[Bug rtl-optimization/95123] New: [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[Bug rtl-optimization/95123] New: [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

            Bug ID: 95123
           Summary: [10/11 Regression] Wrong code w/ -O2
                    -fselective-scheduling2 -funroll-loops --param
                    early-inlining-insns=5 --param
                    loop-invariant-max-bbs-in-loop=3 --param
                    max-jump-thread-duplication-stmts=0
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---
            Target: x86_64-unknown-linux-gnu

The following program, compiled w/ gcc-11.0.0-alpha20200510 snapshot
(g:13a46321516e2efd3bbb1f1899c539c6724240a9) w/ -O2 -fselective-scheduling2
-funroll-loops --param early-inlining-insns=5 --param
loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0,
segfauls on run-time:

int ak, mt;
const int g5[1] = { -1 }, ip[5] = { 0 };
unsigned int eu;

void
cm (unsigned char t9)
{
  (void) t9;
  eu = (eu & (~0 - 1)) + ip[eu + 1 > 1];
}

void
qe (unsigned int nc)
{
  cm (nc);
  cm (nc);
  cm (nc);
  asm ("");
  cm (nc);
}

int
main (void)
{
  int xh, bc = mt == 2;

  mt = ak;

  for (xh = 0; xh < 1; ++xh)
    {
      qe (g5[xh]);
      asm (";");
      if (!!bc)
        __builtin_puts ("");
    }

  for (xh = 0; xh < 5; ++xh)
    {
      qe (ip[xh]);
      asm (";");
      if (!!bc)
        __builtin_printf ("%d\n", xh);

    }

  for (xh = 0; xh < 3; ++xh)
    {
      qe (ip[xh]);
      if (!!bc)
        mt += xh;
    }

  return 0;
}

% x86_64-unknown-linux-gnu-gcc-11.0.0 -O2 -fselective-scheduling2 --param
early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param
max-jump-thread-duplication-stmts=0 -o good cd8zuepp.c
% ./good
% echo $?
0

% x86_64-unknown-linux-gnu-gcc-11.0.0 -O2 -fselective-scheduling2
-funroll-loops --param early-inlining-insns=5 --param
loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0 -o
bad cd8zuepp.c
% ./bad 
zsh: segmentation fault (core dumped)  ./bad

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[amonakov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Alexander Monakov <amonakov at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amonakov at gcc dot gnu.org

--- Comment #1 from Alexander Monakov <amonakov at gcc dot gnu.org> ---
This is probably due to sel-sched, and very sensitive to compiler revision: I
tried checking with a 20200511 (one day difference) on Compiler Exporer, and
could not reproduce the miscompilation.

If you still have the compiler binary, you can help out by testing with
sel-sched debug counters: if you append -fdbg-cnt=sel_sched_insn_cnt:0 to the
"bad" command line, it should work again (as sel-sched will not move anything),
with -fdbg-cnt=sel_sched_insn_cnt:99999 it should fail. We use this for
isolating a problematic transformation (by bisecting on the counter value).

(other sel-sched debug counters are sel_sched_cnt and sel_sched_region_cnt, but
they are more coarse-grained, by pass and region, instead of insn,
respectively)

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org
   Last reconfirmed|                            |2020-05-14
             Status|UNCONFIRMED                 |WAITING

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
I can't reproduce that with the mentioned revision.
Where does it segfault?

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

--- Comment #3 from Arseny Solokha <asolokha at gmx dot com> ---
(In reply to Alexander Monakov from comment #1)
> If you still have the compiler binary, you can help out by testing with
> sel-sched debug counters: if you append -fdbg-cnt=sel_sched_insn_cnt:0 to
> the "bad" command line, it should work again (as sel-sched will not move
> anything), with -fdbg-cnt=sel_sched_insn_cnt:99999 it should fail. We use
> this for isolating a problematic transformation (by bisecting on the counter
> value).

It still works w/ counter value 79, starts failing at 80.

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

--- Comment #4 from Arseny Solokha <asolokha at gmx dot com> ---
(In reply to Martin Liška from comment #2)
> I can't reproduce that with the mentioned revision.
> Where does it segfault?

Program received signal SIGSEGV, Segmentation fault.
main () at iu1wkpbg.c:39
39            qe (ip[xh]);
(gdb) disassemble 
Dump of assembler code for function main:

<…>

   0x000055555555461f <+159>:   je     0x5555555545a0 <main+32>
   0x0000555555554625 <+165>:   xor    %ebp,%ebp
   0x0000555555554627 <+167>:   xor    %edi,%edi
   0x0000555555554629 <+169>:   callq  0x5555555547e0 <qe>
   0x000055555555462e <+174>:   cmp    $0x2,%ebx
   0x0000555555554631 <+177>:   lea    0x2a8(%rip),%rsi        # 0x5555555548e0
<ip>
   0x0000555555554638 <+184>:   mov    %ebp,%esi
   0x000055555555463a <+186>:   je     0x555555554650 <main+208>
   0x000055555555463c <+188>:   add    $0x1,%rbp
   0x0000555555554640 <+192>:   cmp    $0x5,%rbp
   0x0000555555554644 <+196>:   je     0x55555555466f <main+239>
=> 0x0000555555554646 <+198>:   mov    (%rsi,%rbp,4),%edi
   0x0000555555554649 <+201>:   jmp    0x555555554629 <main+169>

