34fa897..6bc512cabdf 100644
--- a/gcc/match.pd
+++ b/gcc/match.pd
@@ -2400,7 +2400,8 @@ DEFINE_INT_AND_FLOAT_ROUND_FN (RINT)
  (convert (mult@0 zero_one_valued_p@1 INTEGER_CST@2))
  (if (INTEGRAL_TYPE_P (type)
       && INTEGRAL_TYPE_P (TREE_TYPE (@0))
-      && TYPE_PRECISION (type) < TYPE_PRECISION (TREE_TYPE (@0)))
+      && TYPE_PRECISION (type) < TYPE_PRECISION (TREE_TYPE (@0))
+      && (TYPE_UNSIGNED (type) || TYPE_PRECISION (type) > 1))
   (mult (convert @1) (convert @2))))

 /* (X << C) != 0 can be simplified to X, when C is zero_one_valued_p.

```

For bit 1 precision, look at the lower bit of the INTEGER_CST and decide if it
should be @1 or `0` and that would avoid the overflow too.

Note you can reproduce the failure on the trunk and GCC 14 by using
-fsanitize=undefined which I missed in the original bug report and that is
because r14-3432-gddd64a6ec3b38e is disable for undefined sanitizers case.

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=110165,
                   |                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=110166,
                   |                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=105835

--- Comment #11 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Sam James from comment #5)
> (In reply to Andrew Pinski from comment #3)
> > I wonder if my r13-7434-g682bbd364708fe exposed the issue.
> > And then r14-3432-gddd64a6ec3b38e "fixed" it (on accident).
> 
> Yeah, r13-7434-g682bbd364708fe is the first bad commit on releases/gcc-13.
> 
> I'll bisect for the "fix" now.

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 58247
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58247&action=edit
Easier to (reduced) understand testcase

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #13 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 58249
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58249&action=edit
Patch which I am testing

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2024-May/652
                   |                            |209.html

--- Comment #14 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Patch submitted:
https://gcc.gnu.org/pipermail/gcc-patches/2024-May/652209.html

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|13.3                        |13.4

--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 13.3 is being released, retargeting bugs to GCC 13.4.

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #16 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Andrew Pinski <pinskia@gcc.gnu.org>:

https://gcc.gnu.org/g:49c87d22535ac4f8aacf088b3f462861c26cacb4

commit r15-755-g49c87d22535ac4f8aacf088b3f462861c26cacb4
Author: Andrew Pinski <quic_apinski@quicinc.com>
Date:   Mon May 20 00:16:40 2024 -0700

    match: Disable `(type)zero_one_valuep*CST` for 1bit signed types [PR115154]

    The problem here is the pattern added in r13-1162-g9991d84d2a8435
    assumes that it is well defined to multiply zero_one_valuep by the
truncated
    converted integer constant. It is well defined for all types except for
signed 1bit types.
    Where `a * -1` is produced which is undefined/
    So disable this pattern for 1bit signed types.

    Note the pattern added in r14-3432-gddd64a6ec3b38e is able to workaround
the undefinedness except when
    `-fsanitize=undefined` is turned on, this is why I added a testcase for
that.

    Bootstrapped and tested on x86_64-linux-gnu with no regressions.

            PR tree-optimization/115154

    gcc/ChangeLog:

            * match.pd (convert (mult zero_one_valued_p@1 INTEGER_CST@2)):
Disable
            for 1bit signed types.

    gcc/testsuite/ChangeLog:

            * c-c++-common/ubsan/signed1bitfield-1.c: New test.
            * gcc.c-torture/execute/signed1bitfield-1.c: New test.

    Signed-off-by: Andrew Pinski <quic_apinski@quicinc.com>

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #17 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-14 branch has been updated by Andrew Pinski
<pinskia@gcc.gnu.org>:

https://gcc.gnu.org/g:b2bb49d6a77e4568c0b91db17b2599f5929fb85b

commit r14-10224-gb2bb49d6a77e4568c0b91db17b2599f5929fb85b
Author: Andrew Pinski <quic_apinski@quicinc.com>
Date:   Mon May 20 00:16:40 2024 -0700

    match: Disable `(type)zero_one_valuep*CST` for 1bit signed types [PR115154]

    The problem here is the pattern added in r13-1162-g9991d84d2a8435
    assumes that it is well defined to multiply zero_one_valuep by the
truncated
    converted integer constant. It is well defined for all types except for
signed 1bit types.
    Where `a * -1` is produced which is undefined/
    So disable this pattern for 1bit signed types.

    Note the pattern added in r14-3432-gddd64a6ec3b38e is able to workaround
the undefinedness except when
    `-fsanitize=undefined` is turned on, this is why I added a testcase for
that.

    Bootstrapped and tested on x86_64-linux-gnu with no regressions.

            PR tree-optimization/115154

    gcc/ChangeLog:

            * match.pd (convert (mult zero_one_valued_p@1 INTEGER_CST@2)):
Disable
            for 1bit signed types.

    gcc/testsuite/ChangeLog:

            * c-c++-common/ubsan/signed1bitfield-1.c: New test.
            * gcc.c-torture/execute/signed1bitfield-1.c: New test.

    Signed-off-by: Andrew Pinski <quic_apinski@quicinc.com>
    (cherry picked from commit 49c87d22535ac4f8aacf088b3f462861c26cacb4)

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

--- Comment #18 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Andrew Pinski
<pinskia@gcc.gnu.org>:

https://gcc.gnu.org/g:d6cf49eaf5ac237c57785dce42c89deac911affa

commit r13-8783-gd6cf49eaf5ac237c57785dce42c89deac911affa
Author: Andrew Pinski <quic_apinski@quicinc.com>
Date:   Mon May 20 00:16:40 2024 -0700

    match: Disable `(type)zero_one_valuep*CST` for 1bit signed types [PR115154]

    The problem here is the pattern added in r13-1162-g9991d84d2a8435
    assumes that it is well defined to multiply zero_one_valuep by the
truncated
    converted integer constant. It is well defined for all types except for
signed 1bit types.
    Where `a * -1` is produced which is undefined/
    So disable this pattern for 1bit signed types.

    Note the pattern added in r14-3432-gddd64a6ec3b38e is able to workaround
the undefinedness except when
    `-fsanitize=undefined` is turned on, this is why I added a testcase for
that.

    Bootstrapped and tested on x86_64-linux-gnu with no regressions.

            PR tree-optimization/115154

    gcc/ChangeLog:

            * match.pd (convert (mult zero_one_valued_p@1 INTEGER_CST@2)):
Disable
            for 1bit signed types.

    gcc/testsuite/ChangeLog:

            * c-c++-common/ubsan/signed1bitfield-1.c: New test.
            * gcc.c-torture/execute/signed1bitfield-1.c: New test.

    Signed-off-by: Andrew Pinski <quic_apinski@quicinc.com>
    (cherry picked from commit 49c87d22535ac4f8aacf088b3f462861c26cacb4)

[Bug tree-optimization/115154] [13/14/15 Regression] wrong code at optimization levels -O2, -O3, -Os since r13-7434-g682bbd364708fe

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115154

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |14.1.0
      Known to work|                            |13.3.1, 14.1.1, 15.0
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #19 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed on all branches, sadly it barely didn't make it for the just released GCC
13.3.0.