[Bug c++/53239] New: [4.7 Regression] -ftree-vrp breaks min()

[Bug c++/53239] New: [4.7 Regression] -ftree-vrp breaks min()

[proski at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

             Bug #: 53239
           Summary: [4.7 Regression] -ftree-vrp breaks min()
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: proski@gnu.org


GNU Lilypond is miscompiled on Fedora 17.  It manifests as a failure to process
any non-trivial input.  Both i386 and x86_64 are affected.

$ gcc --version
gcc (GCC) 4.7.0 20120502 (Red Hat 4.7.0-3)

It turns out that adding -fno-tree-vrp fixes the problem.  A call to min() is
affected.  Comparing the assembly output without and with -fno-tree-vrp shows
that the generated assembly code wrongly eliminates a conditional register move
after calling the compare (_ZN6Moment7compareERKS_S1_) function.

The attached file was generated on i386.

Credit for finding a problem in the assembly goes to David Kastrup.

[Bug c++/53239] [4.7 Regression] -ftree-vrp breaks min()

[proski at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #1 from proski at gnu dot org 2012-05-04 21:43:11 UTC ---
Created attachment 27310
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=27310
Example (made on i386)

This line is miscompiled:
next = min (next, it->pending_moment ());
The result of comparison in min() is unused unless the -fno-tree-vrp option is
used.

[Bug c++/53239] [4.7 Regression] -ftree-vrp breaks min()

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-05-04 21:54:03 UTC ---
  s_6 = this_5(D)->children_list_;
  x.4_39 = (long unsigned int) s_6;
  D.36426_37 = x.4_39 & 6;

I think the code is depending on undefined code dealing with alignment
requirements on pointers.

[Bug c++/53239] [4.7 Regression] -ftree-vrp breaks min()

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-05-04 21:55:04 UTC ---
  prephitmp.102_38 = MEM[(struct scm_unused_struct * *)s_6];
  D.36424_34 = (long unsigned int) prephitmp.102_38;
  D.36423_40 = D.36424_34 & 1;

Is the real place.

[Bug middle-end/53239] [4.7 Regression] VRP vs named value return opt

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-05-04
          Component|c++                         |middle-end
            Summary|[4.7 Regression] -ftree-vrp |[4.7 Regression] VRP vs
                   |breaks min()                |named value return opt
     Ever Confirmed|0                           |1

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-05-04 22:02:59 UTC ---
Actually the following is what is being removed:
  if (D.36751_45 < 0)
    goto <bb 6>;
  else
    goto <bb 7>;

<bb 6>:

<bb 7>:
  # D.36747_44 = PHI <<retval>_2(D)(6), &D.35100(5)>

So it is not VRP really as it is doing something fine.  It is just we say
<retval>_2 is uninitialized.

[Bug middle-end/53239] [4.7 Regression] VRP vs named value return opt

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> 2012-05-04 23:20:49 UTC ---
Is there a self-contained run-time testcase?

[Bug middle-end/53239] [4.7 Regression] VRP vs named value return opt

[proski at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #6 from proski at gnu dot org 2012-05-07 02:50:04 UTC ---
Created attachment 27330
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=27330
Self-contained test case

Run the "compile" script.  The output would be:

return = 2/1
return = 1/1

It means that the output depends on whether -fno-tree-vrp is used.

[Bug tree-optimization/53239] [4.7 Regression] VRP vs named value return opt

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
          Component|middle-end                  |tree-optimization

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-05-07 07:08:30 UTC ---
VRP bug.

[Bug tree-optimization/53239] [4.7 Regression] VRP vs named value return opt

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |jakub at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-05-07 07:13:44 UTC ---
Created attachment 27331
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=27331
gcc47-pr53239.patch

Untested fix.

[Bug tree-optimization/53239] [4.7 Regression] VRP vs named value return opt

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.7.1

[Bug tree-optimization/53239] [4.7 Regression] VRP vs named value return opt

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #9 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-05-07 09:33:56 UTC ---
Doh.  Patch looks ok.

