[Bug c++/55559] New: Marshalling double through union with inlines, incorrect behavior with -O2

[Bug c++/55559] New: Marshalling double through union with inlines, incorrect behavior with -O2

[mpreda at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

             Bug #: 55559
           Summary: Marshalling double through union with inlines,
                    incorrect behavior with -O2
    Classification: Unclassified
           Product: gcc
           Version: 4.7.2
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: mpreda@gmail.com


Created attachment 28848
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28848
.ii preprocessed source

The following simple program returns different results depending on being
compiled with / without -O2.

The expected result is (unsigned)-1, but the observed result with -O2 is 0.

//----------
union V {
    long long v;
    double dbl;
};

inline long long VAL_NUM(double d)   { return V{dbl: d}.v; }
inline double GET_NUM(long long val) { return V{v: val}.dbl; }

int main() {
    return (unsigned) GET_NUM(VAL_NUM(-1));
}
//---------

gcc -v -save-temps -std=c++11 -Wall bug.cpp
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/4.7/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu/Linaro
4.7.2-2ubuntu1' --with-bugurl=file:///usr/share/doc/gcc-4.7/README.Bugs
--enable-languages=c,c++,go,fortran,objc,obj-c++ --prefix=/usr
--program-suffix=-4.7 --enable-shared --enable-linker-build-id
--with-system-zlib --libexecdir=/usr/lib --without-included-gettext
--enable-threads=posix --with-gxx-include-dir=/usr/include/c++/4.7
--libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu
--enable-libstdcxx-debug --enable-libstdcxx-time=yes --enable-gnu-unique-object
--enable-plugin --enable-objc-gc --disable-werror --with-arch-32=i686
--with-tune=generic --enable-checking=release --build=x86_64-linux-gnu
--host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 4.7.2 (Ubuntu/Linaro 4.7.2-2ubuntu1) 
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-std=c++11' '-Wall' '-mtune=generic'
'-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/4.7/cc1plus -E -quiet -v -imultiarch
x86_64-linux-gnu -D_GNU_SOURCE bug.cpp -mtune=generic -march=x86-64 -std=c++11
-Wall -fpch-preprocess -fstack-protector -o bug.ii
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory
"/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../x86_64-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/include/c++/4.7
 /usr/include/c++/4.7/x86_64-linux-gnu
 /usr/include/c++/4.7/backward
 /usr/lib/gcc/x86_64-linux-gnu/4.7/include
 /usr/local/include
 /usr/lib/gcc/x86_64-linux-gnu/4.7/include-fixed
 /usr/include/x86_64-linux-gnu
 /usr/include
End of search list.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-std=c++11' '-Wall' '-mtune=generic'
'-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/4.7/cc1plus -fpreprocessed bug.ii -quiet
-dumpbase bug.cpp -mtune=generic -march=x86-64 -auxbase bug -Wall -std=c++11
-version -fstack-protector -o bug.s
GNU C++ (Ubuntu/Linaro 4.7.2-2ubuntu1) version 4.7.2 (x86_64-linux-gnu)
    compiled by GNU C version 4.7.2, GMP version 5.0.2, MPFR version 3.1.0-p3,
MPC version 0.9
warning: GMP header version 5.0.2 differs from library version 5.0.5.
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
GNU C++ (Ubuntu/Linaro 4.7.2-2ubuntu1) version 4.7.2 (x86_64-linux-gnu)
    compiled by GNU C version 4.7.2, GMP version 5.0.2, MPFR version 3.1.0-p3,
MPC version 0.9
warning: GMP header version 5.0.2 differs from library version 5.0.5.
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: 521527ea42f0901bf839bcaad0cb13e6
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-std=c++11' '-Wall' '-mtune=generic'
'-march=x86-64'
 as -v --64 -o bug.o bug.s
GNU assembler version 2.22.90 (x86_64-linux-gnu) using BFD version (GNU
Binutils for Ubuntu) 2.22.90.20120924
COMPILER_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.7/:/usr/lib/gcc/x86_64-linux-gnu/4.7/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.7/:/usr/lib/gcc/x86_64-linux-gnu/
LIBRARY_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.7/:/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib/:/lib/x86_64-linux-gnu/:/lib/../lib/:/usr/lib/x86_64-linux-gnu/:/usr/lib/../lib/:/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-std=c++11' '-Wall' '-mtune=generic'
'-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/4.7/collect2 --sysroot=/ --build-id
--no-add-needed --as-needed --eh-frame-hdr -m elf_x86_64 --hash-style=gnu
-dynamic-linker /lib64/ld-linux-x86-64.so.2 -z relro
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/crt1.o
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/crti.o
/usr/lib/gcc/x86_64-linux-gnu/4.7/crtbegin.o
-L/usr/lib/gcc/x86_64-linux-gnu/4.7
-L/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu
-L/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../../lib -L/lib/x86_64-linux-gnu
-L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib
-L/usr/lib/gcc/x86_64-linux-gnu/4.7/../../.. bug.o -lgcc --as-needed -lgcc_s
--no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed
/usr/lib/gcc/x86_64-linux-gnu/4.7/crtend.o
/usr/lib/gcc/x86_64-linux-gnu/4.7/../../../x86_64-linux-gnu/crtn.o

