[Bug tree-optimization/64682] New: wrong code at -O2 and -O3 on x86_64-linux-gnu

[Bug tree-optimization/64682] New: wrong code at -O2 and -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

            Bug ID: 64682
           Summary: wrong code at -O2 and -O3 on x86_64-linux-gnu
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The current gcc trunk miscompiles the following code on x86_64-linux at -O2 and
-O3 in both 32-bit and 64-bit modes. 

This is a regression from 4.9.x. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/5.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 5.0.0 20150119 (experimental) [trunk revision 219832] (GCC) 

$ 
$ gcc-trunk -Os small.c; a.out
5
$ gcc-4.9 -O2 small.c; a.out
5
$ 
$ gcc-trunk -O2 small.c; a.out
1
$ 


-----------------------------------


int printf (const char *, ...);

int a, b = 1;

int
main ()
{
  int i;
  for (i = 0; i < 56; i++)
    for (; a; a--)
      ;
  int *c = &b;
  if (*c)
    *c = 1 % (unsigned int) *c | 5;

  printf ("%d\n", b);

  return 0;
}

[Bug tree-optimization/64682] [5 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-01-20
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |segher at gcc dot gnu.org
   Target Milestone|---                         |5.0
            Summary|wrong code at -O2 and -O3   |[5 Regression] wrong code
                   |on x86_64-linux-gnu         |at -O2 and -O3 on
                   |                            |x86_64-linux-gnu
     Ever confirmed|0                           |1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r218248.

[Bug rtl-optimization/64682] [5 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Target|                            |x86_64-*-*
           Priority|P3                          |P1
          Component|tree-optimization           |rtl-optimization

[Bug rtl-optimization/64682] [5 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Testcase usable for the testsuite:
int a, b = 1;

__attribute__((noinline, noclone)) void
foo (int x)
{
  if (x != 5)
    __builtin_abort ();
}

int
main ()
{
  int i;
  for (i = 0; i < 56; i++)
    for (; a; a--)
      ;
  int *c = &b;
  if (*c)
    *c = 1 % (unsigned int) *c | 5;

  foo (b);

  return 0;
}

This indeed is a combiner bug.
Trying 28, 29 -> 30:
Failed to match this instruction:
(parallel [
        (set (mem/c:SI (symbol_ref:DI ("b") [flags 0x2]  <var_decl
0x7f3aa8245cf0 b>) [1 b+0 S4 A32])
            (const_int 5 [0x5]))
        (set (reg:SI 90 [ D.1884 ])
            (const_int 5 [0x5]))
    ])
Failed to match this instruction:
(parallel [
        (set (mem/c:SI (symbol_ref:DI ("b") [flags 0x2]  <var_decl
0x7f3aa8245cf0 b>) [1 b+0 S4 A32])
            (const_int 5 [0x5]))
        (set (reg:SI 90 [ D.1884 ])
            (const_int 5 [0x5]))
    ])
Successfully matched this instruction:
(set (reg:SI 90 [ D.1884 ])
    (const_int 5 [0x5]))
Successfully matched this instruction:
(set (mem/c:SI (symbol_ref:DI ("b") [flags 0x2]  <var_decl 0x7f3aa8245cf0 b>)
[1 b+0 S4 A32])
    (const_int 5 [0x5]))
allowing combination of insns 28, 29 and 30
original costs 0 + 4 + 4 = 0
replacement costs 4 + 4 = 8
deferring deletion of insn with uid = 28.
deferring deletion of insn with uid = 27.
deferring deletion of insn with uid = 29.
modifying insn i3    30: [`b']=0x5
deferring rescan insn with uid = 30.

In the end it kept there only the b = 5; store, but not setting of pseudo 90 to
the same value, but pseudo 90 is used in the next basic block (to initialize
first argument to the function call).  Segher, can you please have a look?

[Bug rtl-optimization/64682] [5 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Ah, so the thing is probably that:
(insn 28 27 29 7 (parallel [
            (set (reg:SI 102)
                (udiv:SI (reg:SI 100)
                    (reg:SI 90 [ D.1884 ])))
            (set (reg:SI 101 [ D.1886 ])
                (umod:SI (reg:SI 100)
                    (reg:SI 90 [ D.1884 ])))
            (clobber (reg:CC 17 flags))
        ]) pr64682.c:21 351 {*udivmodsi4}
     (expr_list:REG_DEAD (reg:SI 100)
        (expr_list:REG_DEAD (reg:SI 90 [ D.1884 ])
            (expr_list:REG_UNUSED (reg:SI 102)
                (expr_list:REG_UNUSED (reg:CC 17 flags)
                    (nil))))))
(insn 29 28 30 7 (parallel [
            (set (reg:SI 90 [ D.1884 ])
                (ior:SI (reg:SI 101 [ D.1886 ])
                    (const_int 5 [0x5])))
            (clobber (reg:CC 17 flags))
        ]) pr64682.c:21 398 {*iorsi_1}
     (expr_list:REG_DEAD (reg:SI 101 [ D.1886 ])
        (expr_list:REG_UNUSED (reg:CC 17 flags)
            (nil))))
(insn 30 29 31 7 (set (mem/c:SI (symbol_ref:DI ("b") [flags 0x2] <var_decl
0x7ffff1867cf0 b>) [1 b+0 S4 A32])
        (reg:SI 90 [ D.1884 ])) pr64682.c:21 90 {*movsi_internal}
     (nil))
we combine these 3 into:
(note 28 27 29 7 NOTE_INSN_DELETED)
(insn 29 28 30 7 (set (reg:SI 90 [ D.1884 ])
        (const_int 5 [0x5])) pr64682.c:21 90 {*movsi_internal}
     (nil))
(insn 30 29 31 7 (set (mem/c:SI (symbol_ref:DI ("b") [flags 0x2] <var_decl
0x7ffff1867cf0 b>) [1 b+0 S4 A32])
        (const_int 5 [0x5])) pr64682.c:21 90 {*movsi_internal}
     (nil))
and then try to distribute notes, and as there was a REG_DEAD note for pseudo
90 (correct IMHO) in insn 28, but insn 29 set it again to something else, when
we try to distribute the REG_DEAD note onto the new insn 29 (or 30), we delete
insn 29 as dead.  Giving up, not familiar enough with the dead note
distribution in the combiner.

[Bug rtl-optimization/64682] [5 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

Segher Boessenkool <segher at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |segher at gcc dot gnu.org

--- Comment #4 from Segher Boessenkool <segher at gcc dot gnu.org> ---
Yes, distribute_notes messes up if it has a REG_DEAD note while that
same reg is set later, and ends up as I2 in the combination result.

I am testing a patch.

[Bug rtl-optimization/64682] [5 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[segher at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

--- Comment #5 from Segher Boessenkool <segher at gcc dot gnu.org> ---
Author: segher
Date: Thu Jan 22 00:35:44 2015
New Revision: 219981

URL: https://gcc.gnu.org/viewcvs?rev=219981&root=gcc&view=rev
Log:
    PR rtl-optimization/64682
    * combine.c (distribute_notes): When moving a death note for
    a register that is set in the new I2, make sure to put it
    before that new I2.

    PR rtl-optimization/64682
    * gcc.c-torture/execute/pr64682.c: New file.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/combine.c
    trunk/gcc/testsuite/ChangeLog

[Bug rtl-optimization/64682] [5 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64682

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Thanks.