[Bug middle-end/53922] New: VRP: semantic conflict between range_includes_zero_p and value_inside_range

[Bug middle-end/53922] New: VRP: semantic conflict between range_includes_zero_p and value_inside_range

[amker.cheng at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

             Bug #: 53922
           Summary: VRP: semantic conflict between range_includes_zero_p
                    and value_inside_range
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: amker.cheng@gmail.com


In tree-vrp.c
function value_inside_range returns:
          1 if VAL is inside value range VR (VR->MIN <= VAL <= VR->MAX),
          0 if VAL is not inside VR,
     -2 if we cannot tell either way.

While in function range_includes_zero_p, it:
         return (value_inside_range (zero, vr) == 1);
which is bogus.
Because when value_inside_range returns -2, there is the possibility that value
range includes zero.

For example:

int x(int a)
{
    return a;
}
int y(int a) __attribute__ ((weak));
int (*scan_func)(int);
extern int g;
int g = 0;
int main()
{
    if (g)
        scan_func = x;
    else
        scan_func = y;

    if (scan_func)
        g = scan_func(10);

    return 0;
}

compiled with command line:
arm-none-eabi-gcc -mthumb -mcpu=cortex-m3 -Os -S test.c -o test.S
-fdump-tree-all

The dump of vrp2 pass is:
main ()
{
  int (*<Tcc0>) (int) cstore.6;
  int g.2;
  int g.0;

<bb 2>:
  g.0_1 = g;
  if (g.0_1 != 0)
    goto <bb 3>;
  else
    goto <bb 4>;

<bb 3>:

<bb 4>:
  # cstore.6_9 = PHI <x(3), y(2)>
  scan_func = cstore.6_9;
  g.2_4 = cstore.6_9 (10);
  g = g.2_4;
  return 0;

}

Though the problem shows up with this case in gcc4.6 branch and -Os option on
arm, I think it exists in 4.7/4.8 too, just concealed by different gimple
statements.

I will work out a patch for this.

[Bug middle-end/53922] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #1 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-11 07:35:38 UTC ---
The disparity between those functions is a (documented) red herring.  Are you
saying we miscompile something here?

[Bug middle-end/53922] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[amker.cheng at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

--- Comment #2 from amker.cheng <amker.cheng at gmail dot com> 2012-07-11 08:03:11 UTC ---
Yes, the dump before pass vrp2 is like:
main ()
{
  int (*<Tcc0>) (int) cstore.6;
  int g.2;
  int g.0;

<bb 2>:
  g.0_1 = g;
  if (g.0_1 != 0)
    goto <bb 3>;
  else
    goto <bb 4>;

<bb 3>:

<bb 4>:
  # cstore.6_9 = PHI <x(3), y(2)>
  scan_func = cstore.6_9;
  if (cstore.6_9 != 0B)
    goto <bb 5>;
  else
    goto <bb 6>;

<bb 5>:
  g.2_4 = cstore.6_9 (10);
  g = g.2_4;

<bb 6>:
  return 0;

}

gcc parses "# cstore.6_9 = PHI <x(3), y(2)>" and asserts that cstore.6_9
non-zero, then folds predicate cstore.6_9 != 0B to 1, which is wrong, because
weak symbol y could be zero.

[Bug middle-end/53922] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[amker.cheng at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

--- Comment #3 from amker.cheng <amker.cheng at gmail dot com> 2012-07-11 10:12:24 UTC ---
vrp processes PHI node " # cstore.6_9 = PHI <x(3), y(2)>" in calling sequence:
vrp_visit_phi_node
  -> vrp_meet

When gcc gives up in function vrp_meet, it executes following code to derive an
anti-range against zero:

give_up:
  /* Failed to find an efficient meet.  Before giving up and setting
     the result to VARYING, see if we can at least derive a useful
     anti-range.  FIXME, all this nonsense about distinguishing
     anti-ranges from ranges is necessary because of the odd
     semantics of range_includes_zero_p and friends.  */
  if (!symbolic_range_p (vr0)
      && ((vr0->type == VR_RANGE && !range_includes_zero_p (vr0))
      || (vr0->type == VR_ANTI_RANGE && range_includes_zero_p (vr0)))
      && !symbolic_range_p (vr1)
      && ((vr1->type == VR_RANGE && !range_includes_zero_p (vr1))
      || (vr1->type == VR_ANTI_RANGE && range_includes_zero_p (vr1))))
    {
      set_value_range_to_nonnull (vr0, TREE_TYPE (vr0->min));

      /* Since this meet operation did not result from the meeting of
     two equivalent names, VR0 cannot have any equivalences.  */
      if (vr0->equiv)
    bitmap_clear (vr0->equiv);
    }

Here vr0 is for "x" in source code, while vr1 for "y" in source code, which is
a weak symbol.

function range_includes_zero_p check whether vr1 includes zero by calling
value_inside_range. The value_inside_range works well by returning -2, because
of the WEAK symbol. After that, range_includes_zero_p checks whether return
value of value_inside_range equals 1. Finally in vrp_meet, condition
"((vr1->type == VR_RANGE && !range_includes_zero_p (vr1))" holds, resulting in
gcc asserting cstore.6_9 non-zero.

Am I missing something?

[Bug tree-optimization/53922] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2012-07-11
          Component|middle-end                  |tree-optimization
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |
     Ever Confirmed|0                           |1

--- Comment #4 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-11 11:36:09 UTC ---
The issue is that range_includes_zero_p can not return "I don't know" and
dependent on the use the conservative answer is wrong.

Let me fix this.

[Bug tree-optimization/53922] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

--- Comment #5 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-11 12:28:57 UTC ---
Created attachment 27774
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=27774
untested patch

[Bug tree-optimization/53922] [4.6/4.7/4.8 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|rguenth at gcc dot gnu.org  |
      Known to work|                            |4.0.4
   Target Milestone|---                         |4.6.4
            Summary|VRP: semantic conflict      |[4.6/4.7/4.8 Regression]
                   |between                     |VRP: semantic conflict
                   |range_includes_zero_p and   |between
                   |value_inside_range          |range_includes_zero_p and
                   |                            |value_inside_range
      Known to fail|                            |4.1.2

--- Comment #6 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-13 09:56:04 UTC ---
Testing the patch.  Fails since we introduced VRP.

[Bug tree-optimization/53922] [4.6/4.7/4.8 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

--- Comment #7 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-13 11:21:45 UTC ---
Author: rguenth
Date: Fri Jul 13 11:21:39 2012
New Revision: 189461

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=189461
Log:
2012-07-13  Richard Guenther  <rguenther@suse.de>

    PR tree-optimization/53922
    * tree-vrp.c (value_inside_range): Change prototype to take
    min/max instead of value-range.
    (range_includes_zero_p): Likewise.  Return the result from
    value_inside_range.
    (extract_range_from_binary_expr_1): Adjust to handle dont-know
    return value from range_includes_zero_p.
    (extract_range_from_unary_expr_1): Likewise.
    (compare_range_with_value): Likewise.
    (vrp_meet_1): Likewise.

    * gcc.dg/torture/pr53922.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr53922.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-vrp.c

[Bug tree-optimization/53922] [4.6/4.7 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.8.0
            Summary|[4.6/4.7/4.8 Regression]    |[4.6/4.7 Regression] VRP:
                   |VRP: semantic conflict      |semantic conflict between
                   |between                     |range_includes_zero_p and
                   |range_includes_zero_p and   |value_inside_range
                   |value_inside_range          |

--- Comment #8 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-13 11:41:13 UTC ---
Fixed for 4.8.0 sofar.

[Bug tree-optimization/53922] [4.6/4.7 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/53922] [4.6/4.7 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

--- Comment #9 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-09-07 13:04:42 UTC ---
Author: rguenth
Date: Fri Sep  7 13:04:38 2012
New Revision: 191072

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=191072
Log:
2012-09-07  Richard Guenther  <rguenther@suse.de>

    Backport from mainline
    2012-07-13  Richard Guenther  <rguenther@suse.de>

    PR tree-optimization/53922
    * tree-vrp.c (value_inside_range): Change prototype to take
    min/max instead of value-range.
    (range_includes_zero_p): Likewise.  Return the result from
    value_inside_range.
    (extract_range_from_binary_expr_1): Adjust to handle dont-know
    return value from range_includes_zero_p.
    (extract_range_from_unary_expr_1): Likewise.
    (compare_range_with_value): Likewise.
    (vrp_meet_1): Likewise.

    * gcc.dg/torture/pr53922.c: New testcase.

Added:
    branches/gcc-4_7-branch/gcc/testsuite/gcc.dg/torture/pr53922.c
Modified:
    branches/gcc-4_7-branch/gcc/ChangeLog
    branches/gcc-4_7-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_7-branch/gcc/tree-vrp.c

[Bug tree-optimization/53922] [4.6 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.7.2
            Summary|[4.6/4.7 Regression] VRP:   |[4.6 Regression] VRP:
                   |semantic conflict between   |semantic conflict between
                   |range_includes_zero_p and   |range_includes_zero_p and
                   |value_inside_range          |value_inside_range

--- Comment #10 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-09-07 13:05:53 UTC ---
And 4.7.

[Bug tree-optimization/53922] [4.6 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[howarth at nitro dot med.uc.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Jack Howarth <howarth at nitro dot med.uc.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |howarth at nitro dot
                   |                            |med.uc.edu

--- Comment #11 from Jack Howarth <howarth at nitro dot med.uc.edu> 2012-09-22 23:46:14 UTC ---
The new gcc.dg/torture/pr53922.c testcase fails on darwin. The darwin linker
developer had the following comments...

---------------------------------------
This is a feature that darwin does not support:

 int y(int a) __attribute__ ((weak));

This is a function prototype marked "weak".  In the linux world, this tells the
static linker it is ok for there to be no definition
+of the function y - just make a PLT entry as if it was found is some shared
object, and somehow it will be magically found at
+runtime.

Darwin uses two-level namespace where the static linker needs to record in
which dylib (shared object) each undefined symbol was
+found.  If the symbol cannot be found at static link time, it is an error.

You can make this example work by adding
 -undefined dynamic_lookup

to the link line which tells the static linker to assume any unresolved symbol
will be magically found at runtime.

-------------------------------------
Adding...

/* { dg-options "-Wl,-undefined,dynamic_lookup" { target *-*-darwin* } } */


is confirmed to allow all of the gcc.dg/torture/pr53922.c tests to pass at
-m32/-m64 on x86_64-apple-darwin11.

[Bug tree-optimization/53922] [4.6 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

--- Comment #12 from Dominique d'Humieres <dominiq at lps dot ens.fr> 2012-09-23 10:32:11 UTC ---
> The new gcc.dg/torture/pr53922.c testcase fails on darwin. ...

This is pr54083.

[Bug tree-optimization/53922] [4.6 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[fang at csl dot cornell.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

David Fang <fang at csl dot cornell.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fang at csl dot cornell.edu

--- Comment #13 from David Fang <fang at csl dot cornell.edu> 2012-09-27 21:28:16 UTC ---
http://gcc.gnu.org/ml/gcc-testresults/2012-09/msg02736.html

(4.7.2 test-results) shows similar failures on powerpc-darwin8

[Bug tree-optimization/53922] [4.6 Regression] VRP: semantic conflict between range_includes_zero_p and value_inside_range

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53922

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|4.6.4                       |4.7.2

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-12 16:27:41 UTC ---
The 4.6 branch has been closed, fixed in GCC 4.7.2.