Bug 110431 - Incorrect disambiguation of wide accesess from store-merging or SLP
Summary: Incorrect disambiguation of wide accesess from store-merging or SLP
Status: NEW
Alias: None
Product: gcc
Classification: Unclassified
Component: middle-end (show other bugs)
Version: 12.3.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
Keywords: wrong-code
Depends on:
Reported: 2023-06-27 09:45 UTC by Alexander Monakov
Modified: 2024-01-26 10:18 UTC (History)
3 users (show)

See Also:
Known to work:
Known to fail:
Last reconfirmed: 2023-06-27 00:00:00


Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Monakov 2023-06-27 09:45:52 UTC
Inspired by bug 110237 comment 19:

int b, a;

int main()
    int *pa = &a, *pb = &b;
    asm("" : "+r"(pa));
    asm("" : "+r"(pb));
    if (pa + 1 == pb) {
        a = 1, b = 2;
        long x;
        __builtin_memcpy(&x, pa, 4);
        __builtin_memcpy(4 + (char *)&x, pa+1, 4);
        return (x - 0x0000000200000001) * 131 >> 32;


On GIMPLE, both store-merging and SLP vectorization are capable of introducing merged long-sized access in place of individual int-sized memcpy's, which is then disambiguated against initial stores on the RTL level, leading to a miscompilation.
Comment 1 Richard Biener 2023-06-27 10:16:24 UTC
I guess the provenance people would say this violates some rules since
pa + 1 is used to access 'b'.  GCC itself is prone to introduce such
issues when propagating equivalences though.