Bug 39417 - [4.3 Regression] Incorrect values computed with -ftree-copy-prop
Summary: [4.3 Regression] Incorrect values computed with -ftree-copy-prop
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 4.3.3
: P2 normal
Target Milestone: 4.4.0
Assignee: Not yet assigned to anyone
URL:
Keywords: wrong-code
Depends on:
Blocks:
 
Reported: 2009-03-09 23:17 UTC by Maks Verver
Modified: 2011-06-27 11:48 UTC (History)
4 users (show)

See Also:
Host: x86_64-pc-linux-gnu
Target: x86_64-pc-linux-gnu
Build: x86_64-pc-linux-gnu
Known to work: 3.4.6, 4.4.0
Known to fail: 4.0.4, 4.1.3, 4.2.4, 4.3.4
Last reconfirmed: 2009-03-10 11:15:32


Attachments
The test case that fails (358 bytes, text/plain)
2009-03-09 23:19 UTC, Maks Verver
Details
The working tree code (798 bytes, text/plain)
2009-03-09 23:21 UTC, Maks Verver
Details
The broken tree code (789 bytes, text/plain)
2009-03-09 23:21 UTC, Maks Verver
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Maks Verver 2009-03-09 23:17:52 UTC
Attached is a small program that computes some values and puts them in a std::vector. The values are stored in the `init' variable, but when optimizations are enabled, the data actually added to the vector is garbage.

I've done a little testing and the problem exists when compiling with -O and -O2, but when compiling with -O0 or -O -fno-tree-copy-prop the bug disappears. (This is also the case when compiling with -fmudflap.)

To reproduce the bug, take the attached test.cpp and do:
  $ g++ -O -o broken test.cpp
  $ ./broken
  broken: test.cpp:55: int main(): Assertion `res[0] == 5' failed.
  Aborted

For comparison, you can run:
  $ g++ -O -fno-tree-copy-prop -o working test.cpp
  $ ./working

And see that it works fine. Running the broken binary trough valgrind gives a "conditional jump or move depends on uninitialised value" message.

I'll attach (part of) the output of compiling with -fdump-tree-optimized. The code is similar in both versions, but I think the problem is here:

<bb 16>:
  init_lsm.129 = l / i - i / 2;
  if (init_lsm.129 >= 0)
    goto <bb 17>;
  else
    goto <bb 25>;

<bb 17>:
  init = init_lsm.129;
  init = init_lsm.130;

As you can see, the correct value in `init_lsm.129' is assigned to `init' only to be overwritten by the uninitialized data in `init_lsm.130'. The working version looks similar but seems to have the last two statements reversed, so that the correct value ends up in `init'.

I'm using gcc version 4.3.3 (Gentoo 4.3.3 p1.0, pie-10.1.5), but the problem was first seen on a system runing GCC 4.1.x (or lower); not my own system so I can't check exactly, but it probably doesn't matter. Since the bug seems to be in the C++ front-end, it occurs when producing 64-bit as well as 32-bit binaries.

Hopefully, you are able to figure out what goes wrong. If this is a genuine bug, it seems to affect a wide range of compiler versions. Let me know if you need any more information, and I'll be happy to help.
Comment 1 Maks Verver 2009-03-09 23:19:00 UTC
Created attachment 17431 [details]
The test case that fails
Comment 2 Maks Verver 2009-03-09 23:21:01 UTC
Created attachment 17432 [details]
The working tree code
Comment 3 Maks Verver 2009-03-09 23:21:26 UTC
Created attachment 17433 [details]
The broken tree code
Comment 4 Andrew Pinski 2009-03-09 23:22:10 UTC
This works on the trunk.
Comment 5 Richard Biener 2009-03-10 11:15:32 UTC
Confirmed.  Workaround with -fno-tree-loop-im.

Maybe just latent on the trunk.

We perform the following:

Executing store motion of init from loop 1
Executing store motion of init from loop 1
Moving statement
init_lsm.127 = init;
(cost 0) out of loop 1.

Moving statement
init_lsm.128 = init;
(cost 0) out of loop 1.

which of course can't work.  Likely the SM rewrite on the trunk fixed this.
Comment 6 Richard Biener 2009-08-04 12:29:57 UTC
GCC 4.3.4 is being released, adjusting target milestone.
Comment 7 Richard Biener 2010-04-20 14:18:51 UTC
Subject: Bug 39417

Author: rguenth
Date: Tue Apr 20 14:18:35 2010
New Revision: 158560

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=158560
Log:
2010-04-20  Richard Guenther  <rguenther@suse.de>

	PR tree-optimization/39417
	* g++.dg/torture/pr39417.C: New testcase.

Added:
    trunk/gcc/testsuite/g++.dg/torture/pr39417.C
Modified:
    trunk/gcc/testsuite/ChangeLog

Comment 8 Richard Biener 2010-05-22 18:13:25 UTC
GCC 4.3.5 is being released, adjusting target milestone.
Comment 9 Richard Biener 2011-06-27 11:48:56 UTC
Fixed in 4.4.0.