[Bug middle-end/67194] New: Missed jump thread and false positive from -Wuninitialized

[Bug middle-end/67194] New: Missed jump thread and false positive from -Wuninitialized

[law at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

            Bug ID: 67194
           Summary: Missed jump thread and false positive from
                    -Wuninitialized
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: law at redhat dot com
  Target Milestone: ---

Extracted from bz55035:

Reconfirmed.

Nowadays (trunk@221914) also breaks all-gcc for nios2-linux-gnu.
Reminds me of bug #36550

Smallish testcase:

$ cat reload1.i ; echo EOF
/* PR target/55035 */
/* { dg-do compile } */
/* { dg-options "-O2 -W -Wall -Werror" } */
struct rtx_def;
typedef struct rtx_def *rtx;
enum rtx_code {
  UNKNOWN,
  INSN, 
  ASM_INPUT,
  CLOBBER
};
struct rtx_def {
  enum rtx_code code: 4;
};
class rtx_def;
class rtx_insn : public rtx_def {};
struct recog_data_d
{
  rtx operand[30];
  rtx *operand_loc[30];
  rtx *dup_loc[1];
  char dup_num[1];
  char n_operands;
  char n_dups;
};
extern struct recog_data_d recog_data;
extern int get_int(void);
void
elimination_costs_in_insn (rtx_insn *insn)
{
  int icode = get_int ();
  int i;
  rtx orig_operand[30];
  rtx orig_dup[30];
  if (icode < 0)
    {
      if (((enum rtx_code) insn->code) == INSN)
        __builtin_abort();
      return;
    }
  for (i = 0; i < recog_data.n_dups; i++)
    orig_dup[i] = *recog_data.dup_loc[i];
  for (i = 0; i < recog_data.n_operands; i++)
    {
      orig_operand[i] = recog_data.operand[i];
      if (orig_operand[i]->code == CLOBBER)
        *recog_data.operand_loc[i] = 0;
    }
  for (i = 0; i < recog_data.n_dups; i++)
    *recog_data.dup_loc[i]
      = *recog_data.operand_loc[(int) recog_data.dup_num[i]];
  for (i = 0; i < recog_data.n_dups; i++)
    *recog_data.dup_loc[i] = orig_dup[i];
}
EOF

$ g++ -O2 -W -Wall -Werror -c reload1.i -o reload1.o
reload1.i: In function ‘void elimination_costs_in_insn(rtx_insn*)’:
reload1.i:53:41: error: ‘orig_dup[0]’ may be used uninitialized in this
function [-Werror=maybe-uninitialized]
     *recog_data.dup_loc[i] = orig_dup[i];
                                         ^
cc1plus: all warnings being treated as errors

And a second, related testcase:

typedef struct rtx_def *rtx;
struct recog_data_d
{
  rtx operand;
  char n_dups;
};

rtx *operand_loc;
rtx dup_loc;

struct recog_data_d recog_data;

void elimination_costs_in_insn ()
{
  rtx orig_dup;
  if (recog_data.n_dups)
      orig_dup = dup_loc;
  *operand_loc = 0;
  if (recog_data.n_dups)
      dup_loc = orig_dup;
}

A warning is issued even at -O1. If I remove "rtx operand" field from struct
recog_data_d (or if I change the type of n_dups to int), then it disappears at
-O2 (but still present at -O1).

