[Bug c++/53364] New: [4.7/4.8 Regression] Wrong code generation

[Bug c++/53364] New: [4.7/4.8 Regression] Wrong code generation

[foom at fuhm dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

             Bug #: 53364
           Summary: [4.7/4.8 Regression] Wrong code generation
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: foom@fuhm.net


On the following code, minimized from a much larger program:

test.cpp
=====================
#include <algorithm>

struct A
{
    int m_x;

    explicit A(int x) : m_x(x) {}
    operator int() const { return m_x; }
};

struct B : public A
{
 public:
    explicit B(int x)
    : A(x) {}
};

int data = 1;

int main() {
    B b = B(10);
    b = std::min(b, B(data));
    return int(b);
}
=================

Running: g++ -O2 -c test.cpp
With gcc version: g++ (Debian 4.7.0-8) 4.7.0
(which says it's built from r187339 on the gcc 4.7 branch).
On architecture: x86-64

The program ought to return 1, but instead, it returns randomness. Running
valgrind confirms that this program is using uninitialized values.

Testing with the debian gcc-snapshot package (trunk rev 187013) shows the same
bug.
Testing with the debian gcc 4.6.3 package does not show the bug.
Using -O1 does not show the bug.
Using -O1 -fstrict-aliasing shows the bug.

[Bug c++/53364] [4.7/4.8 Regression] Wrong code generation

[foom at fuhm dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

--- Comment #1 from foom at fuhm dot net 2012-05-16 04:10:59 UTC ---
Asm generated. Note that at no point is anything ever actually written to the
stack, only read from it:

0000000000000000 <main>:
   0:    83 3d 00 00 00 00 09     cmpl   $0x9,0x0(%rip)        # 7 <main+0x7>
   7:    48 8d 44 24 e8           lea    -0x18(%rsp),%rax
   c:    48 8d 54 24 d8           lea    -0x28(%rsp),%rdx
  11:    48 0f 4f c2              cmovg  %rdx,%rax
  15:    8b 00                    mov    (%rax),%eax
  17:    c3                       retq   


Making what ought to be a no-op change to the program, using class "A" instead
of "B", thus:
int main() {
    A a = A(10);
    a = std::min(a, A(data));
    return int(a);
}
causes the following, correctly working, asm to be generated. This is the same
output generated by adding "-fno-strict-aliasing" to the compile line for the
original program. See that it now does write values onto the stack locations
being read from.

(It also seems rather crazy to me that gcc doesn't optimize such a simple
program to use purely registers and no stack addresses, but I suppose that's a
different bug.)

0000000000000000 <main>:
   0:    8b 15 00 00 00 00        mov    0x0(%rip),%edx        # 6 <main+0x6>
   6:    48 8d 44 24 e8           lea    -0x18(%rsp),%rax
   b:    48 8d 4c 24 d8           lea    -0x28(%rsp),%rcx
  10:    c7 44 24 d8 0a 00 00     movl   $0xa,-0x28(%rsp)
  17:    00 
  18:    83 fa 09                 cmp    $0x9,%edx
  1b:    89 54 24 e8              mov    %edx,-0x18(%rsp)
  1f:    48 0f 4f c1              cmovg  %rcx,%rax
  23:    8b 00                    mov    (%rax),%eax
  25:    c3                       retq

[Bug c++/53364] [4.7/4.8 Regression] Wrong code generation

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-05-16 04:13:07 UTC ---
Does -fno-tree-vrp fix the issue?

[Bug c++/53364] [4.7/4.8 Regression] Wrong code generation

[foom at fuhm dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

--- Comment #3 from foom at fuhm dot net 2012-05-16 04:28:21 UTC ---
> Does -fno-tree-vrp fix the issue?

Nope, "g++ -O2 -fno-tree-vrp -c test.cpp" is no different than without.

[Bug c++/53364] [4.7/4.8 Regression] Wrong code generation

[glisse at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

--- Comment #4 from Marc Glisse <glisse at gcc dot gnu.org> 2012-05-16 07:11:35 UTC ---
Looking at -fdump-tree-all, 081t.phicprop1 is still the same for -O1 and -O2,
but O82t.dse1 is missing the memory writes for -O2.

[Bug tree-optimization/53364] [4.7/4.8 Regression] Wrong code generation

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-05-16
          Component|c++                         |tree-optimization
      Known to work|                            |4.6.3
   Target Milestone|---                         |4.7.1
     Ever Confirmed|0                           |1
      Known to fail|                            |4.7.1

--- Comment #5 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-05-16 10:28:58 UTC ---
Confirmed.  Reduced testcase:

extern "C" void abort (void);

template<typename _Tp>
inline const _Tp&
min(const _Tp& __a, const _Tp& __b)
{
  if (__b < __a)
    return __b;
  return __a;
}

struct A
{
  int m_x;

  explicit A(int x) : m_x(x) {}
  operator int() const { return m_x; }
};

struct B : public A
{
public:
  explicit B(int x) : A(x) {}
};

int data = 1;

int main()
{
  B b = B(10);
  b = min(b, B(data));
  if (b != 1)
    abort ();
  return 0;
}

[Bug tree-optimization/53364] [4.7/4.8 Regression] Wrong code generation

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |

--- Comment #6 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-05-16 10:31:10 UTC ---
Mine.

[Bug tree-optimization/53364] [4.7/4.8 Regression] Wrong code generation

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

--- Comment #7 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-05-16 11:07:46 UTC ---
This is aliasing_component_refs_p returning that *D.2309_15 does not
alias MEM[(struct A *)&D.2249].m_x (This is *(struct B *)&D.2249 vs.
*(struct A *)&D.2249)

This is because this is a view-converted base but we don't detect that
properly in indirect_ref_may_alias_decl_p.

I have a patch.

[Bug tree-optimization/53364] [4.7/4.8 Regression] Wrong code generation

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

--- Comment #8 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-05-16 13:08:38 UTC ---
Author: rguenth
Date: Wed May 16 13:08:33 2012
New Revision: 187589

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=187589
Log:
2012-05-16  Richard Guenther  <rguenther@suse.de>

    PR tree-optimization/53364
    * tree-ssa-alias.c (indirect_ref_may_alias_decl_p): Properly
    detect a view-conversion of the decl.

    * g++.dg/torture/pr53364.C: New testcase.

Added:
    branches/gcc-4_7-branch/gcc/testsuite/g++.dg/torture/pr53364.C
Modified:
    branches/gcc-4_7-branch/gcc/ChangeLog
    branches/gcc-4_7-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_7-branch/gcc/tree-ssa-alias.c

[Bug tree-optimization/53364] [4.7/4.8 Regression] Wrong code generation

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

--- Comment #9 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-05-16 13:11:08 UTC ---
Author: rguenth
Date: Wed May 16 13:11:01 2012
New Revision: 187590

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=187590
Log:
2012-05-16  Richard Guenther  <rguenther@suse.de>

    PR tree-optimization/53364
    * tree-ssa-alias.c (indirect_ref_may_alias_decl_p): Properly
    detect a view-conversion of the decl.

    * g++.dg/torture/pr53364.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr53364.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-alias.c

[Bug tree-optimization/53364] [4.7/4.8 Regression] Wrong code generation

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53364

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #10 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-05-16 13:12:46 UTC ---
Fixed.  Possibly latent on the 4.6 branch.