[Bug middle-end/63311] New: [4.9/5 Regression] -O1 optimization introduces valgrind warning

[Bug middle-end/63311] New: [4.9/5 Regression] -O1 optimization introduces valgrind warning

[Joost.VandeVondele at mat dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

            Bug ID: 63311
           Summary: [4.9/5 Regression] -O1 optimization introduces
                    valgrind warning
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: Joost.VandeVondele at mat dot ethz.ch

The following testcase yields a valgrind error when compiled with -O1 but not
at -O0. 4.8 is fine 4.9/trunk is not.

> gfortran -O1 -g bug.f90 && valgrind ./a.out 
==57092== Conditional jump or move depends on uninitialised value(s)
==57092==    at 0x4006F5: __m1_MOD_test (bug.f90:20)
==57092==    by 0x4007BB: main (bug.f90:36)
==57092== ERROR SUMMARY: 4 errors from 1 contexts (suppressed: 6 from 6)

> cat bug.f90
MODULE M1
  IMPLICIT NONE
CONTAINS
  INTEGER FUNCTION foo()
     INTEGER, VOLATILE :: v=42
     foo=v
  END FUNCTION
  SUBROUTINE test(n,flag)
    INTEGER :: n,i,j,k,l,tt
    LOGICAL :: flag
    REAL(KIND=8) :: v,t
    IF (flag) THEN
      t=42
      tt=foo()
    ENDIF
    v=0
    DO i=1,n
       v=0
       IF (flag) THEN
          IF (tt==i) v=MAX(v,t)
       ENDIF
       DO j=1,n
        DO k=1,n
            v=MAX(v,sin(REAL(j*k)))
         ENDDO
       ENDDO
    ENDDO
  END SUBROUTINE
END MODULE M1

USE M1
INTEGER :: n
LOGICAL :: flag
n=4
flag=.FALSE.
CALL test(n,flag)
END

what seems to happen is that '(tt==i)' is evaluated before IF (flag) is
evaluated, also in the case where 'flag==.FALSE.', while 'tt' is only
initialized in the .TRUE. case. 

I actually think generated code might nevertheless be correct, but it makes
valgrind less useful on -O1 code.

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.2

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
This is probably ifcombine at work and the target splitting the combined
condition back, but the other way around.

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[dominiq at lps dot ens.fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-09-22
     Ever confirmed|0                           |1

--- Comment #2 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
Confirmed.

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r208687 , so possibly a latent bug is no longer latent after the
FE changes.

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.9.2                       |4.9.3

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 4.9.2 has been released.

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[Joost.VandeVondele at mat dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Joost VandeVondele <Joost.VandeVondele at mat dot ethz.ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |Joost.VandeVondele at mat dot ethz
                   |                            |.ch

--- Comment #5 from Joost VandeVondele <Joost.VandeVondele at mat dot ethz.ch> ---
(In reply to Jakub Jelinek from comment #3)
> Started with r208687 , so possibly a latent bug is no longer latent after
> the FE changes.

It also reproduces with a C instead of with a Fortran testcase (as derived from
the .original dump). To be attached in a second:

> gcc -O1 -std=c11 -g PR63311.c -lm && valgrind ./a.out
==36918== Conditional jump or move depends on uninitialised value(s)
==36918==    at 0x40056C: test (PR63311.c:41)
==36918==    by 0x40061F: main (PR63311.c:130)
==36918== ERROR SUMMARY: 4 errors from 1 contexts (suppressed: 6 from 6)

> gcc -O0 -std=c11 -g PR63311.c -lm && valgrind ./a.out
==36936== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 6 from 6)

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[Joost.VandeVondele at mat dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

--- Comment #6 from Joost VandeVondele <Joost.VandeVondele at mat dot ethz.ch> ---
Created attachment 33852
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33852&action=edit
C testcase

warning with : gcc -O1 -std=c11 -g PR63311.c -lm && valgrind ./a.out

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
      Known to work|                            |4.8.3
      Known to fail|                            |4.9.2

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed that it is ifcombine.  Not sure if I'd call it wrong-code though.

Note that there are no default-defs involved thus ifcombine doesn't see
must-uninits and disabling its transform when maybe-uninits are seen
is IMHO bogus.

Not sure what to do about this one.  There is no way to preserve evaluation
order (no andif / orif on gimple).

[Bug middle-end/63311] [4.9/5 Regression] -O1 optimization introduces valgrind warning

[Joost.VandeVondele at mat dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

--- Comment #8 from Joost VandeVondele <Joost.VandeVondele at mat dot ethz.ch> ---
(In reply to Richard Biener from comment #7)
> Confirmed that it is ifcombine.  Not sure if I'd call it wrong-code though.
> 
> Note that there are no default-defs involved thus ifcombine doesn't see
> must-uninits and disabling its transform when maybe-uninits are seen
> is IMHO bogus.
> 
> Not sure what to do about this one.  There is no way to preserve evaluation
> order (no andif / orif on gimple).

just wondering if the 'target splitting the condition back' means if has a
choice which of the two to evaluate first. Be means of heuristic, if one of the
two conditions contains a 'maybe-uninit' and the other not, it is presumably
best to evaluate the 'maybe-uninit' one at the second stage ?

