[Bug tree-optimization/95396] New: GCC produces incorrect code with -O3 for loops

[Bug tree-optimization/95396] New: GCC produces incorrect code with -O3 for loops

[vsevolod.livinskij at frtk dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

            Bug ID: 95396
           Summary: GCC produces incorrect code with -O3 for loops
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: vsevolod.livinskij at frtk dot ru
  Target Milestone: ---

Error:
>$ g++ -O0 small.cpp && ./a.out 
42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 0 0 0 
>$ g++ -O3 small.cpp && ./a.out 
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 42 0 0 0 

Reproducer:
>$ cat small.cpp 
#include <stdio.h>

unsigned short arr_26 [20];
signed char arr_25 [2000];

unsigned char b;

int c(int d, int f) { return d > f ? d : f; }

void test() { 
    for (char e = c(b, 241) + 15; e < 17; e += 1)
        arr_26[e] = 42;
}

int main() {
    test();
    for (size_t i_0 = 0; i_0 < 20; ++i_0)
        printf("%d ", arr_26 [i_0]);
    printf("\n");
}

GCC version:
11.0.0 (1852a26b925970f64f8d31518ba732fe9c3ade23)

[Bug tree-optimization/95396] GCC produces incorrect code with -O3 for loops

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
             Target|                            |x86_64-*-*
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-05-29
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
> ./xgcc -B. t.C -O2 -fopt-info -ftree-vectorize
t.C:11:20: optimized:  Inlining int c(int, int)/15 into void test()/16.
t.C:11:37: optimized: loop vectorized using 16 byte vectors
t.C:10:6: optimized: loop with 1 iterations completely unrolled (header
execution count 70866959)

caused/triggered by vectorization.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|GCC produces incorrect code |[8/9/10/11 Regression] GCC
                   |with -O3 for loops          |produces incorrect code
                   |                            |with -O3 for loops since
                   |                            |r8-6511-g3ae129323d150621
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rsandifo at gcc dot gnu.org
      Known to work|                            |7.4.0

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r8-6511-g3ae129323d150621.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[babokin at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #3 from Dmitry Babokin <babokin at gmail dot com> ---
Could anyone please have a look at this bug? Fixing it would help us not to
file duplicate bugs discovered in random testing.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
   Target Milestone|---                         |8.5

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[babokin at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #4 from Dmitry Babokin <babokin at gmail dot com> ---
Richard Sandiford, could you please have a look as author of the commit, which
brought the regression?

We have a bunch of other fails, which might be or might be not the same as this
one. We'd like to avoid spamming developers with duplicates, so waiting for
this bug to be fixed.

Also, if there's a way how we can help investigating this bug, we would
appreciate your guidance.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Creating dr for arr_26[_5]
analyze_innermost: success.
        base_address: &arr_26
        offset from base address: (ssizetype) ((sizetype) (char) _3 * 2)
        constant offset from base address: -482
        step: 2
        base alignment: 32
        base misalignment: 0
        offset alignment: 2
        step alignment: 2
        base_object: arr_26
        Access function 0: {(int) e_12, +, 1}_1

the constant offset is odd and indeed we end up storing outside of the
array:

10              arr_26[e] = 42;
(gdb) p/x $rax + 0x601860
$2 = 0x601660
(gdb) p &arr_26
$3 = (unsigned short (*)[20]) 0x601860 <arr_26>

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
One odd thing is that for unsigned char _3 we get via

                wide_int var_min, var_max;
                value_range_kind vr_type = get_range_info (tmp_var, &var_min,
                                                           &var_max);

[241, 255]

the add of 15 then overflows for both min and max and thus we happily accept
the result but compute the difference signed (in widest_int):

                /* Calculate (ssizetype) OP0 - (ssizetype) TMP_VAR.  */
                widest_int diff = (widest_int::from (op0_min, sgn)
                                   - widest_int::from (var_min, sgn));
                var0 = tmp_var;
                *off = wide_int_to_tree (ssizetype, diff);

which then results in 0-241 == -241.

To me it looks like we should instead do

                /* Calculate (ssizetype) (OP0 - TMP_VAR).  */
                widest_int diff = widest_int::from (op0_min - var_min, sgn);

which fixes this particular testcase.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #6)
> One odd thing is that for unsigned char _3 we get via
> 
>                 wide_int var_min, var_max;
>                 value_range_kind vr_type = get_range_info (tmp_var, &var_min,
>                                                            &var_max);
> 
> [241, 255]
> 
> the add of 15 then overflows for both min and max and thus we happily accept
> the result but compute the difference signed (in widest_int):
> 
>                 /* Calculate (ssizetype) OP0 - (ssizetype) TMP_VAR.  */
>                 widest_int diff = (widest_int::from (op0_min, sgn)
>                                    - widest_int::from (var_min, sgn));
>                 var0 = tmp_var;
>                 *off = wide_int_to_tree (ssizetype, diff);
> 
> which then results in 0-241 == -241.
> 
> To me it looks like we should instead do
> 
>                 /* Calculate (ssizetype) (OP0 - TMP_VAR).  */
>                 widest_int diff = widest_int::from (op0_min - var_min, sgn);
> 
> which fixes this particular testcase.

Or alternatively

                widest_int diff = wi::ext (widest_int::from (op0_min, sgn)
                                           - widest_int::from (var_min, sgn),
                                           TYPE_PRECISION (type),
                                           TYPE_SIGN (type));

which maybe more highlights the underlying issue (failing zero-extension
for the sign-changing conversion)?

I don't expect any fallout of either patch possibly due to bad test
coverage so extra thoughts welcome.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #8 from Martin Liška <marxin at gcc dot gnu.org> ---
May I please remind this issue?

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
should link all the split_constant_offset issues together ...

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #10 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Looks like this might have gone latent on trunk.  First thought
was that it might be g:7b4ea2827d2003c8ffc76cd478f8974360cbd78f,
but it seems not.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

--- Comment #11 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to rsandifo@gcc.gnu.org from comment #10)
> Looks like this might have gone latent on trunk.  First thought
> was that it might be g:7b4ea2827d2003c8ffc76cd478f8974360cbd78f,
> but it seems not.

You should still be able to see the problem with --param=evrp-mode=legacy on
the master. It's latent without the param since r11-3685-gfcae5121154d1c33.

[Bug tree-optimization/95396] [8/9/10/11 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rsandifo at gcc dot gnu.org

--- Comment #12 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #11)
> You should still be able to see the problem with --param=evrp-mode=legacy on
> the master. It's latent without the param since r11-3685-gfcae5121154d1c33.
Ah, indeed, thanks.  And with that, the proposed fix for PR98069 fixes
this PR too.

[Bug tree-optimization/95396] [8/9/10 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[8/9/10/11 Regression] GCC  |[8/9/10 Regression] GCC
                   |produces incorrect code     |produces incorrect code
                   |with -O3 for loops since    |with -O3 for loops since
                   |r8-6511-g3ae129323d150621   |r8-6511-g3ae129323d150621

--- Comment #13 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Fixed on trunk by r11-5904.

[Bug tree-optimization/95396] [8/9/10 Regression] GCC produces incorrect code with -O3 for loops since r8-6511-g3ae129323d150621

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95396

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #14 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Tracking backports in PR98069

*** This bug has been marked as a duplicate of bug 98069 ***