[Bug tree-optimization/50729] New: Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[Bug tree-optimization/50729] New: Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[mgretton at sourceware dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

             Bug #: 50729
           Summary: Silent code gen fault: Value range propagation seems
                    to propagate values across narrowing/widening
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: mgretton@sourceware.org
            Target: arm*-*-*


Created attachment 25497
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25497
Executable test case.

The attached executable test rtest.c fails when compiled and executed as
follows:

$ arm-none-eabi-gcc rtest.c -O2 -o rtest.axf
$ ~ramrad01/public/qemu-arm rtest.axf 
1616
20019
FAIL!!

The test consists of two identical functions f0a and f0b which are compiled
with different optimization levels, and produce different results at -O0 and
-O2.

Investigations lead me to believe that VRP is at fault - initially because the
issue goes away if you compile -O2 -fdisable-tree-vrp1 -fdisable-tree-vrp2.

The attached cutdown testcase (rtest-cutdown.c) when compiled as follows
produces the attached tree dumps.

$ arm-none-eabi-gcc rtest-cutdown.c -O2 -o rtest.axf -fdump-tree-all

Looking at the difference between the two attached trees indicates that before
VRP1 the tree looked something like:

  int8_t temp_1;
  uint64_t D.6414;
  short unsigned int D.6416;
  temp_1_27 = (int8_t) D.6414_26;
  D.6416_33 = (short unsigned int) temp_1_27;

[note short unsigned int is 16-bits]

VRP1's analysis finds the following:

D.6414_26: [0, 4611686018427388031]
temp_1_27: VARYING

After VRP1 this bit of tree is transformed into:

  int8_t temp_1;
  uint64_t D.6414;
  short unsigned int D.6416;
  temp_1_27 = (int8_t) D.6414_26;
  D.6416_33 = (short unsigned int) D.6414_26;

That is D.6416_33 is now assigned directly from D.6414_26 instead of going
through temp_1_27.

[Similar replacements of temp_1_27 by D.6414_26 occur throughout the example
but this particular case serves its purpose].

This is incorrect as it stops the 64-bit value D6414_26 being narrowed to an
8-bit signed value before being widened to a 16-bit, now it just gets narrowed
from 64-bits to 16-bits.

[Bug tree-optimization/50729] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[mgretton at sourceware dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

--- Comment #1 from Matthew Gretton-Dann <mgretton at sourceware dot org> 2011-10-14 13:40:14 UTC ---
Created attachment 25498
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25498
Cutdown pre-processed non-executable testcase

[Bug tree-optimization/50729] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[mgretton at sourceware dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

--- Comment #2 from Matthew Gretton-Dann <mgretton at sourceware dot org> 2011-10-14 13:49:15 UTC ---
Created attachment 25499
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25499
Tree just before VRP

[Bug tree-optimization/50729] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[mgretton at sourceware dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

--- Comment #3 from Matthew Gretton-Dann <mgretton at sourceware dot org> 2011-10-14 13:49:50 UTC ---
Created attachment 25500
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25500
VRP1 Analysis and resultant tree

[Bug tree-optimization/50729] [4.7 Regression] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2011-10-14
      Known to work|                            |4.6.2
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |
   Target Milestone|---                         |4.7.0
            Summary|Silent code gen fault:      |[4.7 Regression] Silent
                   |Value range propagation     |code gen fault: Value range
                   |seems to propagate values   |propagation seems to
                   |across narrowing/widening   |propagate values across
                   |                            |narrowing/widening
     Ever Confirmed|0                           |1

--- Comment #4 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-10-14 14:04:26 UTC ---
Confirmed, mine.

[Bug tree-optimization/50729] [4.7 Regression] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

--- Comment #5 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-10-17 12:23:04 UTC ---
Author: rguenth
Date: Mon Oct 17 12:22:54 2011
New Revision: 180087

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=180087
Log:
2011-10-17  Richard Guenther  <rguenther@suse.de>

    PR tree-optimization/50729
    * tree-vrp.c (extract_range_from_unary_expr_1): Remove
    redundant test.
    (simplify_conversion_using_ranges): Properly test the
    intermediate result.

    * gcc.dg/torture/pr50729.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr50729.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-vrp.c

[Bug tree-optimization/50729] [4.7 Regression] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-10-17 12:57:18 UTC ---
Fixed.

[Bug tree-optimization/50729] [4.7 Regression] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[amylaar at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

Jorn Wolfgang Rennecke <amylaar at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
                 CC|                            |amylaar at gcc dot gnu.org
         Resolution|FIXED                       |

--- Comment #7 from Jorn Wolfgang Rennecke <amylaar at gcc dot gnu.org> 2011-11-18 23:13:49 UTC ---
When innerop is unsigned, and middleop is signed, the value computed
for middlemax is bogus.
The original test would catch that condition, the new test doesn't.

[Bug tree-optimization/50729] [4.7 Regression] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[amylaar at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

--- Comment #8 from Jorn Wolfgang Rennecke <amylaar at gcc dot gnu.org> 2011-11-19 00:03:56 UTC ---
More specifically, the problem appears when innerop has a different signedness
than middleop, and the value range of middleop is such that the topmost bit
of a double_int is used.
E.g. the full value range of a 64 bit long long with 32 bit HOST_WIDE_INT,
or a 128 bit integer type with a 64 bit HOST_WIDE_INT.

OTOH both the old and the new test will reject some simplifications that
would be OK when considering a narrow finaltype, and/or same-size
signed/unsigned conversion.

The basic problem is that when a signedness change happens, we are no longer
necessarily considering a single range, but possibly two.

[Bug tree-optimization/50729] [4.7 Regression] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[amylaar at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

--- Comment #9 from Jorn Wolfgang Rennecke <amylaar at gcc dot gnu.org> 2011-11-19 02:06:36 UTC ---
I've added a patch attachment to PR50802 that replaces the test.

[Bug tree-optimization/50729] [4.7 Regression] Silent code gen fault: Value range propagation seems to propagate values across narrowing/widening

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50729

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #10 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-12-06 12:04:45 UTC ---
Fixed.