<…>

(gdb) info registers rsi
rsi            0x0                 0

In a good version I see this instead:

 636:   8b 3c a8                mov    (%rax,%rbp,4),%edi

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

--- Comment #5 from Arseny Solokha <asolokha at gmx dot com> ---
OK, it works if I add -fPIC to the list of compiler options.

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[amonakov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

--- Comment #6 from Alexander Monakov <amonakov at gcc dot gnu.org> ---
Oh, you're probably configuring your compiler with --enable-default-pie. Please
paste the entire gcc -v. I can reproduce the miscompile it if I pass -fpie
-pie.

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

--- Comment #7 from Arseny Solokha <asolokha at gmx dot com> ---
(In reply to Alexander Monakov from comment #6)
> Oh, you're probably configuring your compiler with --enable-default-pie.
> Please paste the entire gcc -v. I can reproduce the miscompile it if I pass
> -fpie -pie.

% gcc-11.0.0 -v
Using built-in specs.
COLLECT_GCC=gcc-11.0.0
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-unknown-linux-gnu/11.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200510/work/gcc-11-20200510/configure
--host=x86_64-unknown-linux-gnu --build=x86_64-unknown-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-unknown-linux-gnu/gcc-bin/11.0.0
--includedir=/usr/lib/gcc/x86_64-unknown-linux-gnu/11.0.0/include
--datadir=/usr/share/gcc-data/x86_64-unknown-linux-gnu/11.0.0
--mandir=/usr/share/gcc-data/x86_64-unknown-linux-gnu/11.0.0/man
--infodir=/usr/share/gcc-data/x86_64-unknown-linux-gnu/11.0.0/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-unknown-linux-gnu/11.0.0/include/g++-v11
--with-python-dir=/share/gcc-data/x86_64-unknown-linux-gnu/11.0.0/python
--enable-languages=c,c++ --enable-obsolete --enable-secureplt --disable-werror
--with-system-zlib --disable-nls --enable-checking=yes --disable-esp
--enable-libstdcxx-time --disable-libstdcxx-pch --enable-shared
--enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu
--disable-multilib --with-multilib-list=m64 --disable-altivec
--disable-fixed-point --enable-targets=all --enable-libgomp
--disable-libmudflap --disable-libssp --disable-libada --disable-systemtap
--disable-vtable-verify --disable-libvtv --without-zstd --disable-libquadmath
--enable-lto --with-isl --disable-isl-version-check --disable-libsanitizer
--enable-default-pie --enable-default-ssp
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.0 20200510 (experimental) (GCC)

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW

--- Comment #8 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r10-4944-g1e83bd7003e03160, which is change in inliner. Thus it is
a latent issue.

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.2

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.2                        |10.3

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.2 is released, adjusting target milestone.

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug rtl-optimization/95123] [10/11 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.3                        |10.4

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.3 is being released, retargeting bugs to GCC 10.4.

[Bug rtl-optimization/95123] [10/11/12 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0 -fPIE

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection
            Summary|[10/11/12 Regression] Wrong |[10/11/12 Regression] Wrong
                   |code w/ -O2                 |code w/ -O2
                   |-fselective-scheduling2     |-fselective-scheduling2
                   |-funroll-loops --param      |-funroll-loops --param
                   |early-inlining-insns=5      |early-inlining-insns=5
                   |--param                     |--param
                   |loop-invariant-max-bbs-in-l |loop-invariant-max-bbs-in-l
                   |oop=3 --param               |oop=3 --param
                   |max-jump-thread-duplication |max-jump-thread-duplication
                   |-stmts=0                    |-stmts=0 -fPIE

--- Comment #11 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Seems to be working on the trunk, would be interesting to see why it passes
there.

[Bug rtl-optimization/95123] [10/11/12 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0 -fPIE

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |

--- Comment #12 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #11)
> Seems to be working on the trunk, would be interesting to see why it passes
> there.

Fixed with r12-4240-g2b8453c401b699ed and it still crashes with
-fno-tree-vectorize on master.

[Bug rtl-optimization/95123] [10/11/12/13 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0 -fPIE

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug rtl-optimization/95123] [11/12/13/14 Regression] Wrong code w/ -O2 -fselective-scheduling2 -funroll-loops --param early-inlining-insns=5 --param loop-invariant-max-bbs-in-loop=3 --param max-jump-thread-duplication-stmts=0 -fPIE

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95123

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #14 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.