Bug 33381 - [4.2 regression] miscompilation casting signed long to void*
Summary: [4.2 regression] miscompilation casting signed long to void*
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: target (show other bugs)
Version: 4.2.2
: P1 normal
Target Milestone: 4.2.3
Assignee: Richard Biener
URL:
Keywords: wrong-code
Depends on: 33099
Blocks:
  Show dependency treegraph
 
Reported: 2007-09-10 23:47 UTC by Debian GCC Maintainers
Modified: 2007-10-10 09:24 UTC (History)
4 users (show)

See Also:
Host:
Target: x64_86-linux-gnu
Build:
Known to work: 4.1.3 4.3.0
Known to fail: 4.2.2
Last reconfirmed: 2007-09-21 13:36:53


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Debian GCC Maintainers 2007-09-10 23:47:34 UTC
[forwarded from http://bugs.debian.org/440545]

seen with 4.2 branch 20070902, works with 4,1 branch and trunk

  Matthias

Output from attached program, if compiled with optimization level -O2:
From 0 to 2:
 0 - In: -1, -1 (0xffffffffffffffff), Out: -1
 1 - In: 0, 0 (0xffffffffffffffff), Out: 0
 2 - In: 1, 1 (0xffffffffffffffff), Out: 1
From 1 to 3:
 1 - In: 0, 0 ((nil)), Out: 0
 2 - In: 1, 1 (0x1), Out: 1
 3 - In: 2, 2 (0x2), Out: 2

 Should be
From 0 to 2:
 0 - In: -1, -1 (0xffffffffffffffff), Out: -1
 1 - In: 0, 0 ((nil)), Out: 0
 2 - In: 1, 1 (0x1), Out: 1
From 1 to 3:
 1 - In: 0, 0 ((nil)), Out: 0
 2 - In: 1, 1 (0x1), Out: 1
 3 - In: 2, 2 (0x2), Out: 2


#include <assert.h>
#include <stdio.h>
#include <stdlib.h>

int main()
{
  int i = 0;

  printf("From 0 to 2:\n");
  for (i = 0; i < 3; i++) {
    int iin = i - 1;
    signed long lin = iin;
    void *pin = (void *) lin;
    signed long iout = (signed long) pin;
      
    printf(" %d - In: %d, %ld (%p), Out: %ld\n", i, iin, lin, pin, iout);
  }

  printf("From 1 to 3:\n");
  for (i = 1; i < 4; i++) {
    int iin = i - 1;
    signed long lin = iin;
    void *pin = (void *) lin;
    signed long iout = (signed long) pin;
      
    printf(" %d - In: %d, %ld (%p), Out: %ld\n", i, iin, lin, pin, iout);
  }

  return EXIT_SUCCESS;
}
Comment 1 Mark Mitchell 2007-09-11 03:32:04 UTC
Ian --

Is this a VRP issue?

Thanks,

-- Mark
Comment 2 Richard Biener 2007-09-11 11:31:46 UTC
A bug in VRP respective its friend SCEV.

  iin_5 = i_1 - 1;
  lin_6 = iin_5;
  pin_7 = (void *) iin_5;
  iout_8 = iin_5;
  printf (&" %d - In: %d, %ld (%p), Out: %ld\n"[0], i_1, iin_5, iin_5, pin_7, iin_5);
  i_9 = i_1 + 1;

  (scalar = pin_7)
  (scalar_evolution = {-1B, +, 1B}_1))
)
(instantiate_parameters
  (loop_nb = 1)
  (chrec = {-1B, +, 1B}_1)
  (res = {-1B, +, 1B}_1))
Found new range for pin_7: [-1B, -1B]

Value ranges after VRP:

i_1: VARYING
i_2: ~[0, 0]  EQUIVALENCES: { } (0 elements)
iin_5: [-1, 1]  EQUIVALENCES: { } (0 elements)
lin_6: [-1, 1]  EQUIVALENCES: { iin_5 } (1 elements)
pin_7: [-1B, -1B]  EQUIVALENCES: { } (0 elements)

<L0>:;
  iin_5 = i_27 - 1;
  lin_6 = iin_5;
  pin_7 = (void *) iin_5;
  iout_8 = iin_5;
  printf (&" %d - In: %d, %ld (%p), Out: %ld\n"[0], i_27, iin_5, iin_5, -1B, iin_5);
  i_9 = i_27 + 1;

