[Bug tree-optimization/48973] New: Inliner bug with one-bit (1-bit) bitfield

[Bug tree-optimization/48973] New: Inliner bug with one-bit (1-bit) bitfield

[arthur.j.odwyer at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

           Summary: Inliner bug with one-bit (1-bit) bitfield
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: arthur.j.odwyer@gmail.com


Created attachment 24231
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24231
Output of "ajo-gcc -w -O1 -finline-small-functions test.c -v"

This reproduces for me with svn revision 173589 (2011-05-09). Since this
reproduces all the way back to 4.4, it *must* be a duplicate of *something*,
but I didn't find anything likely-looking in a Bugzilla search. I'm on Ubuntu
10.10, x86-64.

cat >test.c <<EOF
struct S0 {
   signed f0 : 1;
} g_72 = {0}; 
int f5 = -1;
void func_46(int f4) {
    g_72.f0 = (f5 & 1) > 0;
}
int main() {
    func_46(-1);
    printf("%x\n", (unsigned int)(g_72.f0));
    return 0;
}
EOF
gcc -w -O1 test.c -o a.out ; ./a.out
gcc -w -O2 test.c -o a.out ; ./a.out

REDUCED: gcc -w -O1 -finline-small-functions test.c -o a.out ; ./a.out

With -O1 the output is "ffffffff". With -O2 the output is "1". g_72.f0 should
evaluate to -1, and then casting that to (unsigned int) should always yield
0xffffffff regardless of optimization level. This looks to me like an inliner
bug.

In gcc 4.4.5 and 4.5.1, the bug also reproduces when you use "f4" instead of
"f5" inside func_46(). In trunk, you need to use a global variable to see the
bug.

This test case is reduced from the output of Csmith 2.1.0 (git hash 541a6480,
https://github.com/csmith-project/csmith/), using the following command line:
csmith --no-paranoid --no-longlong --no-pointers --arrays --no-jumps --consts
--no-volatiles --checksum --no-divs --no-muls --bitfields --packed-struct -s
1281232940

[Bug tree-optimization/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-12 07:20:30 UTC ---
extern void abort (void);
struct S { int f : 1; } s;
int v = -1;

void
foo (void)
{
  s.f = (v & 1) > 0;
}

void
bar (unsigned int x)
{
  if (x != -1U)
    abort ();
}

int
main ()
{
  foo ();
  bar (s.f);
  return 0;
}

[Bug tree-optimization/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-12 07:29:37 UTC ---
extern void abort (void);
struct S { int f : 1; } s;
int v = -1;

void
foo (unsigned int x)
{
  if (x != -1U)
    abort ();
}

int
main ()
{
  s.f = (v & 1) > 0;
  foo (s.f);
  return 0;
}

Smaller testcase which failed already in 4.2, apparently introduced in between
r97500 and r98750.

[Bug tree-optimization/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-12 07:36:07 UTC ---
And even more reduced:
extern void abort (void);
struct S { int f : 1; } s;
int v = -1;

int
main ()
{
  s.f = (v & 1) > 0;
  if ((unsigned int) s.f != -1U)
    abort ();
  return 0;
}

[Bug tree-optimization/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011.05.12 07:19:50
                 CC|                            |jakub at gcc dot gnu.org
      Known to work|                            |4.2.3
   Target Milestone|---                         |4.3.6
            Summary|Inliner bug with one-bit    |[4.3/4.4/4.5/4.6/4.7
                   |(1-bit) bitfield            |Regression] Inliner bug
                   |                            |with one-bit (1-bit)
                   |                            |bitfield
     Ever Confirmed|0                           |1
      Known to fail|                            |4.3.3, 4.6.0, 4.7.0

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-12 07:19:50 UTC ---
Confirmed, started in between r110000 and r112000, but strangely works in 4.2
which has branched off in r117923.  Looking into it.

[Bug tree-optimization/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-12 08:29:09 UTC ---
Even smaller:

extern void abort (void);
struct S { int f : 1; } s;
int v = -1;

int
main ()
{
  s.f = v < 0;
  if ((unsigned int) s.f != -1U)
    abort ();
  return 0;
}

I'd say the bug is during expansion of a comparison with signed 1 bit type. 
Then the comparison needs to result 0 / -1 instead of 0 / 1.  I think it would
be difficult to adjust all the conditional expansion to handle this very rare
special case, so probably it will be better to expand such conditionals as
if it was unsigned:1 or unsigned char typed comparison, followed by cast from
that type to signed:1.

[Bug middle-end/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #6 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-05-12 09:00:59 UTC ---
"Fixed" with bitfield lowering where we expand from

  v.0_1 = v;
  BF.1_3 = MEM[(struct S *)&s];
  D.2700_4 = BF.1_3 & -2;
  D.2702_6 = v.0_1 < 0;
  BF.1_7 = D.2702_6 | D.2700_4;
  MEM[(struct S *)&s] = BF.1_7;
  D.2693_9 = (<unnamed-signed:1>) BF.1_7;
  D.2694_10 = (unsigned int) D.2693_9;
  if (D.2694_10 != 4294967295)

similar to what Jakub proposed to do manually.