>From a usability point of view, I had to touch a couple of spots in our code to
make valgrind testing possible again, so while I wouldn't call this wrong-code,
it certainly is some user-visible behavior.

[Bug middle-end/63311] [4.9/5/6 Regression] -O1 optimization introduces valgrind warning

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 4.9.3 has been released.

[Bug middle-end/63311] [4.9/5/6 Regression] -O1 optimization introduces valgrind warning

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.9.3                       |4.9.4

[Bug middle-end/63311] [9/10/11/12 Regression] -O1 optimization introduces valgrind warning

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|8.5                         |9.4

--- Comment #17 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 8 branch is being closed.

[Bug middle-end/63311] [9/10/11/12 Regression] -O1 optimization introduces valgrind warning

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.4                         |9.5

--- Comment #18 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9.4 is being released, retargeting bugs to GCC 9.5.

[Bug middle-end/63311] [9/10/11/12 Regression] -O1 optimization introduces valgrind warning

[mark at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Mark Wielaard <mark at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mark at gcc dot gnu.org

--- Comment #19 from Mark Wielaard <mark at gcc dot gnu.org> ---
This still replicates with valgrind 3.18.1 and gcc 11.2.1:

$ gcc -O1 -std=c11 -g PR63311.c -lm && valgrind --track-origins=yes ./a.out
==2836066== Memcheck, a memory error detector
==2836066== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==2836066== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==2836066== Command: ./a.out
==2836066== 
==2836066== Conditional jump or move depends on uninitialised value(s)
==2836066==    at 0x4011E2: test (PR63311.c:41)
==2836066==    by 0x401223: main (PR63311.c:130)
==2836066==  Uninitialised value was created by a stack allocation
==2836066==    at 0x40112D: test (PR63311.c:11)
==2836066== 
==2836066== 
==2836066== HEAP SUMMARY:
==2836066==     in use at exit: 0 bytes in 0 blocks
==2836066==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==2836066== 
==2836066== All heap blocks were freed -- no leaks are possible
==2836066== 
==2836066== For lists of detected and suppressed errors, rerun with: -s
==2836066== ERROR SUMMARY: 4 errors from 1 contexts (suppressed: 0 from 0)

[Bug middle-end/63311] [9/10/11/12 Regression] -O1 optimization introduces valgrind warning

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dmalcolm at gcc dot gnu.org

--- Comment #20 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
FWIW I tried running both reproducers with -fanalyzer (Fortran and C), and
found that -fanalyzer generates false positives on them, which I'm tracking
separately as PR analyzer/104576.

[Bug middle-end/63311] [9/10/11/12 Regression] -O1 optimization introduces valgrind warning

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

--- Comment #21 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:5fbcbcaff7248604e04b39464f4fbd64fbf6e43b

commit r12-7270-g5fbcbcaff7248604e04b39464f4fbd64fbf6e43b
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Feb 16 18:21:58 2022 -0500

    analyzer: const functions have no side effects [PR104576]

    PR analyzer/104576 tracks that we issue a false positive from
    -Wanalyzer-use-of-uninitialized-value for the reproducers of PR 63311
    when optimization is disabled.

    The root cause is that the analyzer was considering that a call to
    __builtin_sinf could have side-effects.

    This patch fixes things by generalizing the handling for "pure"
    functions to also consider "const" functions.

    gcc/analyzer/ChangeLog:
            PR analyzer/104576
            * region-model.cc: Include "calls.h".
            (region_model::on_call_pre): Use flags_from_decl_or_type to
            generalize check for DECL_PURE_P to also check for ECF_CONST.

    gcc/testsuite/ChangeLog:
            PR analyzer/104576
            * gcc.dg/analyzer/torture/uninit-pr63311.c: New test.
            * gcc.dg/analyzer/uninit-pr104576.c: New test.
            * gfortran.dg/analyzer/uninit-pr63311.f90: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug middle-end/63311] [10/11/12/13 Regression] -O1 optimization introduces valgrind warning

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.5                         |10.4

--- Comment #22 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9 branch is being closed

[Bug middle-end/63311] [10/11/12/13 Regression] -O1 optimization introduces valgrind warning

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #23 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug middle-end/63311] [11/12/13/14 Regression] -O1 optimization introduces valgrind warning

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #24 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.

[Bug middle-end/63311] [11/12 Regression] -O1 optimization introduces valgrind warning

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63311

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=110228
      Known to work|                            |13.2.0, 14.0
      Known to fail|                            |12.3.0, 13.1.0
            Summary|[11/12/13/14 Regression]    |[11/12 Regression] -O1
                   |-O1 optimization introduces |optimization introduces
                   |valgrind warning            |valgrind warning

--- Comment #25 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed for GCC 13.2.0 by r13-7533-g79b6a4875f3dcc4bbca9242313b3edc1bad69660 .
And the trunk by r14-2289-gb083203f053f16 .