[Bug rtl-optimization/40679] New: Optimizer handles loops with volatiles and post-incr. wrong

[Bug rtl-optimization/40679] New: Optimizer handles loops with volatiles and post-incr. wrong

[bastian dot schick at sciopta dot com]

If the following code is compiled with -Os for ARM or ColdFire, the exit
condition for the loop is removed.
Replacing *tbl++ with tbl[i] or using unsigned long instead of volatile
unsigned long does not show the problem.
I suspect the post-increment optimization to be the problem, because the
PowerPC version does not show the problem.
Also: Using a different start-address for tbl, does not show the problem.

The problem has been reported also for 4.4.0.

typedef volatile unsigned long __vu32;
void bs()
{
    int i;
    __vu32 *tbl = (__vu32 *)0xffffff00;
    for(i = 0; i < 64; ++i){
//->      tbl[i] = (__vu32)10;
      *tbl++ = (__vu32)10;
    }
}
Cmd-line: arm-none-eabi-gcc -S -Os t.c
Output: 
        .cpu arm7tdmi
        .fpu softvfp
        .eabi_attribute 20, 1
        .eabi_attribute 21, 1
        .eabi_attribute 23, 3
        .eabi_attribute 24, 1
        .eabi_attribute 25, 1
        .eabi_attribute 26, 1
        .eabi_attribute 30, 4
        .eabi_attribute 18, 4
        .file   "t.c"
        .text
        .align  2
        .global bs
        .type   bs, %function
bs:
        @ Function supports interworking.
        @ args = 0, pretend = 0, frame = 0
        @ frame_needed = 0, uses_anonymous_args = 0
        @ link register save eliminated.
        mvn     r2, #255
.L2:
        mov     r3, #10
        str     r3, [r2], #4
        b       .L2
        .size   bs, .-bs
        .ident  "GCC: (Sourcery G++ Lite 2008q3-39) 4.3.2"


-- 
           Summary: Optimizer handles loops with volatiles and post-incr.
                    wrong
           Product: gcc
           Version: 4.3.2
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: bastian dot schick at sciopta dot com
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-mingw32
GCC target triplet: i686-mingw32


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

Re: [Bug rtl-optimization/40679] New: Optimizer handles loops with volatiles and post-incr. wrong

[Andrew Pinski]

Sent from my iPhone

On Jul 8, 2009, at 12:32 AM, "bastian dot schick at sciopta dot com" <gcc-bugzilla@gcc.gnu.org 
 > wrote:

> If the following code is compiled with -Os for ARM or ColdFire, the  
> exit
> condition for the loop is removed.
> Replacing *tbl++ with tbl[i] or using unsigned long instead of  
> volatile
> unsigned long does not show the problem.
> I suspect the post-increment optimization to be the problem, because  
> the
> PowerPC version does not show the problem.
> Also: Using a different start-address for tbl, does not show the  
> problem.

It looks more like a wrapping issue. 4*64 = 256. So we go from -256u  
to 0 which causes wrapping of the pointer which is undefined and  
therefor I think gcc is doing the correct thing (If got my numbers  
correct).


>
> The problem has been reported also for 4.4.0.
>
> typedef volatile unsigned long __vu32;
> void bs()
> {
>    int i;
>    __vu32 *tbl = (__vu32 *)0xffffff00;
>    for(i = 0; i < 64; ++i){
> //->      tbl[i] = (__vu32)10;
>      *tbl++ = (__vu32)10;
>    }
> }
> Cmd-line: arm-none-eabi-gcc -S -Os t.c
> Output:
>        .cpu arm7tdmi
>        .fpu softvfp
>        .eabi_attribute 20, 1
>        .eabi_attribute 21, 1
>        .eabi_attribute 23, 3
>        .eabi_attribute 24, 1
>        .eabi_attribute 25, 1
>        .eabi_attribute 26, 1
>        .eabi_attribute 30, 4
>        .eabi_attribute 18, 4
>        .file   "t.c"
>        .text
>        .align  2
>        .global bs
>        .type   bs, %function
> bs:
>        @ Function supports interworking.
>        @ args = 0, pretend = 0, frame = 0
>        @ frame_needed = 0, uses_anonymous_args = 0
>        @ link register save eliminated.
>        mvn     r2, #255
> .L2:
>        mov     r3, #10
>        str     r3, [r2], #4
>        b       .L2
>        .size   bs, .-bs
>        .ident  "GCC: (Sourcery G++ Lite 2008q3-39) 4.3.2"
>
>
> -- 
>           Summary: Optimizer handles loops with volatiles and post- 
> incr.
>                    wrong
>           Product: gcc
>           Version: 4.3.2
>            Status: UNCONFIRMED
>          Severity: major
>          Priority: P3
>         Component: rtl-optimization
>        AssignedTo: unassigned at gcc dot gnu dot org
>        ReportedBy: bastian dot schick at sciopta dot com
> GCC build triplet: i686-pc-linux-gnu
>  GCC host triplet: i686-mingw32
> GCC target triplet: i686-mingw32
>
>
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679
>