[Bug middle-end/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |jakub at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-12 09:04:30 UTC ---
Created attachment 24235
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24235
gcc46-pr48973.patch

Untested fix.

[Bug middle-end/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-12 10:31:42 UTC ---
(In reply to comment #6)
> "Fixed" with bitfield lowering where we expand from
> 
>   v.0_1 = v;
>   BF.1_3 = MEM[(struct S *)&s];
>   D.2700_4 = BF.1_3 & -2;
>   D.2702_6 = v.0_1 < 0;
>   BF.1_7 = D.2702_6 | D.2700_4;
>   MEM[(struct S *)&s] = BF.1_7;
>   D.2693_9 = (<unnamed-signed:1>) BF.1_7;
>   D.2694_10 = (unsigned int) D.2693_9;
>   if (D.2694_10 != 4294967295)
> 
> similar to what Jakub proposed to do manually.

Well, if bitfield lowering does this and nothing cleans it up, there is room
for improvement.  It would be sad if it couldn't be optimized already at the
tree level back to:
   v.0_1 = v;
   BF.1_3 = MEM[(struct S *)&s];
   D.2700_4 = BF.1_3 & -2;
   D.2702_6 = v.0_1 < 0;
   BF.1_7 = D.2702_6 | D.2700_4;
   MEM[(struct S *)&s] = BF.1_7;
   D.2693_9 = (<unnamed-signed:1>) D.2702_6;  // change here.  Assuming D.2702
                                              // is either > 1 precision, or
                                              // unsigned
   D.2694_10 = (unsigned int) D.2693_9;
   if (D.2694_10 != 4294967295)

[Bug middle-end/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #9 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-05-12 11:36:21 UTC ---
(In reply to comment #8)
> (In reply to comment #6)
> > "Fixed" with bitfield lowering where we expand from
> > 
> >   v.0_1 = v;
> >   BF.1_3 = MEM[(struct S *)&s];
> >   D.2700_4 = BF.1_3 & -2;
> >   D.2702_6 = v.0_1 < 0;
> >   BF.1_7 = D.2702_6 | D.2700_4;
> >   MEM[(struct S *)&s] = BF.1_7;
> >   D.2693_9 = (<unnamed-signed:1>) BF.1_7;
> >   D.2694_10 = (unsigned int) D.2693_9;
> >   if (D.2694_10 != 4294967295)
> > 
> > similar to what Jakub proposed to do manually.
> 
> Well, if bitfield lowering does this and nothing cleans it up, there is room
> for improvement.  It would be sad if it couldn't be optimized already at the
> tree level back to:
>    v.0_1 = v;
>    BF.1_3 = MEM[(struct S *)&s];
>    D.2700_4 = BF.1_3 & -2;
>    D.2702_6 = v.0_1 < 0;
>    BF.1_7 = D.2702_6 | D.2700_4;
>    MEM[(struct S *)&s] = BF.1_7;
>    D.2693_9 = (<unnamed-signed:1>) D.2702_6;  // change here.  Assuming D.2702
>                                               // is either > 1 precision, or
>                                               // unsigned
>    D.2694_10 = (unsigned int) D.2693_9;
>    if (D.2694_10 != 4294967295)

Yeah, we can combine that with the comparison - but I'm not sure we
want to have compares with 1-bit precision quantities, do we?  Or
we want to optimize this to

  tem = D.2702_6 & CST;
  if (tem != 0)

instead?

[Bug middle-end/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-23 09:36:09 UTC ---
Author: jakub
Date: Mon May 23 09:36:05 2011
New Revision: 174060

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=174060
Log:
    PR middle-end/48973
    * expr.c (expand_expr_real_2) <case LT_EXPR>: If do_store_flag
    failed and the comparison has a single bit signed type, use
    constm1_rtx instead of const1_rtx for true value.
    (do_store_flag): If ops->type is single bit signed type, disable
    signel bit test optimization and pass -1 instead of 1 as last
    parameter to emit_store_flag_force.

    * gcc.c-torture/execute/pr48973-1.c: New test.
    * gcc.c-torture/execute/pr48973-2.c: New test.

Added:
    trunk/gcc/testsuite/gcc.c-torture/execute/pr48973-1.c
    trunk/gcc/testsuite/gcc.c-torture/execute/pr48973-2.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/expr.c
    trunk/gcc/testsuite/ChangeLog

[Bug middle-end/48973] [4.3/4.4/4.5/4.6/4.7 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-23 10:24:50 UTC ---
Author: jakub
Date: Mon May 23 10:24:47 2011
New Revision: 174063

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=174063
Log:
    PR middle-end/48973
    * expr.c (expand_expr_real_2) <case LT_EXPR>: If do_store_flag
    failed and the comparison has a single bit signed type, use
    constm1_rtx instead of const1_rtx for true value.
    (do_store_flag): If ops->type is single bit signed type, disable
    signel bit test optimization and pass -1 instead of 1 as last
    parameter to emit_store_flag_force.

