[Bug tree-optimization/67121] New: wrong code at -O3 on x86_64-linux-gnu

[Bug tree-optimization/67121] New: wrong code at -O3 on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

            Bug ID: 67121
           Summary: wrong code at -O3 on x86_64-linux-gnu
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu
  Target Milestone: ---

The current gcc trunk miscompiles the following code on x86_64-linux-gnu at -O3
 in both 32-bit and 64-bit modes. 

This is a regression from 5.1.x.

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 6.0.0 20150804 (experimental) [trunk revision 226592] (GCC) 
$ 
$ gcc-trunk -O2 small.c; ./a.out
$ gcc-5.1 -O3 small.c; ./a.out
$ 
$ gcc-trunk -O3 small.c
$ ./a.out
Aborted (core dumped)
$ 


-----------------------------------


int a[6], b, c = 226, d, e, f;
char g;

void
fn1 (int p1)
{
  b = a[p1];
}

int
main ()
{
  a[0] = 1;
  for (f = 0; f < 9; f++)
    {
      char h = c;
      int i = 1;
      g = h < 0 ? h : h >> i;
      e = g;
      for (d = 1; d; d = 0)
        ;
    }
  fn1 (g >> 8 & 1);

  if (b != 0) 
    __builtin_abort (); 

  return 0;
}

[Bug tree-optimization/67121] [6 Regression] wrong code at -O3 on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-08-05
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |6.0
            Summary|wrong code at -O3 on        |[6 Regression] wrong code
                   |x86_64-linux-gnu            |at -O3 on x86_64-linux-gnu
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/67121] [6 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Hmm.

Visiting statement:
h_38 = (char) pretmp_48;
Found new range for h_38: VARYING

...

Visiting statement:
_42 = (int) h_38;
Intersecting
  [-128, 127]
and
  [0, 127]
to
  [0, 127]
Found new range for _42: [0, 127]

so it seems that the old value-range for _42 is bad:

  # RANGE [0, 127] NONZERO 127
  _42 = (int) h_38;

Before if-conversion we have

  <bb 2>:
  a[0] = 1;
  f = 0;
  pretmp_48 = c;

  <bb 3>:
  # f.4_36 = PHI <0(2), _19(6)>
  # ivtmp_59 = PHI <9(2), ivtmp_28(6)>
  h_9 = (char) pretmp_48;
  if (h_9 >= 0)
    goto <bb 4>;
  else
    goto <bb 10>;

  <bb 4>:
  # RANGE [0, 127] NONZERO 127
  _10 = (int) h_9;

while after:

  <bb 2>:
  a[0] = 1;
  f = 0;
  pretmp_48 = c;

  <bb 3>:
  # f.4_36 = PHI <0(2), _19(4)>
  # ivtmp_59 = PHI <9(2), ivtmp_28(4)>
  h_9 = (char) pretmp_48;
  # RANGE [0, 127] NONZERO 127
  _10 = (int) h_9;
...
  prephitmp_3 = h_9 >= 0 ? _14 : _38;

so if-conversion has to reset value-range info on stmts previously
conditionally
executed.

[Bug tree-optimization/67121] [6 Regression] wrong code at -O3 on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

--- Comment #4 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r223863.

[Bug tree-optimization/67121] [6 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Wed Aug  5 14:16:51 2015
New Revision: 226630

URL: https://gcc.gnu.org/viewcvs?rev=226630&root=gcc&view=rev
Log:
2015-08-05  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67121
        * tree-if-conv.c (combine_blocks): Clear range-info produced
        by stmts no longer executed conditionally.

        * gcc.dg/torture/pr67121.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr67121.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-if-conv.c

[Bug tree-optimization/67121] [6 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk but latent issue on the branches, esp. the gcc 5 branch which
also uses old ranges during VRP2.

[Bug tree-optimization/67121] [5 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |6.0
   Target Milestone|6.0                         |5.3
            Summary|[6 Regression] wrong code   |[5 Regression] wrong code
                   |at -O3 on x86_64-linux-gnu  |at -O3 on x86_64-linux-gnu

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Marking for backport.

[Bug tree-optimization/67121] [5 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Sep 21 09:55:57 2015
New Revision: 227961

URL: https://gcc.gnu.org/viewcvs?rev=227961&root=gcc&view=rev
Log:
2015-09-21  Richard Biener  <rguenther@suse.de>

        Backport from mainline
        2015-07-08  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66793
        * gimple-ssa-isolate-paths.c
(insert_trap_and_remove_trailing_statemen):
        Properly split the block after stmts ending it.

        * gcc.dg/torture/pr66793.c: New testcase.

        2015-08-05  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67055
        * tree-ssa-ccp.c (fold_builtin_alloca_with_align): Handle
        NULL gimple_block.

        * g++.dg/torture/pr67055.C: New testcase.

        2015-08-05  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67121
        * tree-if-conv.c (combine_blocks): Clear range-info produced
        by stmts no longer executed conditionally.

        * gcc.dg/torture/pr67121.c: New testcase.

        2015-09-16  Richard Biener  <rguenther@suse.de>

        PR middle-end/67271
        * fold-const.c (native_encode_expr): Bail out on bogus offsets.

        * gcc.dg/pr67271.c: New testcase.

        2015-07-22  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66952
        * tree-ssa-ifcombine.c (pass_tree_ifcombine::execute): For
        blocks we end up executing unconditionally reset all SSA
        info such as range and alignment.
        * tree-ssanames.h (reset_flow_sensitive_info): Declare.
        * tree-ssanames.c (reset_flow_sensitive_info): New function.

        * gcc.dg/torture/pr66952.c: New testcase.

        2015-09-15  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/67470
        * tree-ssa-loop-im.c (execute_sm_if_changed): Preserve PHI
        structure for PHI hoisting by inserting a forwarder block
        if appropriate.

        * gcc.dg/torture/pr67470.c: New testcase.

Added:
    branches/gcc-5-branch/gcc/testsuite/g++.dg/torture/pr67055.C
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/pr67271.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr66793.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr66952.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr67121.c
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/torture/pr67470.c
Modified:
    branches/gcc-5-branch/gcc/ChangeLog
    branches/gcc-5-branch/gcc/fold-const.c
    branches/gcc-5-branch/gcc/gimple-ssa-isolate-paths.c
    branches/gcc-5-branch/gcc/testsuite/ChangeLog
    branches/gcc-5-branch/gcc/tree-if-conv.c
    branches/gcc-5-branch/gcc/tree-ssa-ccp.c
    branches/gcc-5-branch/gcc/tree-ssa-ifcombine.c
    branches/gcc-5-branch/gcc/tree-ssa-loop-im.c
    branches/gcc-5-branch/gcc/tree-ssanames.c
    branches/gcc-5-branch/gcc/tree-ssanames.h

[Bug tree-optimization/67121] [5 Regression] wrong code at -O3 on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67121

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
      Known to fail|                            |5.2.0

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.