[Bug rtl-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[pinskia at gmail dot com]

------- Comment #1 from pinskia at gmail dot com  2009-07-08 08:13 -------
Subject: Re:   New: Optimizer handles loops with volatiles and post-incr. wrong



Sent from my iPhone

On Jul 8, 2009, at 12:32 AM, "bastian dot schick at sciopta dot com"
<gcc-bugzilla@gcc.gnu.org 
 > wrote:

> If the following code is compiled with -Os for ARM or ColdFire, the  
> exit
> condition for the loop is removed.
> Replacing *tbl++ with tbl[i] or using unsigned long instead of  
> volatile
> unsigned long does not show the problem.
> I suspect the post-increment optimization to be the problem, because  
> the
> PowerPC version does not show the problem.
> Also: Using a different start-address for tbl, does not show the  
> problem.

It looks more like a wrapping issue. 4*64 = 256. So we go from -256u  
to 0 which causes wrapping of the pointer which is undefined and  
therefor I think gcc is doing the correct thing (If got my numbers  
correct).


>
> The problem has been reported also for 4.4.0.
>
> typedef volatile unsigned long __vu32;
> void bs()
> {
>    int i;
>    __vu32 *tbl = (__vu32 *)0xffffff00;
>    for(i = 0; i < 64; ++i){
> //->      tbl[i] = (__vu32)10;
>      *tbl++ = (__vu32)10;
>    }
> }
> Cmd-line: arm-none-eabi-gcc -S -Os t.c
> Output:
>        .cpu arm7tdmi
>        .fpu softvfp
>        .eabi_attribute 20, 1
>        .eabi_attribute 21, 1
>        .eabi_attribute 23, 3
>        .eabi_attribute 24, 1
>        .eabi_attribute 25, 1
>        .eabi_attribute 26, 1
>        .eabi_attribute 30, 4
>        .eabi_attribute 18, 4
>        .file   "t.c"
>        .text
>        .align  2
>        .global bs
>        .type   bs, %function
> bs:
>        @ Function supports interworking.
>        @ args = 0, pretend = 0, frame = 0
>        @ frame_needed = 0, uses_anonymous_args = 0
>        @ link register save eliminated.
>        mvn     r2, #255
> .L2:
>        mov     r3, #10
>        str     r3, [r2], #4
>        b       .L2
>        .size   bs, .-bs
>        .ident  "GCC: (Sourcery G++ Lite 2008q3-39) 4.3.2"
>
>
> -- 
>           Summary: Optimizer handles loops with volatiles and post- 
> incr.
>                    wrong
>           Product: gcc
>           Version: 4.3.2
>            Status: UNCONFIRMED
>          Severity: major
>          Priority: P3
>         Component: rtl-optimization
>        AssignedTo: unassigned at gcc dot gnu dot org
>        ReportedBy: bastian dot schick at sciopta dot com
> GCC build triplet: i686-pc-linux-gnu
>  GCC host triplet: i686-mingw32
> GCC target triplet: i686-mingw32
>
>
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679
>


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug rtl-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[bastian dot schick at sciopta dot com]

------- Comment #2 from bastian dot schick at sciopta dot com  2009-07-08 08:24 -------
(In reply to comment #1)
> 
> Sent from my iPhone

Oh, dude (which one :-)

> On Jul 8, 2009, at 12:32 AM, "bastian dot schick at sciopta dot com"
> <gcc-bugzilla@gcc.gnu.org 
>  > wrote:
> 
> > If the following code is compiled with -Os for ARM or ColdFire, the  
> > exit
> > condition for the loop is removed.
> > Replacing *tbl++ with tbl[i] or using unsigned long instead of  
> > volatile
> > unsigned long does not show the problem.
> > I suspect the post-increment optimization to be the problem, because  
> > the
> > PowerPC version does not show the problem.
> > Also: Using a different start-address for tbl, does not show the  
> > problem.
> 
> It looks more like a wrapping issue. 4*64 = 256. So we go from -256u  
> to 0 which causes wrapping of the pointer which is undefined and  

If so, it should not be used, but it seems to be a new optimization as 3.4.4
does not use it.

> therefor I think gcc is doing the correct thing (If got my numbers  
> correct).

