[Bug rtl-optimization/67830] New: wrong code at -O1 and above on x86_64-linux-gnu

[Bug rtl-optimization/67830] New: wrong code at -O1 and above on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67830

            Bug ID: 67830
           Summary: wrong code at -O1 and above on x86_64-linux-gnu
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu
  Target Milestone: ---

The current gcc trunk mis-compiles the following code on x86_64-linux-gnu at
-O1 and above in both 32-bit and 64-bit modes. 

This is a regression from 5.2.x.


$ gcc-trunk -v 
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 6.0.0 20151002 (experimental) [trunk revision 228389] (GCC) 
$    
$ gcc-trunk -O0 small.c; ./a.out
$ gcc-5.2 -O1 small.c; ./a.out
$ 
$ gcc-trunk -O1 small.c
$ ./a.out
Aborted (core dumped)
$ 


----------------------------


int a, b, *g, h;
unsigned char c, d;

int
main ()
{
  int f, e = -2;
  b = e;
  g = &b;
  h = c = a + 1;
  f = d - h;
  *g &= f;

  if (b != -2)
    __builtin_abort ();

  return 0;
}

[Bug tree-optimization/67830] [6 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67830

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2015-10-05
          Component|rtl-optimization            |tree-optimization
   Target Milestone|---                         |6.0
            Summary|wrong code at -O1 and above |[6 Regression] wrong code
                   |on x86_64-linux-gnu         |at -O1 and above on
                   |                            |x86_64-linux-gnu
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  .optimized already has an unconditional abort() call and forwprop2
changes it to that.

Applying pattern match.pd:2322, gimple-match.c:2002
gimple_simplified to _15 = d.2_9 - _5;
_16 = _15 & 254;
_12 = (int) _16;
Applying pattern match.pd:1853, generic-match.c:5128
  Replaced '_12 != -2' with '1'
gimple_simplified to if (1 != 0)

[Bug tree-optimization/67830] [6 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67830

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |NEW
                 CC|                            |law at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
  _7 = (int) _5;
  _10 = (int) d.2_9;
  f_11 = _10 - _7;
  _12 = f_11 & -2;

with _5 and d.2_9 being of type unsigned char is transformed to

  _15 = d.2_9 - _5;
  _16 = _15 & 254;
  _12 = (int) _16;

with _16 being unsigned char.  That looks wrong as it changes a
sign-extended subtraction result to a zero-extended one.

CCing Jeff who added that pattern.

[Bug tree-optimization/67830] [6 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67830

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mpolacek at gcc dot gnu.org

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r222877.

[Bug tree-optimization/67830] [6 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[law at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67830

Jeffrey A. Law <law at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at redhat dot com

--- Comment #4 from Jeffrey A. Law <law at redhat dot com> ---
The discrepancy between the release checking and development build is the
ENABLE_GC_CHECKING is not enabled in the former, but is enabled in the latter.

We're looking at a gc_free'd blob of memory in the threader due to a case which
I initially didn't think could happen because of some oddities in the FSM bits
that I'd forgotten about.

I'm pondering the best way forward.

[Bug tree-optimization/67830] [6 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67830

--- Comment #6 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Author: law
Date: Fri Oct 23 19:16:53 2015
New Revision: 229267

URL: https://gcc.gnu.org/viewcvs?rev=229267&root=gcc&view=rev
Log:
[RFA] Fix pr67830, another type narrowing problem

        PR tree-optimization/67830
        * match.pd ((bit_and (plus/minus (convert @0) (convert @1)) mask)):
        Explicitly verify the mask has no bits outside the type of
        the innermost operands.

        PR tree-optimization/67830
        * gcc.dg/pr67830.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr67830.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/match.pd
    trunk/gcc/testsuite/ChangeLog

[Bug tree-optimization/67830] [6 Regression] wrong code at -O1 and above on x86_64-linux-gnu

[law at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67830

Jeffrey A. Law <law at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Jeffrey A. Law <law at redhat dot com> ---
Fixed on the trunk.