In both cases the -Wuninitialized warning is bogus and points to a miss jump
threading opportunity.
>From gcc-bugs-return-494667-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Wed Aug 12 17:26:01 2015
Return-Path: <gcc-bugs-return-494667-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 84293 invoked by alias); 12 Aug 2015 17:26:01 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 84233 invoked by uid 55); 12 Aug 2015 17:25:54 -0000
From: "mpolacek at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/55095] Wshift-overflow
Date: Wed, 12 Aug 2015 17:26:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 4.8.0
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: enhancement
X-Bugzilla-Who: mpolacek at gcc dot gnu.org
X-Bugzilla-Status: REOPENED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: mpolacek at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 6.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-55095-4-To6xyeymHh@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-55095-4@http.gcc.gnu.org/bugzilla/>
References: <bug-55095-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-08/txt/msg00809.txt.bz2
Content-length: 832

https://gcc.gnu.org/bugzilla/show_bug.cgi?idU095

--- Comment #19 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Wed Aug 12 17:25:23 2015
New Revision: 226826

URL: https://gcc.gnu.org/viewcvs?rev"6826&root=gcc&view=rev
Log:
        PR c++/55095
        * c-common.c (maybe_warn_shift_overflow): Properly handle
        left-shifting 1 into the sign bit.

        * c-c++-common/Wshift-overflow-6.c: New test.
        * c-c++-common/Wshift-overflow-7.c: New test.
        * g++.dg/cpp1y/left-shift-2.C: New test.

Added:
    trunk/gcc/testsuite/c-c++-common/Wshift-overflow-6.c
    trunk/gcc/testsuite/c-c++-common/Wshift-overflow-7.c
    trunk/gcc/testsuite/g++.dg/cpp1y/left-shift-2.C
Modified:
    trunk/gcc/c-family/ChangeLog
    trunk/gcc/c-family/c-common.c
    trunk/gcc/testsuite/ChangeLog

[Bug middle-end/67194] [9/10/11 Regression] Missed jump thread and false positive from -Wuninitialized

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |4.8.0
            Summary|Missed jump thread and      |[9/10/11 Regression] Missed
                   |false positive from         |jump thread and false
                   |-Wuninitialized             |positive from
                   |                            |-Wuninitialized
                 CC|                            |msebor at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-03-31
      Known to fail|                            |10.2.0, 11.0, 4.8.4, 4.9.4,
                   |                            |5.5.0, 6.4.0, 7.2.0, 8.3.0,
                   |                            |9.1.0

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
Confirmed with GCC 11 as a regression introduced in r192537 (4.8.0 20121017):

$ gcc -O2 -S -Wall -xc++ pr67194.c
pr67194.c: In function ‘void elimination_costs_in_insn(rtx_insn*)’:
pr67194.c:53:28: warning: ‘orig_dup[0]’ may be used uninitialized in this
function [-Wmaybe-uninitialized]
   53 |     *recog_data.dup_loc[i] = orig_dup[i];
      |     ~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~
pr67194.c:34:7: note: ‘orig_dup[0]’ was declared here
   34 |   rtx orig_dup[30];
      |       ^~~~~~~~

[Bug middle-end/67194] [9/10/11 Regression] Missed jump thread and false positive from -Wuninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |9.4

[Bug middle-end/67194] [9/10/11/12 Regression] Missed jump thread and false positive from -Wuninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.4                         |9.5

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9.4 is being released, retargeting bugs to GCC 9.5.

[Bug tree-optimization/67194] [9/10/11/12 Regression] Missed jump thread and false positive from -Wuninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/67194] [10/11/12/13 Regression] Missed jump thread and false positive from -Wuninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.5                         |10.4

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9 branch is being closed

[Bug tree-optimization/67194] [10/11/12/13 Regression] Missed jump thread and false positive from -Wuninitialized

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug tree-optimization/67194] [10/11/12/13 Regression] Missed jump thread and false positive from -Wuninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
For the second testcase the issue is the aliasing store *operand_loc = 0;
which can invalidate the predicate value.  Fixed with -fstrict-aliasing (or
-O2).
Nothing uninit analysis can do here.

The first testcase has a similar issue at -O2 because of the union now
containing rtx *.

I don't see what we can do here - if there's no aliasing the code needs to say
that or be optimized in source.

[Bug tree-optimization/67194] [11/12/13/14 Regression] Missed jump thread and false positive from -Wuninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67194

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.