[Bug tree-optimization/55559] Marshalling double through union with inlines, incorrect behavior with -O2

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-12-02
          Component|c++                         |tree-optimization
     Ever Confirmed|0                           |1
      Known to fail|                            |4.7.0, 4.8.0

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-12-02 00:09:30 UTC ---
CCP is broken:
Visiting statement:
D.1625_1 = D.1625_8;
Lattice value changed to CONSTANT -4616189618054758400.  Adding SSA edges to
worklist.

Visiting statement:
D.1631_7 = VIEW_CONVERT_EXPR<double>(D.1625_1);
which is likely CONSTANT
Lattice value changed to CONSTANT -1.0e+0.  Adding SSA edges to worklist.

Visiting statement:
D.1631_9 = D.1631_7;
Lattice value changed to CONSTANT -1.0e+0.  Adding SSA edges to worklist.

Visiting statement:
D.1631_2 = D.1631_9;
Lattice value changed to CONSTANT -1.0e+0.  Adding SSA edges to worklist.

Visiting statement:
D.1610_3 = (unsigned int) D.1631_2;
which is likely CONSTANT
Lattice value changed to CONSTANT 0.  Adding SSA edges to worklist.


I think this is a regression if the code does not use extended  initializer
lists but I have not tested it though.

[Bug tree-optimization/55559] Marshalling double through union with inlines, incorrect behavior with -O2

[mikpe at it dot uu.se]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

Mikael Pettersson <mikpe at it dot uu.se> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mikpe at it dot uu.se

--- Comment #2 from Mikael Pettersson <mikpe at it dot uu.se> 2012-12-02 11:15:37 UTC ---
Doesn't depend on that extended initializer, a pure C version fails for me at
-O1 and above with gcc 4.4.7, 4.5.4, 4.6.3, 4.7.2, and trunk, while 4.3.6
works.

[Bug tree-optimization/55559] Marshalling double through union with inlines, incorrect behavior with -O2

[mikpe at it dot uu.se]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

--- Comment #3 from Mikael Pettersson <mikpe at it dot uu.se> 2012-12-02 16:04:49 UTC ---
Created attachment 28853
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28853
simplified test case in plain C

The regression started with Richard Biener's "[PATCH] Teach SCCVN/FRE
expression insertion, optimize type-punning through unions (final!)" patch in
r133218:
http://gcc.gnu.org/ml/gcc-patches/2008-03/msg00873.html
http://gcc.gnu.org/ml/gcc-cvs/2008-03/msg00436.html

[Bug tree-optimization/55559] [4.6/4.7/4.8 Regression] Marshalling double through union with inlines, incorrect behavior with -O2

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
      Known to work|                            |4.3.6
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |
   Target Milestone|---                         |4.6.4
            Summary|Marshalling double through  |[4.6/4.7/4.8 Regression]
                   |union with inlines,         |Marshalling double through
                   |incorrect behavior with -O2 |union with inlines,
                   |                            |incorrect behavior with -O2

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> 2012-12-03 11:43:53 UTC ---
Mine then.

