[Bug ipa/94232] New: [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[Bug ipa/94232] New: [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

            Bug ID: 94232
           Summary: [10 Regression] Wrong code since
                    r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

I see quite a lot of package failures after the revision. One of the affected
is gengetopt.

I isolated the ipa_get_jf_ancestor_result change into only one transformation
which causes the following crash:

$ valgrind ../src/gengetopt --gen-version --input=test_modes_cmd.ggo
--func-name=test_modes_cmd_parser --file-name=test_modes_cmd --unnamed-opt
--show-required
==22646== Memcheck, a memory error detector
==22646== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==22646== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==22646== Command: ../src/gengetopt --gen-version --input=test_modes_cmd.ggo
--func-name=test_modes_cmd_parser --file-name=test_modes_cmd --unnamed-opt
--show-required
==22646== 
==22646== 
==22646== Process terminating with default action of signal 11 (SIGSEGV):
dumping core
==22646==  Bad permissions for mapped region at address 0x445098
==22646==    at 0x4904DCF:
std::__detail::_List_node_base::_M_hook(std::__detail::_List_node_base*)
(list.cc:132)
==22646==    by 0x427D16:
CmdlineParserCreator::generate_check_modes(std::ostream&, unsigned int) (in
/home/marxin/BIG/osc/openSUSE:Factory:Staging:Gcc7/gengetopt/gengetopt-2.23/src/gengetopt)
==22646==    by 0x43ADBA: CmdlineParserCreator::generate_source() (in
/home/marxin/BIG/osc/openSUSE:Factory:Staging:Gcc7/gengetopt/gengetopt-2.23/src/gengetopt)
==22646==    by 0x40790E: main (in
/home/marxin/BIG/osc/openSUSE:Factory:Staging:Gcc7/gengetopt/gengetopt-2.23/src/gengetopt)

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48067
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48067&action=edit
good optimized dump

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48068
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48068&action=edit
bad optimized dump

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
      Known to work|                            |9.3.0
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2020-03-20
                 CC|                            |rguenth at gcc dot gnu.org
           Priority|P3                          |P1
      Known to fail|                            |10.0
   Target Milestone|---                         |10.0

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48069
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48069&action=edit
good ipa cp dump

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48070
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48070&action=edit
bad ipa cp dump

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48071
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48071&action=edit
good fixup dump

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
Created attachment 48072
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48072&action=edit
bad fixup dump

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #8 from Martin Liška <marxin at gcc dot gnu.org> ---
Looking at the fixup diff. Isn't it caused with:

# __y_329 = PHI <&MEM <void *> [(struct map *)&modeOptionMap + 8B](32),
__y_328(33)>
# __y_329 = PHI <&MEM <struct ModeOptionMap> [(void *)&modeOptionMap +
64B](32), __y_328(33)>

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #9 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #8)
> Looking at the fixup diff. Isn't it caused with:
> 
> # __y_329 = PHI <&MEM <void *> [(struct map *)&modeOptionMap + 8B](32),
> __y_328(33)>
> # __y_329 = PHI <&MEM <struct ModeOptionMap> [(void *)&modeOptionMap +
> 64B](32), __y_328(33)>

That should be the root cause. ipa_get_jf_ancestor_result returns:

good:
 <addr_expr 0x7ffff7061940
    type <pointer_type 0x7ffff76e0a80
        type <pointer_type 0x7ffff7868000 type <void_type 0x7ffff7861f18 void>
            public unsigned DI
            size <integer_cst 0x7ffff784cbb8 constant 64>
            unit-size <integer_cst 0x7ffff784cbd0 constant 8>
            align:64 warn_if_not_align:0 symtab:0 alias-set 4
structural-equality
            pointer_to_this <pointer_type 0x7ffff76e0a80>>
        unsigned DI size <integer_cst 0x7ffff784cbb8 64> unit-size <integer_cst
0x7ffff784cbd0 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 structural-equality>
    constant
    arg:0 <mem_ref 0x7ffff6d47e60 type <pointer_type 0x7ffff7868000>

