Bug 106070 - [13 Regression] Wrong code with -O1 since r13-469-g9a53101caadae1b5
Summary: [13 Regression] Wrong code with -O1 since r13-469-g9a53101caadae1b5
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 13.0
: P3 normal
Target Milestone: 13.0
Assignee: Richard Biener
URL:
Keywords: wrong-code
: 106025 (view as bug list)
Depends on:
Blocks: yarpgen
  Show dependency treegraph
 
Reported: 2022-06-24 04:45 UTC by Vsevolod Livinskii
Modified: 2022-06-28 06:41 UTC (History)
6 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2022-06-24 00:00:00


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vsevolod Livinskii 2022-06-24 04:45:57 UTC
GCC produces incorrect code with -O1.
I was not able to merge the test into a single file.

Reproducer:
// func.cpp
extern unsigned var_2;
extern int var_4;
extern signed char var_10;
extern unsigned long long arr_252;
void test() {
  for (unsigned a = 0; a < (unsigned char)var_10; a += 2)
    arr_252 = var_2 != var_4 ? var_4 : (long)var_2;
}

//driver.cpp
#include <stdio.h>

unsigned int var_2 = 1;
int var_4 = -1;
signed char var_10 = (signed char)(-127 - 1);
unsigned long long int arr_252;

void test();

int main() {
    test();
    printf("%llx\n", arr_252);
    if (arr_252 != 0xffffffffffffffff)
        __builtin_abort();
}

Error:
>$ g++ -O0 func.cpp driver.cpp && ./a.out 
ffffffffffffffff
>$  g++ -O1 func.cpp driver.cpp && ./a.out 
ffffffff
Aborted (core dumped)

gcc version 13.0.0 20220623 (31ce821a790caec8a2849dd67a9847e78a33d14c)
Comment 1 Andrew Pinski 2022-06-24 04:49:22 UTC
Single file testcase:
#include <stdio.h>
unsigned int var_2 = 1;
int var_4 = -1;
signed char var_10 = (signed char)(-127 - 1);
unsigned long long int arr_252;
[[gnu::noipa]]
void test() {
  for (unsigned a = 0; a < (unsigned char)var_10; a += 2)
    arr_252 = var_2 != var_4 ? var_4 : (long)var_2;
}

void test();

int main() {
    test();
    printf("%llx\n", arr_252);
    if (arr_252 != 0xffffffffffffffff)
        __builtin_abort();
}

(The [[gnu::noipa]] makes things easier for single file testcases so no inlining or other IPA passes on the function).
Comment 2 Andrew Pinski 2022-06-24 05:04:06 UTC
Reduced testcase:
#include <stdio.h>
unsigned int var_2 = 1;
int var_4 = -1;
int var_10 = 4;
unsigned long arr_252;
[[gnu::noipa]]
void test() {
  for (int a = 0; a < var_10; a += 2)
    arr_252 = var_2 != (int)var_4 ? (unsigned long)var_4 : (unsigned long)var_2;
}

void test();

int main() {
    test();
    fprintf(stderr, "%lx\n", arr_252);
    if (arr_252 != 0xffffffffffffffff)
        __builtin_abort();
}

---- CUT ---
There is a missing sign extend from 32bit to 64bit.

Confirmed.
Comment 3 Martin Liška 2022-06-24 08:46:31 UTC
Started with r13-469-g9a53101caadae1b5.
Comment 4 Richard Biener 2022-06-24 10:32:01 UTC
Ah, smaller.  Nice.
Comment 5 Richard Biener 2022-06-24 11:08:45 UTC
+Applying pattern match.pd:4591, gimple-match.cc:59644
...
@@ -31,7 +41,7 @@
   var_4.3_3 = (unsigned int) var_4.2_2;
   iftmp.0_9 = (long unsigned int) var_2.1_1;
   iftmp.0_10 = (long unsigned int) var_4.2_2;
   _4 = var_2.1_1 != var_4.3_3;
-  iftmp.0_6 = _4 ? iftmp.0_10 : iftmp.0_9;
+  iftmp.0_6 = (long unsigned int) var_4.3_3;
 
   <bb 4> [local count: 955630225]:
   # a_16 = PHI <a_12(7), 0(3)>

so that's

 var_2 != (unsigned) var_4 ? -> (unsigned long) var_4 : (unsigned long) var_2

which we turn into (unsigned long) (unsigned) var_4.  I thought that's what
generic also does but I have to double-check operand_equal_for_comparison_p here.

Ah, it checks

  /* Discard a single widening conversion from ARG1 and see if the inner
     value is the same as ARG0.  */
  if (CONVERT_EXPR_P (arg1)
      && INTEGRAL_TYPE_P (TREE_TYPE (TREE_OPERAND (arg1, 0)))
      && TYPE_PRECISION (TREE_TYPE (TREE_OPERAND (arg1, 0)))
         < TYPE_PRECISION (TREE_TYPE (arg1))
      && operand_equal_p (arg0, TREE_OPERAND (arg1, 0), 0))

and the operand_equal_p matches against the non-NOP-stripped arg0.  So it's
either a same precision or widening of the comparison op.

Hmm, will have to think how to translate that into a sign check to make it
fit match.pd (I don't want to export and use operand_equal_for_comparison_p)
Comment 6 GCC Commits 2022-06-24 12:50:22 UTC
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:b36a1c964f99758de1f3b169628965d3c3af812b

commit r13-1243-gb36a1c964f99758de1f3b169628965d3c3af812b
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Jun 24 13:37:22 2022 +0200

    middle-end/106070 - bogus cond-expr folding
    
    The following fixes up r13-469-g9a53101caadae1b5 by properly
    implementing what operand_equal_for_comparison_p did.
    
    2022-06-24  Richard Biener  <rguenther@suse.de>
    
            PR middle-end/106070
            * match.pd (a != b ? a : b): Fix translation of
            operand_equal_for_comparison_p.
    
            * gcc.dg/torture/pr106070.c: New testcase.
Comment 7 Richard Biener 2022-06-24 12:50:33 UTC
Fixed.
Comment 8 Richard Biener 2022-06-24 12:52:40 UTC
*** Bug 106025 has been marked as a duplicate of this bug. ***
Comment 9 Richard Earnshaw 2022-06-27 09:46:56 UTC
The testcase incorrectly assumes that long is 64-bits.
Comment 10 Richard Earnshaw 2022-06-27 09:47:53 UTC
the testcase in the committed patch, that is.
Comment 11 GCC Commits 2022-06-27 13:36:22 UTC
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:00063459f683adcd92ada8325984e6b10e9f7a95

commit r13-1299-g00063459f683adcd92ada8325984e6b10e9f7a95
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Jun 27 15:35:25 2022 +0200

    testsuite: Fix up pr106070.c test [PR106070]
    
    The test FAILs on 32-bit targets, because when unsigned long
    is 32-bit, (unsigned long) -1 isn't 0xffffffffffffffff.
    The options to fix this would be either using -1UL, or switch
    to unsigned long long and using -1ULL, I chose the latter because
    the test then FAILs in r13-1242 even on 32-bit targets.
    And while at it, some deobfuscation and formatting tweaks.
    
    2022-06-27  Jakub Jelinek  <jakub@redhat.com>
    
            PR tree-optimization/106070
            * gcc.dg/torture/pr106070.c: Use unsigned long long instead of
            unsigned long and -1ULL instead of 0xffffffffffffffff, deobcuscate
            and improve formatting.
Comment 12 Richard Biener 2022-06-28 06:41:49 UTC
Jakub fixed it.