[Bug c++/62006] New: Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[Bug c++/62006] New: Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[tkoeppe at google dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

            Bug ID: 62006
           Summary: Bad code generation with -O3 (possibly due to
                    -ftree-partial-pre)
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: tkoeppe at google dot com

Created attachment 33231
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33231&action=edit
Demonstrates bad code generation with -O3

I was writing some code to demonstrate custom allocators with fancy pointers.
While testing it with GCC, I noticed memory corruption when compiling with -O3.
Jonathan Wakely had a quick look and narrowed it down to "-O2
-ftree-partial-pre"; with just "-O2" the code works.

I don't have any insights in the problem, so I'm just attaching the full code.
You can tell that it's broken by passing the program through valgrind, or
simply by noting that it prints all container elements as zero, rather than
their actual values.

(Incidentally, I believe there's a similar problem in Clang:
http://llvm.org/bugs/show_bug.cgi?id=20524)

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-08-04
          Component|c++                         |tree-optimization
            Version|unknown                     |4.9.1
     Ever confirmed|0                           |1
      Known to fail|                            |4.10.0, 4.8.2, 4.9.1

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
N.B. compile with -std=c++11 

I can't tell whether it's a regression without rewriting some of the code to
avoid features that aren't supported prior to 4.8

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
There is only a single extra PRE performed by partial-PRE.  I'll have a look.

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
It looks ok what PRE does (it's not really a partial partial redundancy but
a full redundndancy).

The bug also reproduces with -O2 -ftree-partial-pre.  Disabling loop
optimizations and cddce2 hides the bug.

With PPRE enabled CDDCE2 removes the stores to D.46421.diff (again I see
nothing wrong with doing that).

Btw, this all happens in _M_range_initialize.  (-fno-strict-aliasing fixes
the bug as well).

Note that I see stores as OffPtrBase to automatic objects:

-  MEM[(struct OffPtrBase *)&D.46421].diff = _70;

and loads from OffPtr via this:

   _16 = &MEM[(struct OffPtr *)this_4(D)].D.43564;

or remaining stores:

   MEM[(struct OffPtrBase *)this_4(D) + 16B].diff = iftmp.15_41;

I also see:

   _74 = (sizetype) _47;
   iftmp.10_75 = &D.46429.D.43564 + _74;
   __last.3_77 = (long int) iftmp.10_75;
   __first.4_78 = (long int) &D.46430.D.43564;
   _79 = __last.3_77 - __first.4_78;

which effectively subtracts two unrelated addresses of automatic objects
(boooo - undefined behavior!)

I think the testcase is simply bogus.  Can you explain what the "fancy"
pointers
do?  Disabling points-to analysis also "fixes" the testcase.

Note that with points-to analysis you cannot reach any other object
with offsetting the address of an object.

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[tkoeppe at google dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #4 from Thomas Köppe <tkoeppe at google dot com> ---
Ah, you're right, this offset pointer computation as it stands is undefined
behaviour. The intended use is to use those pointers only within a preallocated
arena, so that the pointers would indeed live in a common object (a large
array).

I shall change the allocator to an arena allocator and rerun the test.

The intended use for offset pointers is to inter-process communication; a
vector with the fancy-pointer allocator can be used from two separate
processes.
>From gcc-bugs-return-457690-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Aug 04 12:13:59 2014
Return-Path: <gcc-bugs-return-457690-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 22628 invoked by alias); 4 Aug 2014 12:13:57 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 22523 invoked by uid 48); 4 Aug 2014 12:13:46 -0000
From: "ysrumyan at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug rtl-optimization/61672] Less redundant instructions deleted by pre_delete after r208113.
Date: Mon, 04 Aug 2014 12:13:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: rtl-optimization
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: ysrumyan at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-61672-4-oJjIi3n4Py@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61672-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61672-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-08/txt/msg00188.txt.bz2
Content-length: 557

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida672

--- Comment #4 from Yuri Rumyantsev <ysrumyan at gmail dot com> ---
Richard,

I put into attachment original file. For compiler built 20140208 and 20140730
I've got:

grep -c redundant test.cc.179r.pre (20140208)
3825
grep -c redundant test.182r.pre (20140730)
314.

Note also that the following warning is emitted:
art/runtime/interpreter/interpreter_goto_table_impl.cc:2436:1: warning: the
frame size of 3408 bytes is larger than 1728 bytes [-Wframe-larger-than=]

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Btw, points-to handles this conservatively, so -fno-tree-pta isn't a real fix
either.  We didn't yet spot the real bogus transform.

