[Bug tree-optimization/63551] New: wrong code (segfaults) at -Os on x86_64-linux-gnu

[Bug tree-optimization/63551] New: wrong code (segfaults) at -Os on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

            Bug ID: 63551
           Summary: wrong code (segfaults) at -Os on x86_64-linux-gnu
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The current gcc trunk (as well as 4.9.x) miscompiles the following code on
x86_64-linux at -Os in both 32-bit and 64-bit modes. 

This is a regression from 4.8.x. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/5.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 5.0.0 20141014 (experimental) [trunk revision 216217] (GCC) 
$ 
$ gcc-trunk -O1 small.c; a.out
$ 
$ gcc-trunk -Os small.c
$ ./a.out
Segmentation fault (core dumped)
$ 

-----------------------------------

union U
{
  unsigned int f0;
  int f1;
};

int a, d;

void
fn1 (union U p)
{
  if (p.f1 <= 0)
    if (a)
      d = 0; 
}

void
fn2 ()
{
  d = 0; 
  union U b = { 4294967286 };
  fn1 (b);
}

int
main ()
{
  fn2 ();
  return 0;
}

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-10-16
                 CC|                            |hubicka at gcc dot gnu.org
   Target Milestone|---                         |5.0
            Summary|wrong code (segfaults) at   |[4.9/5 Regression] wrong
                   |-Os on x86_64-linux-gnu     |code (segfaults) at -Os on
                   |                            |x86_64-linux-gnu
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

fn2 ()
{
  <bb 2>:
  d = 0;
  __builtin_unreachable ();

}

?

Somehow IPA inline inserts this call.

Considering fn1/2 with 7 size
 to be inlined into fn2/3 in t.c:22
 Estimated badness is -1073741826, frequency 1.00.
    Badness calculation for fn2/3 -> fn1/2
      size growth -2, time 0  big_speedup
      -1073741826: Growth -2 <= 0
Introduced new external node (__builtin_unreachable/7).
Processing frequency fn1

from ipa-inline-analysis.c:edge_set_predicate

757       if (predicate && false_predicate_p (predicate) && e->callee)
758         {
759           struct cgraph_node *callee = !e->inline_failed ? e->callee :
NULL;
760
761           e->redirect_callee (cgraph_node::get_create
762                                 (builtin_decl_implicit
(BUILT_IN_UNREACHABLE)));
763           e->inline_failed = CIF_UNREACHABLE;
764           if (callee)
765             callee->remove_symbol_and_inline_clones ();

thus there is some bug in predicate compute.

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
I guess we somehow miss the punning through the union makes '4294967286'
signed '-10'.

Analyzing function: fn2/3
  function  fn2/3 parameter descriptors:
  Jump functions of caller  fn2/3:
    callsite  fn2/3 -> fn1/2 :
       param 0: UNKNOWN
         Aggregate passed by value:
           offset: 0, cst: 4294967286

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r208831.

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Target Milestone|5.0                         |4.9.3

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #5 from Martin Jambor <jamborm at gcc dot gnu.org> ---
(In reply to Jan Hubicka from comment #3)
> indeed, somewhere we need to view convert the aggregate value... Predicates
> works on conditions on arguments, so I suppose this ought to happen at
> ipa-prop side. Martin?

I disagree, ipa-prop jump functions describe what values callers pass
to callees, it is the conditions of the predicates that need do
describe what then happens to these values, including any conversions.

Anyway, I am bootstrapping the following fix:

Index: src/gcc/ipa-inline-analysis.c
===================================================================
--- src.orig/gcc/ipa-inline-analysis.c
+++ src/gcc/ipa-inline-analysis.c
@@ -880,6 +880,7 @@ evaluate_conditions_for_known_args (stru
     }
       if (c->code == IS_NOT_CONSTANT || c->code == CHANGED)
     continue;
+      val = fold_convert (TREE_TYPE (c->val), val);
       res = fold_binary_to_constant (c->code, boolean_type_node, val, c->val);
       if (res && integer_zerop (res))
     continue;

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have posted the fix to the mailing list as well:

https://gcc.gnu.org/ml/gcc-patches/2014-11/msg02842.html

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Author: jamborm
Date: Mon Dec  1 12:05:41 2014
New Revision: 218205

URL: https://gcc.gnu.org/viewcvs?rev=218205&root=gcc&view=rev
Log:
2014-12-01  Martin Jambor  <mjambor@suse.cz>

    PR ipa/63551
    * ipa-inline-analysis.c (evaluate_conditions_for_known_args): Convert
    value of the argument to the type of the value in the condition.

testsuite/
    * gcc.dg/ipa/pr63551.c: New test.
    * gcc.dg/ipa/pr64041.c: Likewise.


Added:
    trunk/gcc/testsuite/gcc.dg/ipa/pr63551.c
    trunk/gcc/testsuite/gcc.dg/ipa/pr64041.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ipa-inline-analysis.c
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #9 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Author: jamborm
Date: Mon Dec  1 12:52:58 2014
New Revision: 218208

URL: https://gcc.gnu.org/viewcvs?rev=218208&root=gcc&view=rev
Log:
2014-12-01  Martin Jambor  <mjambor@suse.cz>

    PR ipa/63551
    * ipa-inline-analysis.c (evaluate_conditions_for_known_args): Convert
    value of the argument to the type of the value in the condition.

testsuite/
    * gcc.dg/ipa/pr63551.c: New test.
    * gcc.dg/ipa/pr64041.c: Likewise.


