[Bug tree-optimization/98906] New: [8/9/10/11 Regression] Miscompiles code even at -O1

[Bug tree-optimization/98906] New: [8/9/10/11 Regression] Miscompiles code even at -O1

[amonakov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98906

            Bug ID: 98906
           Summary: [8/9/10/11 Regression] Miscompiles code even at -O1
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: amonakov at gcc dot gnu.org
  Target Milestone: ---

Created attachment 50097
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50097&action=edit
testcase

The attached testcase is clean w.r.t ASan and UBSan. At -O1+, 'main' is
miscompiled to a single basic block reporting an error on initial loop
iteration, since gcc-6, while -Og and '-O1 -fno-inline' yield expected code.

.optimized dump is wrong, so one of GIMPLE passes is the culprit, but a bit
hard to see which one exactly.

[Bug tree-optimization/98906] [8/9/10/11 Regression] Miscompiles code even at -O1

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98906

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
So ccp3 is doing it.

Visiting statement:
quo_lo_52 = floorf (_51);
which is likely CONSTANT
Match-and-simplified floorf (_51) to -8.6e+1
Lattice value changed to CONSTANT -8.6e+1.  Adding SSA edges to worklist.

Visiting statement:
_55 = (unsigned int) quo_lo_52;
which is likely CONSTANT
Match-and-simplified (unsigned int) quo_lo_52 to 0
Lattice value changed to CONSTANT 0.  Adding SSA edges to worklist.


I think this code is undefined/unspecified as -86 is outside the range of an
unsigned int.

[Bug tree-optimization/98906] [8/9/10/11 Regression] Miscompiles code even at -O1

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98906

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #1)
> I think this code is undefined/unspecified as -86 is outside the range of an
> unsigned int.

Even with changing to cast to int first still gives the same.  Note the cast to
int is needed first to get correct results.

[Bug tree-optimization/98906] [8/9/10/11 Regression] Miscompiles code even at -O1

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98906

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
        unsigned quo = (uint32_t)(int64_t)(quo_hi) +
(uint32_t)(int64_t)(quo_lo);

Fixes the issue ......

[Bug tree-optimization/98906] [8/9/10/11 Regression] Miscompiles code even at -O1

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98906

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Yes the code is undefined/unspecified.
quo_lo in one case does not fit into the range of unsigned int while quo_high
does not fit into the range of int.  So you need to first cast to int64_t (long
or long long) and then cast to uint32_t for this code to be well defined.

[Bug tree-optimization/98906] [8/9/10/11 Regression] Miscompiles code even at -O1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98906

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Note, it started with r140562, and indeed, I agree the bug is that quo_lo has
the value of -86, which is outside of range of uint32_t, therefore
"If the value of the integral part cannot be represented by the integer type,
the behavior is undefined."
applies.

[Bug tree-optimization/98906] [8/9/10/11 Regression] Miscompiles code even at -O1

[amonakov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98906

--- Comment #6 from Alexander Monakov <amonakov at gcc dot gnu.org> ---
Ah, -fsanitize=float-cast-overflow catches it, but it needs to be enabled
explicitly (not implied by -fsanitize=undefined). Thank you!