        arg:0 <addr_expr 0x7ffff7061360 type <pointer_type 0x7ffff7737c78>
            constant arg:0 <var_decl 0x7ffff7767480 modeOptionMap>>
        arg:1 <integer_cst 0x7ffff6d59708 constant 8>>>

bad:
 <addr_expr 0x7ffff70612e0
    type <pointer_type 0x7ffff7737c78
        type <record_type 0x7ffff7737bd0 ModeOptionMap addressable cxx-odr-p
BLK
            size <integer_cst 0x7ffff7a45f30 constant 384>
            unit-size <integer_cst 0x7ffff7a45828 constant 48>
            align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff7737b28
            attributes <tree_list 0x7ffff764ebe0
                purpose <identifier_node 0x7ffff764ebb8 abi_tag>
                value <tree_list 0x7ffff764eb90
                    value <string_cst 0x7ffff7a42820 type <array_type
0x7ffff76541f8>
                        readonly constant static "cxx11\000">>> fields
<field_decl 0x7ffff773bab0 _M_t> context <namespace_decl 0x7ffff76501c8 std>
            pointer_to_this <pointer_type 0x7ffff7737c78>>
        unsigned DI
        size <integer_cst 0x7ffff784cbb8 constant 64>
        unit-size <integer_cst 0x7ffff784cbd0 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 structural-equality>
    constant
    arg:0 <mem_ref 0x7ffff6d47578 type <record_type 0x7ffff7737bd0
ModeOptionMap>

        arg:0 <addr_expr 0x7ffff7054480 type <pointer_type 0x7ffff7737c78>
            constant arg:0 <var_decl 0x7ffff7767480 modeOptionMap>>
        arg:1 <integer_cst 0x7ffff6d596d8 constant 64>>>

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|rguenth at gcc dot gnu.org         |marxin at gcc dot gnu.org

--- Comment #10 from Martin Liška <marxin at gcc dot gnu.org> ---
I know how to fix it.

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #11 from Martin Liška <marxin at gcc dot gnu.org> ---
Untested fix:

diff --git a/gcc/ipa-cp.c b/gcc/ipa-cp.c
index 1c17010e369..afa3fd972eb 100644
--- a/gcc/ipa-cp.c
+++ b/gcc/ipa-cp.c
@@ -1356,9 +1356,11 @@ ipa_get_jf_ancestor_result (struct ipa_jump_func *jfunc,
tree input)
       poly_int64 off = ipa_get_jf_ancestor_offset (jfunc);
       if (known_eq (off, 0))
        return input;
+      poly_int64 byte_offset = exact_div (off, BITS_PER_UNIT);
       return build1 (ADDR_EXPR, TREE_TYPE (input),
                     fold_build2 (MEM_REF, TREE_TYPE (TREE_TYPE (input)),
-                                 input, build_int_cst (ptr_type_node, off)));
+                                 input,
+                                 build_int_cst (ptr_type_node, byte_offset)));
     }
   else
     return NULL_TREE;

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #12 from Martin Liška <marxin at gcc dot gnu.org> ---
@Martin: It seems that the affected code has no coverage. Can you please add a
run-time test?

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Liska <marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:7d4549b2cd209eb621453ce13be7ffd84ffa720a

commit r10-7292-g7d4549b2cd209eb621453ce13be7ffd84ffa720a
Author: Martin Liska <mliska@suse.cz>
Date:   Fri Mar 20 11:01:13 2020 +0100

    Fix correct offset in ipa_get_jf_ancestor_result.

            PR ipa/94232
            * ipa-cp.c (ipa_get_jf_ancestor_result): Use offset in bytes.
Previously
            build_ref_for_offset function was used and it transforms off to
bytes
            from bits.

[Bug ipa/94232] [10 Regression] Wrong code since r10-7273-gf3280e4c0c98e103603bafc466ea49651fe0b7f2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94232

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #14 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed.