[Bug tree-optimization/99751] New: wrong code at -O1

[Bug tree-optimization/99751] New: wrong code at -O1

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

            Bug ID: 99751
           Summary: wrong code at -O1
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

[549] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/11.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.1 20210324 (experimental) [master revision
be70bb5e4ba:220fd7ed5f2:bf1f3168f474734400e7a97660d1e7dec664bca9] (GCC) 
[550] % 
[550] % gcctk -O0 small.c; ./a.out
[551] % 
[551] % gcctk -O1 small.c
[552] % ./a.out
Aborted
[553] % 
[553] % cat small.c
int *a, **c = &a;
int *b(int *d) { return d; }
void e(int *d) { *c = b(d); }
int main() {
  int f = (e(&f), 0);
  if (a != &f)
    __builtin_abort();
  return 0;
}

[Bug tree-optimization/99751] [11 Regression] wrong code at -O1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-03-24
   Target Milestone|---                         |11.0
     Ever confirmed|0                           |1
      Known to work|                            |10.2.1
           Keywords|                            |wrong-code
            Summary|wrong code at -O1           |[11 Regression] wrong code
                   |                            |at -O1
            Version|unknown                     |11.0

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/99751] [11 Regression] wrong code at -O1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
-fno-ipa-modref fixes it

[Bug ipa/99751] [11 Regression] wrong code at -O1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |ipa
           Priority|P3                          |P1
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
And -fno-inline-small-functions makes it appear at -O2 as well.

[Bug ipa/99751] [11 Regression] wrong code at -O1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r11-5391-gbb07490abba850fd5b1d2d09d76d18b8bdc7d817

[Bug ipa/99751] [11 Regression] wrong code at -O1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
  parm 0 flags: nodirectescape
void e (int * d)
{
  int * * c.0_1;
  int * _2;

  <bb 2> :
  c.0_1 = c;
  _2 = b (d_4(D));
  *c.0_1 = _2;
  return;

is wrong, it does escape through the *c store.  I suppose b (d) is "wrong"
somehow, the escape through the return is not mentioned:

  parm 0 flags: direct noclobber noescape nodirectescape
int * b (int * d)
{
  <bb 2> :
  return d_1(D);

[Bug ipa/99751] [11 Regression] wrong code at -O1

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
Maybe a nicer names:

$ cat pr99751.c
int *ptr1 = 0, **ptr2 = &ptr1;

int *identity(int *p)
{
  return p;
}

void store_to_c(int *p)
{
  *ptr2 = identity(p);
}

int main()
{
  int f;
  store_to_c(&f);
  if (ptr1 != &f)
    __builtin_abort();
  return 0;
}

[Bug ipa/99751] [11 Regression] wrong code at -O1

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |hubicka at gcc dot gnu.org

--- Comment #7 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
mine.

[Bug ipa/99751] [11 Regression] wrong code at -O1

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

--- Comment #8 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
So we wrongly identify nodirectescape in store_to_c this is due to early exit
in analyze_call that does not account for const call possibly returning its
parameter. (An early confusion in EAF tracking logic before I settled up on the
fact that returns are not escapes for local PTA).  I am looking into fix. It is
odd that this did not show earlier.

[Bug ipa/99751] [11 Regression] wrong code at -O1

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
OK, so actually there is logic to handle return values (even for consts) but it
has wrong if.  I am testing the attached fix.

diff --git a/gcc/ipa-modref.c b/gcc/ipa-modref.c
index 7aaf53be8f4..5f33bb5b410 100644
--- a/gcc/ipa-modref.c
+++ b/gcc/ipa-modref.c
@@ -1545,9 +1545,9 @@ merge_call_lhs_flags (gcall *call, int arg, int index,
bool deref,
       tree lhs = gimple_call_lhs (call);
       analyze_ssa_name_flags (lhs, lattice, depth + 1, ipa);
       if (deref)
-       lattice[index].merge (lattice[SSA_NAME_VERSION (lhs)]);
-      else
        lattice[index].merge_deref (lattice[SSA_NAME_VERSION (lhs)], false);
+      else
+       lattice[index].merge (lattice[SSA_NAME_VERSION (lhs)]);
     }
   /* In the case of memory store we can do nothing.  */
   else
@@ -1621,7 +1621,7 @@ analyze_ssa_name_flags (tree name, vec<modref_lattice>
&lattice, int depth,
       else if (gcall *call = dyn_cast <gcall *> (use_stmt))
        {
          tree callee = gimple_call_fndecl (call);
-         /* Return slot optiomization would require bit of propagation;
+         /* Return slot optimization would require bit of propagation;
             give up for now.  */
          if (gimple_call_return_slot_opt_p (call)
              && gimple_call_lhs (call) != NULL_TREE

[Bug ipa/99751] [11 Regression] wrong code at -O1

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #10 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Forgot PR marker in changelog, but it is fixed by
g:dd64aaafe6916ac11ccae3182b4550c8b8f5e066

[Bug ipa/99751] [11 Regression] wrong code at -O1

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jan Hubicka <hubicka@gcc.gnu.org>:

https://gcc.gnu.org/g:7b6ca93b2d57ead352cd5cc3e10be4c33dda674b

commit r11-7895-g7b6ca93b2d57ead352cd5cc3e10be4c33dda674b
Author: Jan Hubicka <jh@suse.cz>
Date:   Mon Mar 29 20:59:42 2021 +0200

    Fix pr99751.c testcase

            PR ipa/99751
            * gcc.c-torture/compile/pr99751.c: Rename from ...
            * gcc.c-torture/execute/pr99751.c: ... to this.