[Bug tree-optimization/67196] New: Another false positive from -Wmaybe-uninitialized

[Bug tree-optimization/67196] New: Another false positive from -Wmaybe-uninitialized

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

            Bug ID: 67196
           Summary: Another false positive from -Wmaybe-uninitialized
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

Created attachment 36176
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=36176&action=edit
Reproducer

The attached generates a false -Wmaybe-uninitialized warning:

$ gcc -O1 -Wall -c diagnostic.cc
diagnostic.cc: In function ‘void test(int)’:
diagnostic.cc:28:28: warning: ‘first_caption_idx’ may be used uninitialized in
this function [-Wmaybe-uninitialized]
     foo (first_caption_idx); /* get bogus warning here at -O1 and above */
                            ^
Seen with gcc 4.8.3 and with trunk (specifically, r226697).
>From gcc-bugs-return-494683-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Wed Aug 12 19:29:39 2015
Return-Path: <gcc-bugs-return-494683-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 20872 invoked by alias); 12 Aug 2015 19:29:39 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 20835 invoked by uid 48); 12 Aug 2015 19:29:33 -0000
From: "luto at mit dot edu" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug inline-asm/66631] inability to clobber segment regs makes tls problematic
Date: Wed, 12 Aug 2015 19:29:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: inline-asm
X-Bugzilla-Version: 5.1.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: luto at mit dot edu
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-66631-4-Zi9rrYC0BS@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-66631-4@http.gcc.gnu.org/bugzilla/>
References: <bug-66631-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-08/txt/msg00825.txt.bz2
Content-length: 1060

https://gcc.gnu.org/bugzilla/show_bug.cgi?idf631

Andy Lutomirski <luto at mit dot edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |luto at mit dot edu

--- Comment #17 from Andy Lutomirski <luto at mit dot edu> ---
I'll chime in, possibly uselessly.

Before Linux 4.1, only CS was saved.  (Unless you go *way* back.)  In  4.1 or
newer, SS is saved, too.

In 64-bit code, DS and ES have no effect*, so I don't think it should affect
code gen.

FS and GS are weird, and they may get weirder when WRGSBASE and friends are
enabled, which will happen at some point.

Anyway, I tend to agree with Andrew here, I think: if you want to fiddle with
FS and GS, write a little asm wrapper around the C code.

* Except in an odd case on AMD processors that is mostly invisible to
userspace.  On new enough kernels, it's completely invisible to userspace, and
I don't think it was ever visible without long jumps or such.

[Bug tree-optimization/67196] Another false positive from -Wmaybe-uninitialized

[manu at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Manuel López-Ibáñez <manu at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-08-12
                 CC|                            |manu at gcc dot gnu.org
             Blocks|                            |24639
     Ever confirmed|0                           |1

--- Comment #1 from Manuel López-Ibáñez <manu at gcc dot gnu.org> ---
For some reason, the uninit pass does not even analyze the predicates and
thinks all uses are unguarded (or it doesn't dump it).

A shorter testcase:

int some_test(int);

int test (int n)
{
  int num_captions_in_row = 0;
  int first_caption = 0; /* set to zero here */
  int first_caption_idx;
  int i;
  for (i = 0; i < n; i++)
    {
      if (some_test (i))
        {
          num_captions_in_row++;
          first_caption = 1; /* only ever set here */
          first_caption_idx = i; /* set here */
        }
    }

  /* The guard on "first_caption" here requires we entered the block
     above that sets "first_caption_idx". */
  if (first_caption && num_captions_in_row == 1)
    return first_caption_idx; /* get bogus warning here at -O1 and above */
  return 0;
}


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=24639
[Bug 24639] [meta-bug] bug to track all Wuninitialized issues
>From gcc-bugs-return-494688-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Wed Aug 12 21:00:20 2015
Return-Path: <gcc-bugs-return-494688-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 57861 invoked by alias); 12 Aug 2015 21:00:20 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 57820 invoked by uid 55); 12 Aug 2015 21:00:16 -0000
From: "joseph at codesourcery dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/67172] [5/6 regression] i686-w64-mingw32 dwarf2 bootstrap fails with undefined reference to __EH_FRAME_BEGIN__
Date: Wed, 12 Aug 2015 21:00:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: joseph at codesourcery dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.3
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-67172-4-HLt4a4FBt5@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-67172-4@http.gcc.gnu.org/bugzilla/>
References: <bug-67172-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-08/txt/msg00830.txt.bz2
Content-length: 831

https://gcc.gnu.org/bugzilla/show_bug.cgi?idg172

--- Comment #4 from joseph at codesourcery dot com <joseph at codesourcery dot com> ---
On Tue, 11 Aug 2015, breedlove.matt at gmail dot com wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?idg172
>
> --- Comment #3 from Matt Breedlove <breedlove.matt at gmail dot com> ---
> In gcc/defaults.h, it gets defined via:

So why does not exactly the same sequence of conditional macro definitions
apply when libgcc is being built and so cause your patch to be
ineffective, given that libgcc does still include the host-side tm.h until
the transition away from host-side target macros in target-side code is
complete?  (In any case, my point still applies: stop
__LIBGCC_EH_FRAME_SECTION_NAME__ being defined if it's incorrect, which
means some sort of host-side change.)

[Bug tree-optimization/67196] [9/10/11 Regression] loop-induced false positive from -Wmaybe-uninitialized

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2015-08-12 00:00:00         |2021-3-31
      Known to fail|                            |10.2.0, 11.0, 5.5.0, 6.4.0,
                   |                            |7.2.0, 8.3.0, 9.1.0
                 CC|                            |msebor at gcc dot gnu.org
            Summary|Another false positive from |[9/10/11 Regression]
                   |-Wmaybe-uninitialized       |loop-induced false positive
                   |                            |from -Wmaybe-uninitialized
           Keywords|                            |diagnostic

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
Reconfirmed with GCC 11 as a regression introduced in r185913 (4.8.0 20120328).

Nothing in the IL jumps out at me that could be used by the predicate analysis
to rule out the false positive: the use in the return statement in bb 8 looks
unconditional.

pr67196.c: In function ‘test’:
pr67196.c:7:7: warning: ‘first_caption_idx’ may be used uninitialized in this
function [-Wmaybe-uninitialized]
    7 |   int first_caption_idx;
      |       ^~~~~~~~~~~~~~~~~
int test (int n)
{
  int i;
  int first_caption_idx;
  int first_caption;
  int num_captions_in_row;
  int _1;
  _Bool _2;
  _Bool _3;
  _Bool _4;
  int _12;

  <bb 2> [local count: 118111600]:
  if (n_16(D) > 0)
    goto <bb 9>; [89.00%]
  else
    goto <bb 11>; [11.00%]

  <bb 11> [local count: 12992276]:
  goto <bb 8>; [100.00%]

  <bb 9> [local count: 105119324]:

  <bb 3> [local count: 955630225]:
  # num_captions_in_row_25 = PHI <num_captions_in_row_5(10), 0(9)>
  # first_caption_27 = PHI <first_caption_7(10), 0(9)>
  # first_caption_idx_29 = PHI <first_caption_idx_9(10),
                               first_caption_idx_14(D)(9)>          <<< (3)
first_caption_idx_14(D) is uninitialized
  # i_31 = PHI <i_19(10), 0(9)>
  _1 = some_test (i_31);
  if (_1 != 0)
    goto <bb 4>; [50.00%]
  else
    goto <bb 12>; [50.00%]

  <bb 12> [local count: 477815113]:
  goto <bb 5>; [100.00%]

  <bb 4> [local count: 477815112]:
  num_captions_in_row_18 = num_captions_in_row_25 + 1;

  <bb 5> [local count: 955630225]:
  # num_captions_in_row_5 = PHI <num_captions_in_row_25(12),
num_captions_in_row_18(4)>
  # first_caption_7 = PHI <first_caption_27(12), 1(4)>
  # first_caption_idx_9 = PHI <first_caption_idx_29(12), i_31(4)>   <<< (2)
  i_19 = i_31 + 1;
  if (n_16(D) != i_19)
    goto <bb 10>; [89.00%]
  else
    goto <bb 6>; [11.00%]

  <bb 10> [local count: 850510901]:
  goto <bb 3>; [100.00%]

  <bb 6> [local count: 105119324]:
  _2 = first_caption_7 != 0;
  _3 = num_captions_in_row_5 == 1;
  _4 = _2 & _3;
  if (_4 != 0)
    goto <bb 13>; [38.20%]
  else
    goto <bb 7>; [61.80%]

  <bb 13> [local count: 40157944]:
  goto <bb 8>; [100.00%]

  <bb 7> [local count: 64961380]:

  <bb 8> [local count: 118111600]:
  # _12 = PHI <first_caption_idx_9(13), 0(7), 0(11)>                <<< (1)
  return _12;                                                       <<< use

}

[Bug tree-optimization/67196] [9/10/11 Regression] loop-induced false positive from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |9.4

[Bug tree-optimization/67196] [9/10/11/12 Regression] loop-induced false positive from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.4                         |9.5

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9.4 is being released, retargeting bugs to GCC 9.5.