    * gcc.c-torture/execute/pr48973-1.c: New test.
    * gcc.c-torture/execute/pr48973-2.c: New test.

Added:
    branches/gcc-4_6-branch/gcc/testsuite/gcc.c-torture/execute/pr48973-1.c
    branches/gcc-4_6-branch/gcc/testsuite/gcc.c-torture/execute/pr48973-2.c
Modified:
    branches/gcc-4_6-branch/gcc/ChangeLog
    branches/gcc-4_6-branch/gcc/expr.c
    branches/gcc-4_6-branch/gcc/testsuite/ChangeLog

[Bug middle-end/48973] [4.3/4.4/4.5 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.6.1, 4.7.0
            Summary|[4.3/4.4/4.5/4.6/4.7        |[4.3/4.4/4.5 Regression]
                   |Regression] Inliner bug     |Inliner bug with one-bit
                   |with one-bit (1-bit)        |(1-bit) bitfield
                   |bitfield                    |
      Known to fail|4.7.0                       |

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-05-23 10:46:55 UTC ---
Fixed for 4.6+ so far.

[Bug middle-end/48973] [4.3/4.4/4.5 Regression] Inliner bug with one-bit (1-bit) bitfield

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug middle-end/48973] [4.3/4.4/4.5 Regression] Inliner bug with one-bit (1-bit) bitfield

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.3.6                       |4.4.7

--- Comment #13 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-06-27 12:14:44 UTC ---
4.3 branch is being closed, moving to 4.4.7 target.

[Bug middle-end/48973] [4.4/4.5 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-07-19 12:46:42 UTC ---
Author: jakub
Date: Tue Jul 19 12:46:39 2011
New Revision: 176449

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=176449
Log:
    Backport from mainline
    2011-05-23  Jakub Jelinek  <jakub@redhat.com>

    PR middle-end/48973
    * expr.c (expand_expr_real_2) <case LT_EXPR>: If do_store_flag
    failed and the comparison has a single bit signed type, use
    constm1_rtx instead of const1_rtx for true value.
    (do_store_flag): If ops->type is single bit signed type, disable
    signel bit test optimization and pass -1 instead of 1 as last
    parameter to emit_store_flag_force.

    * gcc.c-torture/execute/pr48973-1.c: New test.
    * gcc.c-torture/execute/pr48973-2.c: New test.

Added:
    branches/gcc-4_5-branch/gcc/testsuite/gcc.c-torture/execute/pr48973-1.c
    branches/gcc-4_5-branch/gcc/testsuite/gcc.c-torture/execute/pr48973-2.c
Modified:
    branches/gcc-4_5-branch/gcc/ChangeLog
    branches/gcc-4_5-branch/gcc/expr.c
    branches/gcc-4_5-branch/gcc/testsuite/ChangeLog

[Bug middle-end/48973] [4.4/4.5 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-07-19 19:28:44 UTC ---
Author: jakub
Date: Tue Jul 19 19:28:41 2011
New Revision: 176482

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=176482
Log:
    Backport from mainline
    2011-05-23  Jakub Jelinek  <jakub@redhat.com>

    PR middle-end/48973
    * expr.c (expand_expr_real_1) <case LT_EXPR>: If do_store_flag
    failed and the comparison has a single bit signed type, use
    constm1_rtx instead of const1_rtx for true value.
    (do_store_flag): If TREE_TYPE (exp) is single bit signed type, disable
    single bit test optimization, pass -1 instead of 1 as last
    parameter to emit_store_flag and use constm1_rtx instead of
    const1_rtx as true value.

    * gcc.c-torture/execute/pr48973-1.c: New test.
    * gcc.c-torture/execute/pr48973-2.c: New test.

Added:
    branches/gcc-4_4-branch/gcc/testsuite/gcc.c-torture/execute/pr48973-1.c
    branches/gcc-4_4-branch/gcc/testsuite/gcc.c-torture/execute/pr48973-2.c
Modified:
    branches/gcc-4_4-branch/gcc/ChangeLog
    branches/gcc-4_4-branch/gcc/expr.c
    branches/gcc-4_4-branch/gcc/testsuite/ChangeLog

[Bug middle-end/48973] [4.4/4.5 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #16 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-07-19 19:50:22 UTC ---
Fixed.

[Bug middle-end/48973] [4.4/4.5 Regression] Inliner bug with one-bit (1-bit) bitfield

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48973

--- Comment #17 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-07-21 09:39:19 UTC ---
Author: jakub
Date: Thu Jul 21 09:39:16 2011
New Revision: 176555

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=176555
Log:
    PR middle-end/48973
    * expr.c (expand_expr_real_1) <case TRUTH_ANDIF_EXPR>: If
    the comparison has a single bit signed type, use
    constm1_rtx instead of const1_rtx for true value.

Modified:
    branches/gcc-4_4-branch/gcc/ChangeLog
    branches/gcc-4_4-branch/gcc/expr.c