[Bug tree-optimization/55559] [4.6/4.7/4.8 Regression] Marshalling double through union with inlines, incorrect behavior with -O2

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|wrong-code                  |
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |INVALID

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> 2012-12-03 12:30:20 UTC ---
We ask fold_unary to fold

fold_unary_ignore_overflow_loc (loc=2147483655, code=FIX_TRUNC_EXPR, 
    type=0x7ffff6d17690, op0=0x7ffff6e23858)
    at /space/rguenther/src/svn/trunk/gcc/fold-const.c:8363
(gdb) call debug_tree (type)
 <integer_type 0x7ffff6d17690 unsigned int public unsigned SI
    size <integer_cst 0x7ffff6d1a0c0 type <integer_type 0x7ffff6d170a8
bitsizetype> constant 32>
    unit size <integer_cst 0x7ffff6d1a0e0 type <integer_type 0x7ffff6d17000
sizetype> constant 4>
    align 32 symtab 0 alias set -1 canonical type 0x7ffff6d17690 precision 32
min <integer_cst 0x7ffff6d1a100 0> max <integer_cst 0x7ffff6d1a0a0 4294967295>
    pointer_to_this <pointer_type 0x7ffff6d270a8>>
(gdb) call debug_tree (op0)
 <real_cst 0x7ffff6e23858
    type <real_type 0x7ffff6d17f18 double sizes-gimplified DF
        size <integer_cst 0x7ffff6d02d40 constant 64>
        unit size <integer_cst 0x7ffff6d02d60 constant 8>
        align 64 symtab 0 alias set -1 canonical type 0x7ffff6d17f18 precision
64
        pointer_to_this <pointer_type 0x7ffff6d1f150>>
    constant -1.0e+0>

which ends up in fold_convert_const_int_from_real which returns
0 with TREE_OVERFLOW set.

Note that you end up converting the double -1.0 to unsigned which according
to C99 6.3.1.4 ends up invoking undefined behavior.

GCC's behavior is not ill-defined, your testcase is.  That behavior changed
is fine as it is unsefined.

[Bug tree-optimization/55559] [4.6/4.7/4.8 Regression] Marshalling double through union with inlines, incorrect behavior with -O2

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

--- Comment #6 from Paolo Carlini <paolo.carlini at oracle dot com> 2012-12-03 12:51:45 UTC ---
I knew that a PR using "marshalling" couldn't be right ;)

[Bug tree-optimization/55559] [4.6/4.7/4.8 Regression] Marshalling double through union with inlines, incorrect behavior with -O2

[mpreda at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

--- Comment #7 from Mihai Preda <mpreda at gmail dot com> 2012-12-03 22:13:03 UTC ---
Thanks, I didn't realize that (unsigned)-1.0 is undefined.

For the behavior I was expecting it's enough to use an intermediary cast
through int, e.g. (unsigned)(int)-1.0.

It may be nice to generate a consistent (-O0/-O1) result for (unsigned)-1.0
though, even if not required by the standard.

[Bug tree-optimization/55559] [4.6/4.7/4.8 Regression] Marshalling double through union with inlines, incorrect behavior with -O2

[rguenther at suse dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559

--- Comment #8 from rguenther at suse dot de <rguenther at suse dot de> 2012-12-04 09:02:00 UTC ---
On Mon, 3 Dec 2012, mpreda at gmail dot com wrote:

> 
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55559
> 
> --- Comment #7 from Mihai Preda <mpreda at gmail dot com> 2012-12-03 22:13:03 UTC ---
> Thanks, I didn't realize that (unsigned)-1.0 is undefined.
> 
> For the behavior I was expecting it's enough to use an intermediary cast
> through int, e.g. (unsigned)(int)-1.0.

Yes, that makes it implementation-defined (and all implementations
I know of do what you expect, modulo-two reduction).

> It may be nice to generate a consistent (-O0/-O1) result for (unsigned)-1.0
> though, even if not required by the standard.

That's unfortunately generally impossible.