[Bug tree-optimization/67196] [9/10/11/12 Regression] loop-induced false positive from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/67196] [10/11/12/13 Regression] loop-induced false positive from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.5                         |10.4

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9 branch is being closed

[Bug tree-optimization/67196] [10/11/12/13 Regression] loop-induced false positive from -Wmaybe-uninitialized

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug tree-optimization/67196] [10/11/12/13 Regression] loop-induced false positive from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
The issue is that the code supposed to deal with this,
uninit_analysis::overlap,
does not handle the case of chained PHIs very well, that is,

<bb 5> [local count: 955630225]:
# num_captions_in_row_5 = PHI <num_captions_in_row_25(11),
num_captions_in_row_18(4)>
# first_caption_7 = PHI <first_caption_27(11), 1(4)>
# first_caption_idx_9 = PHI <first_caption_idx_29(11), i_31(4)>
i_19 = i_31 + 1;
if (n_16(D) != i_19)
  goto <bb 12>; [89.00%]
else
  goto <bb 6>; [11.00%]

...

<bb 6> [local count: 105119324]:
_2 = first_caption_7 != 0;
_3 = num_captions_in_row_5 == 1;
_4 = _2 & _3;
if (_4 != 0)
  goto <bb 7>; [38.20%]
else
  goto <bb 13>; [61.80%]

...

<bb 8> [local count: 118111600]:
# _12 = PHI <first_caption_idx_9(7), 0(13), 0(10)>
return _12;

the code searchess for a PHI definition of num_captions_in_row_5 in the
same block as the _12 = PHI <>, not realizing that uninit analysis
also includes edges from the _9 = PHI <> in BB5 where the definition
ultimatively resides.

Then there's the issue that use predicates are not yet normalized at
this point so there's still the _4 != 0 test instead of the two ANDed
ones.

With both fixed the diagnostic is gone.

[Bug tree-optimization/67196] [10/11/12/13 Regression] loop-induced false positive from -Wmaybe-uninitialized

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:61051ee5cfd59ee292984641d02caac85f6dfac3

commit r13-2273-g61051ee5cfd59ee292984641d02caac85f6dfac3
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Aug 30 11:47:49 2022 +0200

    tree-optimization/67196 - normalize use predicates earlier

    The following makes sure to have use predicates simplified and
    normalized before doing uninit_analysis::overlap because that
    otherwise cannot pick up all flag setting cases.  This fixes
    half of the issue in PR67196 and conveniently resolves the
    XFAIL in gcc.dg/uninit-pred-7_a.c.

            PR tree-optimization/67196
            * gimple-predicate-analysis.cc (uninit_analysis::is_use_guarded):
            Simplify and normalize use prediates before first use.

            * gcc.dg/uninit-pred-7_a.c: Un-XFAIL.

[Bug tree-optimization/67196] [10/11/12 Regression] loop-induced false positive from -Wmaybe-uninitialized

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org
            Summary|[10/11/12/13 Regression]    |[10/11/12 Regression]
                   |loop-induced false positive |loop-induced false positive
                   |from -Wmaybe-uninitialized  |from -Wmaybe-uninitialized

--- Comment #9 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Working with the trunk, so removing 13 regression marker.

[Bug tree-optimization/67196] [10/11/12 Regression] loop-induced false positive from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |13.0
           Keywords|                            |needs-bisection

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed that it works, the cited patch didn't fix it though(?), so I wonder
what did.

[Bug tree-optimization/67196] [11/12 Regression] loop-induced false positive from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67196

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5
      Known to fail|                            |10.5.0
            Summary|[10/11/12 Regression]       |[11/12 Regression]
                   |loop-induced false positive |loop-induced false positive
                   |from -Wmaybe-uninitialized  |from -Wmaybe-uninitialized