[Bug tree-optimization/53239] [4.7 Regression] VRP vs named value return opt

[proski at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #10 from proski at gnu dot org 2012-05-07 12:35:40 UTC ---
I applied the patch to gcc 4.7.0 and tested it with my example and GNU
Lilypond.  Both are fixed.  Thanks!

[Bug tree-optimization/53239] [4.7/4.8 Regression] VRP vs named value return opt

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[4.7 Regression] VRP vs     |[4.7/4.8 Regression] VRP vs
                   |named value return opt      |named value return opt

--- Comment #11 from H.J. Lu <hjl.tools at gmail dot com> 2012-05-07 13:22:13 UTC ---
This is caused by revision 176918:

http://gcc.gnu.org/ml/gcc-cvs/2011-07/msg01186.html

Does the fix improve gcc.dg/uninit-suppress.c/gcc.dg/uninit-suppress_2.c?

[Bug tree-optimization/53239] [4.7/4.8 Regression] VRP vs named value return opt

[dak at gnu dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

David Kastrup <dak at gnu dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dak at gnu dot org

--- Comment #12 from David Kastrup <dak at gnu dot org> 2012-05-07 13:31:03 UTC ---
Unrelated question: this kind of code is quite common in connection with
user-defined arithmetic classes.  While I understand that changing the bug
priority from "P3 normal" will likely do nothing with regard to which releases
of gcc the fix will appear in, it might make a difference for distributors that
tend to cherry-pick important fixes ahead of regular releases.  For example,
the next release of Fedora is slated to be delivered using gcc 4.7.0, and its
miscompilation of LilyPond, a bonafide application, was what triggered this
report.

Given that the triggering pattern is quite typical for C++ and the problem
being present on all architectures, it might make sense to adjust the priority.

[Bug tree-optimization/53239] [4.7/4.8 Regression] VRP vs named value return opt

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-05-07 13:31:08 UTC ---
Author: jakub
Date: Mon May  7 13:31:00 2012
New Revision: 187240

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=187240
Log:
    PR tree-optimization/53239
    * tree-vrp.c (get_value_range): Set VR of
    SSA_NAME_IS_DEFAULT_DEF of DECL_BY_REFERENCE RESULT_DECL
    to nonnull.

    * g++.dg/opt/vrp3.C: New test.
    * g++.dg/opt/vrp3-aux.cc: New file.
    * g++.dg/opt/vrp3.h: New file.

Added:
    trunk/gcc/testsuite/g++.dg/opt/vrp3-aux.cc
    trunk/gcc/testsuite/g++.dg/opt/vrp3.C
    trunk/gcc/testsuite/g++.dg/opt/vrp3.h
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-vrp.c

[Bug tree-optimization/53239] [4.7/4.8 Regression] VRP vs named value return opt

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-05-07 13:33:34 UTC ---
Author: jakub
Date: Mon May  7 13:33:27 2012
New Revision: 187241

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=187241
Log:
    PR tree-optimization/53239
    * tree-vrp.c (get_value_range): Set VR of
    SSA_NAME_IS_DEFAULT_DEF of DECL_BY_REFERENCE RESULT_DECL
    to nonnull.

    * g++.dg/opt/vrp3.C: New test.
    * g++.dg/opt/vrp3-aux.cc: New file.
    * g++.dg/opt/vrp3.h: New file.

Added:
    branches/gcc-4_7-branch/gcc/testsuite/g++.dg/opt/vrp3-aux.cc
    branches/gcc-4_7-branch/gcc/testsuite/g++.dg/opt/vrp3.C
    branches/gcc-4_7-branch/gcc/testsuite/g++.dg/opt/vrp3.h
Modified:
    branches/gcc-4_7-branch/gcc/ChangeLog
    branches/gcc-4_7-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_7-branch/gcc/tree-vrp.c

[Bug tree-optimization/53239] [4.7/4.8 Regression] VRP vs named value return opt

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53239

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-05-16 15:24:11 UTC ---
Fixed.