Added:
    branches/gcc-4_9-branch/gcc/testsuite/gcc.dg/ipa/pr63551.c
    branches/gcc-4_9-branch/gcc/testsuite/gcc.dg/ipa/pr64041.c
Modified:
    branches/gcc-4_9-branch/gcc/ChangeLog
    branches/gcc-4_9-branch/gcc/ipa-inline-analysis.c
    branches/gcc-4_9-branch/gcc/testsuite/ChangeLog

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551
Bug 63551 depends on bug 64153, which changed state.

Bug 64153 Summary: [5.0 regression] r218205 miscompiles libgomp
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64153

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The gcc.dg/ipa/pr63551.c test fails on the 4.9 branch on 32-bit targets (i386,
arm, s390):
gcc.dg/ipa/pr63551.c:24:9: warning: this decimal constant is unsigned only in
ISO C90
Seems the test is equally miscompiled before r218205 and works after the fix if
4294967286 is replaced with 4294967286U .
Are you ok with that change?

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #12 from Martin Jambor <jamborm at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #11)
> The gcc.dg/ipa/pr63551.c test fails on the 4.9 branch on 32-bit
> targets (i386, arm, s390):
> gcc.dg/ipa/pr63551.c:24:9: warning: this decimal constant is unsigned only
> in ISO C90
> Seems the test is equally miscompiled before r218205 and works after
> the fix if 4294967286 is replaced with 4294967286U .  Are you ok
> with that change?

Of course.  Are you going to commit it?  If you want me to commit it,
I can certainly do it too, just let me know.

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Mon Dec 15 10:44:53 2014
New Revision: 218740

URL: https://gcc.gnu.org/viewcvs?rev=218740&root=gcc&view=rev
Log:
    PR tree-optimization/63551
    * gcc.dg/ipa/pr63551.c (fn2): Use 4294967286U instead of
    4294967286 to avoid warnings.

Modified:
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gcc.dg/ipa/pr63551.c

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #14 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Thu Apr 30 18:01:07 2015
New Revision: 222650

URL: https://gcc.gnu.org/viewcvs?rev=222650&root=gcc&view=rev
Log:
        PR tree-optimization/63551
        * g++.dg/ipa/pr63551.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/ipa/pr63551.C
Modified:
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #15 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Thu Apr 30 18:03:53 2015
New Revision: 222651

URL: https://gcc.gnu.org/viewcvs?rev=222651&root=gcc&view=rev
Log:
        PR tree-optimization/63551
        * g++.dg/ipa/pr63551.C: New test.

Added:
    branches/gcc-5-branch/gcc/testsuite/g++.dg/ipa/pr63551.C
Modified:
    branches/gcc-5-branch/gcc/testsuite/ChangeLog

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #16 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Thu Apr 30 18:05:34 2015
New Revision: 222652

URL: https://gcc.gnu.org/viewcvs?rev=222652&root=gcc&view=rev
Log:
        PR tree-optimization/63551
        * g++.dg/ipa/pr63551.C: New test.

Added:
    branches/gcc-4_9-branch/gcc/testsuite/g++.dg/ipa/pr63551.C
Modified:
    branches/gcc-4_9-branch/gcc/testsuite/ChangeLog

[Bug tree-optimization/63551] [4.9/5 Regression] wrong code (segfaults) at -Os on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63551

--- Comment #17 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Thu Apr 30 18:41:33 2015
New Revision: 222653

URL: https://gcc.gnu.org/viewcvs?rev=222653&root=gcc&view=rev
Log:
        * g++.dg/ipa/pr63551.C: New test.

        Backported from mainline
        2014-12-15  Jakub Jelinek  <jakub@redhat.com>

        PR tree-optimization/63551
        * gcc.dg/ipa/pr63551.c (fn2): Use 4294967286U instead of
        4294967286 to avoid warnings.

        2014-12-03  Martin Jambor  <mjambor@suse.cz>

        PR ipa/64153
        * ipa-inline-analysis.c (evaluate_conditions_for_known_args): Check
        type sizes before view_converting.

        2014-12-01  Martin Jambor  <mjambor@suse.cz>

        PR ipa/63551
        * ipa-inline-analysis.c (evaluate_conditions_for_known_args): Convert
        value of the argument to the type of the value in the condition.

        * gcc.dg/ipa/pr63551.c: New test.
        * gcc.dg/ipa/pr64041.c: Likewise.

Added:
    branches/gcc-4_8-branch/gcc/testsuite/g++.dg/ipa/pr63551.C
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/ipa/pr63551.c
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/ipa/pr64041.c
Modified:
    branches/gcc-4_8-branch/gcc/ChangeLog
    branches/gcc-4_8-branch/gcc/ipa-inline-analysis.c
    branches/gcc-4_8-branch/gcc/testsuite/ChangeLog