But indeed makes sure you are computing differences within one arena only.

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Smells like a duplicate of PR49330 - still always returning 1 from
base_alias_check doesn't fix the original testcase.

Which also fails with -O -ftree-pre -ftree-partial-pre -fstrict-aliasing btw.

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
The fixed demog works for me (GCC 4.9 and 4.8 at least).

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[tkoeppe at google dot com]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="UTF-8", Size: 2483 bytes --]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #9 from Thomas Köppe <tkoeppe at google dot com> ---
Argh, yes, I compiled the wrong file... indeed, the arena version works with
GCC 4.8.2 for me, too, and in Clang as well.

So... not an issue, I suppose?

The desired real application will be for containers allocated in shared memory,
which is presumably obtained from some opaque system feature.
>From gcc-bugs-return-457707-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Aug 04 13:32:03 2014
Return-Path: <gcc-bugs-return-457707-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 7583 invoked by alias); 4 Aug 2014 13:32:03 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 7522 invoked by uid 48); 4 Aug 2014 13:31:56 -0000
From: "alexander.grund at mailbox dot tu-dresden.de" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug fortran/62010] OpenMP simd produces wrong results
Date: Mon, 04 Aug 2014 13:32:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: fortran
X-Bugzilla-Version: 4.9.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: alexander.grund at mailbox dot tu-dresden.de
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: attachments.created
Message-ID: <bug-62010-4-u13cMQDHIp@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-62010-4@http.gcc.gnu.org/bugzilla/>
References: <bug-62010-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-08/txt/msg00204.txt.bz2
Content-length: 247

https://gcc.gnu.org/bugzilla/show_bug.cgi?idb010

--- Comment #1 from Alexander Grund <alexander.grund at mailbox dot tu-dresden.de> ---
Created attachment 33239
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id3239&actioníit
Testcase 2

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #10 from rguenther at suse dot de <rguenther at suse dot de> ---
On Mon, 4 Aug 2014, tkoeppe at google dot com wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006
> 
> --- Comment #9 from Thomas Köppe <tkoeppe at google dot com> ---
> Argh, yes, I compiled the wrong file... indeed, the arena version works with
> GCC 4.8.2 for me, too, and in Clang as well.
> 
> So... not an issue, I suppose?

I think the issue only triggers when you end up using automatic
variables for the difference computation.
>From gcc-bugs-return-457711-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Aug 04 13:48:47 2014
Return-Path: <gcc-bugs-return-457711-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 3596 invoked by alias); 4 Aug 2014 13:48:47 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 3569 invoked by uid 48); 4 Aug 2014 13:48:44 -0000
From: "tkoeppe at google dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)
Date: Mon, 04 Aug 2014 13:48:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 4.9.1
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: tkoeppe at google dot com
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: rguenth at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: attachments.created
Message-ID: <bug-62006-4-9AMX7glw29@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-62006-4@http.gcc.gnu.org/bugzilla/>
References: <bug-62006-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-08/txt/msg00208.txt.bz2
Content-length: 613

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

--- Comment #11 from Thomas Köppe <tkoeppe at google dot com> ---
Created attachment 33240
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33240&action=edit
Further fixing: Uses uintptr_ts for the difference

On Jonathan's suggestion I changed the distance computation to go through a
uintptr_t conversion.

Jonathan suggested compiling with -fno-elide-constructors, and indeed the
attached code breaks when that option is passed. As you said, the UB caused by
the distance computations of automatic objects seems to be the stumbling point.
>From gcc-bugs-return-457712-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Aug 04 14:23:29 2014
Return-Path: <gcc-bugs-return-457712-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 614 invoked by alias); 4 Aug 2014 14:23:28 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 32353 invoked by uid 48); 4 Aug 2014 14:23:21 -0000
From: "ysrumyan at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug rtl-optimization/61672] [4.9/4.10 Regression] Less redundant instructions deleted by pre_delete after r208113.
Date: Mon, 04 Aug 2014 14:23:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: rtl-optimization
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords: missed-optimization
X-Bugzilla-Severity: normal
X-Bugzilla-Who: ysrumyan at gmail dot com
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: rguenth at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.2
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-61672-4-9Bs5W04Y7c@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61672-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61672-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-08/txt/msg00209.txt.bz2
Content-length: 156

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida672

--- Comment #7 from Yuri Rumyantsev <ysrumyan at gmail dot com> ---
It really fixes the issue. Thanks.

[Bug tree-optimization/62006] Bad code generation with -O3 (possibly due to -ftree-partial-pre)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62006

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |INVALID

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Invalid.