[Bug rtl-optimization/62004] New: dead type-unsafe load replaces type-safe load

["vries at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62004

            Bug ID: 62004
           Summary: dead type-unsafe load replaces type-safe load
           Product: gcc
           Version: 4.8.4
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: vries at gcc dot gnu.org

Created attachment 33230
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33230&action=edit
test-case

I've tried to write a program in which there is a type-unsafe load, which is
never executed, to see if tail-merge would fail. In other words, I've tried to
come up with a 'load' variant of PR61964.

With attached test-case load-4.c and current 4.8 branch, I get the following
results:
...
$ gcc -O2 load-4.c; ./a.out ; echo $?
1
...

Adding -fno-strict-aliasing allows the test to pass:
...
$ gcc -O2 load-4.c -fno-strict-aliasing ; ./a.out ; echo $?
0
...
However AFAICT, the test-case is correct, in the sense that the only
type-unsafe code is dead, so -fno-strict-aliasing should not be necessary to
allow the test to pass.

My intention was to trigger a a problem in tail-merge. However, skipping
tail-merge still doesn't make the test pass:
...
$ gcc -O2 load-4.c -fstrict-aliasing -fno-tree-tail-merge; ./a.out ; echo $?
1
...

At rtl level, the same type of optimization as tail-merge is done. We start out
with the if-then-else-join before expand:
...
  if (_13 == h_10)
    goto <bb 3>;
  else
    goto <bb 4>;

  <bb 3>:
  p_14 = MEM[(struct head *)_13].first;
  goto <bb 5>;

  <bb 4>:
  p_15 = _13->next;

  <bb 5>:
...

And this is expanded into rtl:
...
(jump_insn 23 22 24 2 (set (pc)
        (if_then_else (ne (reg:CCZ 17 flags)
                (const_int 0 [0]))
            (label_ref 28)
            (pc))) load-4.c:44 -1
     (expr_list:REG_BR_PROB (const_int 8986 [0x231a])
        (nil))
 -> 28)
(note 24 23 25 4 [bb 4] NOTE_INSN_BASIC_BLOCK)
(insn 25 24 26 4 (set (reg/v/f:DI 59 [ p ])
        (mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 MEM[(struct head *)_13].first+0
S8 A64])) load-4.c:46 -1
     (nil))
(jump_insn 26 25 27 4 (set (pc)
        (label_ref 31)) -1
     (nil)
 -> 31)
(barrier 27 26 28)
(code_label 28 27 29 5 2 "" [1 uses])
(note 29 28 30 5 [bb 5] NOTE_INSN_BASIC_BLOCK)
(insn 30 29 31 5 (set (reg/v/f:DI 59 [ p ])
        (mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 _13->next+0 S8 A64])) load-4.c:49
-1
     (nil))
(code_label 31 30 32 6 3 "" [1 uses])
...

Already at into_cfglayout, the jump 26 is removed, causing the 'dead' bb4 to
become alive:
...
try_optimize_cfg iteration 1

Removing jump 26.

<SNIP>
(jump_insn 23 22 24 2 (set (pc)
        (if_then_else (ne (reg:CCZ 17 flags)
                (const_int 0 [0]))
            (label_ref 28)
            (pc))) load-4.c:44 612 {*jcc_1}
     (expr_list:REG_BR_PROB (const_int 8986 [0x231a])
        (nil))
 -> 28)
(note 24 23 25 3 [bb 3] NOTE_INSN_BASIC_BLOCK)
(insn 25 24 28 3 (set (reg/v/f:DI 59 [ p ])
        (mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 MEM[(struct head *)_13].first+0
S8 A64])) load-4.c:46 87 {*movdi_internal_rex64}
     (nil))
(code_label 28 25 29 4 2 "" [1 uses])
(note 29 28 30 4 [bb 4] NOTE_INSN_BASIC_BLOCK)
(insn 30 29 31 4 (set (reg/v/f:DI 59 [ p ])
        (mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 _13->next+0 S8 A64])) load-4.c:49
87 {*movdi_internal_rex64}
     (nil))
...

And after ce1, we're just left with the code from bb4:
...
IF-THEN-ELSE-JOIN block found, pass 1, test 2, then 3, else 4, join 5
changing bb of uid 30
  from 4 to 2
deleting insn with uid = 29.
deleting insn with uid = 28.
deleting block 4
Removing jump 23.

<SNIP>

(insn 30 22 33 2 (set (reg/v/f:DI 59 [ p ])
        (mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 _13->next+0 S8 A64])) load-4.c:49
87 {*movdi_internal_rex64}
     (expr_list:REG_DEAD (reg/f:DI 66 [ D.1751 ])
        (nil)))
...

Using -fno-if-conversion allows the test to pass:
...
$ gcc -O2 load-4.c -fstrict-aliasing -fno-tree-tail-merge -fno-if-conversion;
./a.out ; echo $?
0
...

And indeed, the problem also triggers for tail-merge:
...
$ gcc.sh -O2 load-4.c -fstrict-aliasing -ftree-tail-merge -fno-if-conversion;
./a.out ; echo $?
1
...