[Bug target/81291] New: [5/6/7/8 Regression] wrong code with -O2 -fno-rerun-cse-after-loop -fno-tree-ter -fno-tree-vrp -funroll-loops due to improper carry

["zsojka at seznam dot cz" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81291

            Bug ID: 81291
           Summary: [5/6/7/8 Regression] wrong code with -O2
                    -fno-rerun-cse-after-loop -fno-tree-ter -fno-tree-vrp
                    -funroll-loops due to improper carry
           Product: gcc
           Version: 8.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: powerpc-unknown-linux-gnu
             Build: x86_64-pc-linux-gnu

Created attachment 41667
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=41667&action=edit
reduced testcase

Output:
$ powerpc-unknown-linux-gnu-gcc -O2 -fno-rerun-cse-after-loop -fno-tree-ter
-fno-tree-vrp -funroll-loops testcase.c
$ qemu-ppc ./a.out 
qemu: uncaught target signal 6 (Aborted) - core dumped
Aborted

The wrong value of "x" is 0x0000000100000000. It seems to be created as:
$ cat testcase.c
...
        li 11,1  # _20,
 # testcase.c:11:   a %= ~(u64)0;
        sth 8,a@l(7)     # aD.2487, a.0_1
 # testcase.c:10:   b = (u64)-a > a;
        sth 10,b@l(6)    # bD.2488, _7
 # testcase.c:13: }
        adde 3,3,11      #, c.4_12, _20
        blr
...
eg. r11 is unconditionally set to 1, which seems to be wrong.

It is visible at least after combine; before combine, there is:
$ cat testcase.c.260r.ud_dce
...
(insn 45 88 47 6 (parallel [
            (set (reg:SI 179 [+4 ])
                (minus:SI (const_int 0 [0])
                    (reg:SI 167 [ _8+4 ])))
            (set (reg:SI 76 ca)
                (leu:SI (reg:SI 167 [ _8+4 ])
                    (const_int 0 [0])))
        ]) "testcase.c":11 104 {subfsi3_carry}
     (expr_list:REG_UNUSED (reg:SI 76 ca)
        (nil)))
...
(insn 66 63 67 6 (parallel [
            (set (reg:SI 175 [ _20+4 ])
                (plus:SI (reg:SI 130 [ d.5_10+-2 ])
                    (reg:SI 133 [ e.7_14+-2 ])))
            (set (reg:SI 76 ca)
                (ltu:SI (plus:SI (reg:SI 130 [ d.5_10+-2 ])
                        (reg:SI 133 [ e.7_14+-2 ]))
                    (reg:SI 130 [ d.5_10+-2 ])))
        ]) 78 {addsi3_carry}
     (expr_list:REG_DEAD (reg:SI 133 [ e.7_14+-2 ])
        (expr_list:REG_DEAD (reg:SI 130 [ d.5_10+-2 ])
            (nil))))
(insn 67 66 68 6 (parallel [
            (set (reg:SI 174 [ _20 ])
                (plus:SI (plus:SI (reg:SI 179 [+4 ])
                        (reg:SI 179 [+4 ]))
                    (reg:SI 76 ca)))
            (clobber (reg:SI 76 ca))
        ]) 83 {*addsi3_carry_in_internal}
     (expr_list:REG_DEAD (reg:SI 179 [+4 ])
        (expr_list:REG_DEAD (reg:SI 76 ca)
            (expr_list:REG_UNUSED (reg:SI 76 ca)
                (nil)))))
...

And after combine:
$ cat testcase.c.261r.combine
...
Trying 45 -> 67:
Failed to match this instruction:
(parallel [
        (set (reg:SI 174 [ _20 ])
            (const_int 1 [0x1]))
        (clobber (reg:SI 76 ca))
    ])
Successfully matched this instruction:
(set (reg:SI 174 [ _20 ])
    (const_int 1 [0x1]))
allowing combination of insns 45 and 67
original costs 0 + 8 = 0
replacement cost 4
deferring deletion of insn with uid = 45.
deferring deletion of insn with uid = 45.
modifying insn i3    67: r174:SI=0x1
deferring rescan insn with uid = 67.
...
(note 45 88 47 6 NOTE_INSN_DELETED)
...
(insn 66 63 67 6 (parallel [
            (set (reg:SI 175 [ _20+4 ])
                (plus:SI (reg:SI 130 [ d.5_10+-2 ])
                    (reg:SI 133 [ e.7_14+-2 ])))
            (set (reg:SI 76 ca)
                (ltu:SI (plus:SI (reg:SI 130 [ d.5_10+-2 ])
                        (reg:SI 133 [ e.7_14+-2 ]))
                    (reg:SI 130 [ d.5_10+-2 ])))
        ]) 78 {addsi3_carry}
     (expr_list:REG_DEAD (reg:SI 133 [ e.7_14+-2 ])
        (expr_list:REG_DEAD (reg:SI 130 [ d.5_10+-2 ])
            (nil))))
(insn 67 66 68 6 (set (reg:SI 174 [ _20 ])
        (const_int 1 [0x1])) 479 {*movsi_internal1}
     (nil))
...

I don't see how 45 and 67 can be combined when 67 is using reg 76 which is set
by insn 66, but I also do not really understand why insn 67 was present in the
first place (it does r179+r179+ca; why? which is (0-r167)+(0-r167)+ca, which is
0-0+0-0+ca, which is "ca" from insn 66, but value of "ca" from insn 45 (=(0==0)
-> =1) is taken?)