[Bug tree-optimization/66952] New: wrong code at -O2 and -O3 on x86_64-linux-gnu

[Bug tree-optimization/66952] New: wrong code at -O2 and -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

            Bug ID: 66952
           Summary: wrong code at -O2 and -O3 on x86_64-linux-gnu
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu
  Target Milestone: ---

The current gcc trunk miscompiles the following code on x86_64-linux at -O2 and
-O3 in both 32-bit and 64-bit modes. 

This is a regression from 5.1.x.


$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 6.0.0 20150719 (experimental) [trunk revision 225987] (GCC) 
$ 
$ gcc-trunk -Os small.c; ./a.out
$ gcc-5.1 -O2 small.c; ./a.out
$ 
$ gcc-trunk -O2 small.c
$ ./a.out
Aborted (core dumped)
$ 


-----------------------------------------------


int a = 128, b;

int
fn1 (char p1, int p2)
{
  return p1 < 0 || p1 > 1 >> p2 ? 0 : p1 << 1;
}

int
fn2 ()
{
  char c = a;
  b = fn1 (c, 1);
  if ((128 | c) < 0 ? 1 : 0)
    return 1;
  return 0;
}

int
main ()
{
  if (fn2 () != 1)
    __builtin_abort ();

  return 0;
}

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-07-20
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |6.0
            Summary|wrong code at -O2 and -O3   |[6 Regression] wrong code
                   |on x86_64-linux-gnu         |at -O2 and -O3 on
                   |                            |x86_64-linux-gnu
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r225861.

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Hmm, I can't see what is wrong with the pattern.  We just replace

  _13 = (int) c_4;
  if (_13 <= 0)

with

  <bb 3>:
  _13 = (int) c_4;
  if (c_4 <= 0)

with c_4 being signed char.  Something else must go wrong here.  Still
-fno-tree-forwprop fixes the bug.

There is a missed optimization in VRP1 which ends up ifcombine doing sth.

VRP2 manages to mess things up then:

  <bb 2>:
  a.0_4 = a;
  c_5 = (char) a.0_4;
  _6 = (int) c_5;
  if (c_5 == 0)
    goto <bb 3>;
  else
    goto <bb 4>;

  <bb 3>:
  b = 0;
  goto <bb 5>;

  <bb 4>:
  _9 = ASSERT_EXPR <_6, _6 != 0>;
  b = 0;
  _10 = _9 | 128;
  if (_10 < 0)

a.0_4: VARYING
c_5: VARYING
_6: [0, 127]
_9: [1, 127]  EQUIVALENCES: { _6 } (1 elements)
_10: [128, 255]
.MEM_15: VARYING

as you can see _6 is already bogus.  Which is because of

  <bb 2>:
  a.0_4 = a;
  c_5 = (char) a.0_4;
  # RANGE [0, 127] NONZERO 127
  _6 = (int) c_5;

which is because of ifcombine hoisting the def of _6 in

  if (c_5 >= 0)
    goto <bb 3>;
  else
    goto <bb 5>;

  <bb 3>:
  # RANGE [0, 127] NONZERO 127
  _6 = (int) c_5;
  if (c_5 == 0)
    goto <bb 4>;
  else
    goto <bb 5>;

above the guarding check!

  <bb 2>:
  a.0_4 = a;
  c_5 = (char) a.0_4;
  # RANGE [0, 127] NONZERO 127
  _6 = (int) c_5;
  if (c_5 == 0)
    goto <bb 3>;
  else
    goto <bb 4>;

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Wed Jul 22 11:31:50 2015
New Revision: 226062

URL: https://gcc.gnu.org/viewcvs?rev=226062&root=gcc&view=rev
Log:
2015-07-22  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66952
        * tree-ssa-ifcombine.c (pass_tree_ifcombine::execute): For
        blocks we end up executing unconditionally reset all SSA
        info such as range and alignment.
        * tree-ssanames.h (reset_flow_sensitive_info): Declare.
        * tree-ssanames.c (reset_flow_sensitive_info): New function.

        * gcc.dg/torture/pr66952.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr66952.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-ifcombine.c
    trunk/gcc/tree-ssanames.c
    trunk/gcc/tree-ssanames.h

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Thu Jul 23 11:19:26 2015
New Revision: 226104

URL: https://gcc.gnu.org/viewcvs?rev=226104&root=gcc&view=rev
Log:
2015-07-23  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66952
        * gcc.dg/torture/pr66952.c: Use signed char.

Modified:
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gcc.dg/torture/pr66952.c

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |6.0

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Also backported now.

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Sep 21 09:55:57 2015
New Revision: 227961

URL: https://gcc.gnu.org/viewcvs?rev=227961&root=gcc&view=rev
Log:
2015-09-21  Richard Biener  <rguenther@suse.de>

        Backport from mainline
        2015-07-08  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66793
        * gimple-ssa-isolate-paths.c
(insert_trap_and_remove_trailing_statemen):
        Properly split the block after stmts ending it.

        * gcc.dg/torture/pr66793.c: New testcase.

        2015-08-05  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67055
        * tree-ssa-ccp.c (fold_builtin_alloca_with_align): Handle
        NULL gimple_block.

        * g++.dg/torture/pr67055.C: New testcase.

        2015-08-05  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67121
        * tree-if-conv.c (combine_blocks): Clear range-info produced
        by stmts no longer executed conditionally.

        * gcc.dg/torture/pr67121.c: New testcase.

        2015-09-16  Richard Biener  <rguenther@suse.de>

        PR middle-end/67271
        * fold-const.c (native_encode_expr): Bail out on bogus offsets.

        * gcc.dg/pr67271.c: New testcase.

        2015-07-22  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66952
        * tree-ssa-ifcombine.c (pass_tree_ifcombine::execute): For
        blocks we end up executing unconditionally reset all SSA
        info such as range and alignment.
        * tree-ssanames.h (reset_flow_sensitive_info): Declare.
        * tree-ssanames.c (reset_flow_sensitive_info): New function.

        * gcc.dg/torture/pr66952.c: New testcase.

        2015-09-15  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67470
        * tree-ssa-loop-im.c (execute_sm_if_changed): Preserve PHI
        structure for PHI hoisting by inserting a forwarder block
        if appropriate.

        * gcc.dg/torture/pr67470.c: New testcase.

Added:
    branches/gcc-5-branch/gcc/testsuite/g++.dg/torture/pr67055.C
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/pr67271.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr66793.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr66952.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr67121.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr67470.c
Modified:
    branches/gcc-5-branch/gcc/ChangeLog
    branches/gcc-5-branch/gcc/fold-const.c
    branches/gcc-5-branch/gcc/gimple-ssa-isolate-paths.c
    branches/gcc-5-branch/gcc/testsuite/ChangeLog
    branches/gcc-5-branch/gcc/tree-if-conv.c
    branches/gcc-5-branch/gcc/tree-ssa-ccp.c
    branches/gcc-5-branch/gcc/tree-ssa-ifcombine.c
    branches/gcc-5-branch/gcc/tree-ssa-loop-im.c
    branches/gcc-5-branch/gcc/tree-ssanames.c
    branches/gcc-5-branch/gcc/tree-ssanames.h

[Bug tree-optimization/66952] [6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66952

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Tue Sep 22 07:47:21 2015
New Revision: 227995

URL: https://gcc.gnu.org/viewcvs?rev=227995&root=gcc&view=rev
Log:
2015-09-22  Richard Biener  <rguenther@suse.de>

        Backport from mainline
        2015-07-23  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66952
        * gcc.dg/torture/pr66952.c: Use signed char.

Modified:
    branches/gcc-5-branch/gcc/testsuite/ChangeLog
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr66952.c