Comment 3 Richard Biener 2007-09-11 11:33:55 UTC
I think this is related (but not exactly dup) of PR33099.
Comment 4 Richard Biener 2007-09-21 13:04:05 UTC
Shorter testcase:

void x(void *data);
void test()
{
  long i;
  for (i = 0; i < 5; i++) 
    if (i > 0)
      x((void *)(i - 1));
}
Comment 5 Richard Biener 2007-09-21 13:36:53 UTC
This was fixed by the introduction of pointer-plus, which removed all traces
of fold_used_pointer* in tree-scalar-evolution.c.

A safe patch would go along the following:

Index: tree-vrp.c
===================================================================
--- tree-vrp.c  (revision 128649)
+++ tree-vrp.c  (working copy)
@@ -2482,6 +2482,13 @@ adjust_range_with_scev (value_range_t *v
   if (vr->type == VR_ANTI_RANGE)
     return;
 
+  /* Don't try to feed SCEV with casts to pointer type.  */
+  if (TREE_CODE (stmt) == MODIFY_EXPR
+      && (TREE_CODE (TREE_OPERAND (stmt, 1)) == NOP_EXPR
+         || TREE_CODE (TREE_OPERAND (stmt, 1)) == CONVERT_EXPR)
+      && POINTER_TYPE_P (TREE_TYPE (TREE_OPERAND (stmt, 1))))
+    return;
+
   chrec = instantiate_parameters (loop, analyze_scalar_evolution (loop, var));
   if (TREE_CODE (chrec) != POLYNOMIAL_CHREC)
     return;
Comment 6 Debian GCC Maintainers 2007-09-25 07:15:55 UTC
comparing 4.2 20070902 with 4.2 20070925 + plus the proposed patch, I see two regressions:

FAIL: g++.dg/ext/vla4.C  (test for errors, line 10)
FAIL: g++.dg/other/unused1.C scan-assembler (string|ascii?)z?\\t"class2("|\\\\\\\\000)

Currently checking 20070925 without the proposed patch.

  Matthias
Comment 7 rguenther@suse.de 2007-09-25 08:25:44 UTC
Subject: Re:  [4.2 regression] miscompilation casting signed
 long to void*

On Tue, 25 Sep 2007, debian-gcc at lists dot debian dot org wrote:

> ------- Comment #6 from debian-gcc at lists dot debian dot org  2007-09-25 07:15 -------
> comparing 4.2 20070902 with 4.2 20070925 + plus the proposed patch, I see two
> regressions:
> 
> FAIL: g++.dg/ext/vla4.C  (test for errors, line 10)
> FAIL: g++.dg/other/unused1.C scan-assembler
> (string|ascii?)z?\\t"class2("|\\\\\\\\000)
> 
> Currently checking 20070925 without the proposed patch.

They also happened w/o the patch for me.

Richard.
Comment 8 Debian GCC Maintainers 2007-09-25 13:36:57 UTC
> > Currently checking 20070925 without the proposed patch.
> 
> They also happened w/o the patch for me.

same here, Matthias
Comment 9 Richard Biener 2007-10-10 09:24:58 UTC
Subject: Bug 33381

Author: rguenth
Date: Wed Oct 10 09:24:43 2007
New Revision: 129197

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=129197
Log:
2007-10-10  Richard Guenther  <rguenther@suse.de>

	PR tree-optimization/33099
	PR tree-optimization/33381
	* tree-vrp.c (adjust_range_with_scev): Do not adjust ranges
	from pointer typed chrecs.

	* gcc.c-torture/execute/pr33099.c: New testcase.
	* gcc.c-torture/execute/pr33381.c: Likewise.

Added:
    branches/gcc-4_2-branch/gcc/testsuite/gcc.c-torture/execute/pr33099.c
    branches/gcc-4_2-branch/gcc/testsuite/gcc.c-torture/execute/pr33381.c
Modified:
    branches/gcc-4_2-branch/gcc/ChangeLog
    branches/gcc-4_2-branch/gcc/testsuite/ChangeLog
    branches/gcc-4_2-branch/gcc/tree-vrp.c

Comment 10 Richard Biener 2007-10-10 09:24:59 UTC
Fixed.