Replacing *tbl++ by tbl[i] gives this ARM code:
.L2:
        mov     r3, #10
        str     r3, [r2], #4
        cmp     r2, #0
        bne     .L2
        bx      lr

See, gcc knows about the wrapping but still the *tbl++ version misses the
end-condition which is the bug.

Addenum: x86-gcc 4.3.3 (openSUSE 10.0) has the same problem.

Compiling with -O, gives correct code with *tbl++ :

.L2:
        mov     r3, #10
        str     r3, [r2], #4
        cmp     r2, #0
        bne     .L2
        bx      lr


-- 

bastian dot schick at sciopta dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bastian dot schick at
                   |                            |sciopta dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug rtl-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[ramana at gcc dot gnu dot org]

------- Comment #3 from ramana at gcc dot gnu dot org  2009-07-08 08:49 -------
On trunk with -fno-tree-vrp I see the correct code being generated. 

bs:
        @ Function supports interworking.
        @ args = 0, pretend = 0, frame = 0
        @ frame_needed = 0, uses_anonymous_args = 0
        @ link register save eliminated.
        mvn     r3, #255
        mov     r2, #10
.L2:
        str     r2, [r3], #4
        cmp     r3, #0
        bne     .L2
        bx      lr


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug rtl-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[bastian dot schick at sciopta dot com]

------- Comment #4 from bastian dot schick at sciopta dot com  2009-07-08 09:06 -------
(In reply to comment #3)
> On trunk with -fno-tree-vrp I see the correct code being generated. 

It seems to be related to Bug #30785 (test for null pointer).


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug tree-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[ramana at gcc dot gnu dot org]

------- Comment #5 from ramana at gcc dot gnu dot org  2009-07-08 09:12 -------
Richi,

Can you comment on this one ?

Ramana


-- 

ramana at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu dot
                   |                            |org
          Component|rtl-optimization            |tree-optimization


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug tree-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[mikpe at it dot uu dot se]

------- Comment #6 from mikpe at it dot uu dot se  2009-07-08 09:59 -------
(In reply to comment #2)
> Replacing *tbl++ by tbl[i] gives this ARM code:
> .L2:
>         mov     r3, #10
>         str     r3, [r2], #4
>         cmp     r2, #0
>         bne     .L2
>         bx      lr
> 
> See, gcc knows about the wrapping but still the *tbl++ version misses the
> end-condition which is the bug.

The difference is that in the tbl[i] version there will not be a wraparound at
runtime because &tbl[i] for i == 64 is never computed, while in the *tbl++
version the iteration with i == 63 will do tbl++ moving tbl from -4U to 0
before the loop termination test, which triggers undefined behaviour.

And the issue is not ARM, the same infinite loop occurs for e.g. target i686.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug tree-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[rguenth at gcc dot gnu dot org]

------- Comment #7 from rguenth at gcc dot gnu dot org  2009-07-08 10:10 -------
Indeed the overflow invokes undefined behavior.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug tree-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[bastian dot schick at sciopta dot com]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1488 bytes --]



------- Comment #8 from bastian dot schick at sciopta dot com  2009-07-08 13:06 -------
(In reply to comment #6)
> (In reply to comment #2)
> > Replacing *tbl++ by tbl[i] gives this ARM code:
> > .L2:
> >         mov     r3, #10
> >         str     r3, [r2], #4
> >         cmp     r2, #0
> >         bne     .L2
> >         bx      lr
> > 
> > See, gcc knows about the wrapping but still the *tbl++ version misses the
> > end-condition which is the bug.
> 
> The difference is that in the tbl[i] version there will not be a wraparound at
> runtime because &tbl[i] for i == 64 is never computed, while in the *tbl++
> version the iteration with i == 63 will do tbl++ moving tbl from -4U to 0
> before the loop termination test, which triggers undefined behaviour.

Ok fine, but why does it generate correct code if not using volatile for the
pointer ?!
        mvn     r2, #251
.L2:
        mov     r3, #10
        str     r3, [r2, #-4]
        add     r2, r2, #4
        cmp     r2, #4
        bne     .L2
        bx      lr
Strange, no post-increment code is generated.
The 68k version still uses post-increment and voilà, endless-loop.

Also see the code for the tbl[i] version, the pointer still wraps.

I suspect following: The test for 0 is removed maybe because the post-increment
is defined to change flags( which it isn't). Since there is no test, the next
optimization changes a "jump not zero" to an "jump always".


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679

[Bug tree-optimization/40679] Optimizer handles loops with volatiles and post-incr. wrong

[rguenth at gcc dot gnu dot org]

------- Comment #9 from rguenth at gcc dot gnu dot org  2009-07-08 13:11 -------
induction variable optimization is different w/o volatile.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=40679