[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601
--- Comment #12 from CVS Commits ---
The master branch has been updated by Jakub Jelinek :
https://gcc.gnu.org/g:9251b457eb8df912f2e8203d0ee8ab300c041520
commit r12-7371-g9251b457eb8df912f2e8203d0ee8ab300c041520
Author: Jakub Jelinek
Date: Thu Feb 24 15:29:02 2022 +0100
sccvn: Fix visit_reference_op_call value numbering of vdefs [PR104601]
The following testcase is miscompiled, because -fipa-pure-const discovers
that bar is const, but when sccvn during fre3 sees
# .MEM_140 = VDEF <.MEM_96>
*__pred$__d_43 = _50 (_49);
where _50 value numbers to , it value numbers .MEM_140 to
vuse_ssa_val (gimple_vuse (stmt)). For const/pure calls that return
a SSA_NAME (or don't have lhs) that is fine, those calls don't store
anything, but if the lhs is present and not an SSA_NAME, value numbering
the vdef to anything but itself means that e.g. walk_non_aliased_vuses
won't consider the call, but the call acts as a store to its lhs.
When it is ignored, sccvn will return whatever has been stored to the
lhs earlier.
I've bootstrapped/regtested an earlier version of this patch, which did the
if (!lhs && gimple_call_lhs (stmt))
changed |= set_ssa_val_to (vdef, vdef);
part before else if (vnresult->result_vdef), and that regressed
+FAIL: gcc.dg/pr51879-16.c scan-tree-dump-times pre "foo (" 1
+FAIL: gcc.dg/pr51879-16.c scan-tree-dump-times pre "foo2 (" 1
so this updated patch uses result_vdef there as before and only otherwise
(which I think must be the const/pure case) decides based on whether the
lhs is non-SSA_NAME.
2022-02-24 Jakub Jelinek
PR tree-optimization/104601
* tree-ssa-sccvn.cc (visit_reference_op_call): For calls with
non-SSA_NAME lhs value number vdef to itself instead of e.g. the
vuse value number.
* g++.dg/torture/pr104601.C: New test.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601 Jakub Jelinek changed: What|Removed |Added Assignee|unassigned at gcc dot gnu.org |jakub at gcc dot gnu.org Status|NEW |ASSIGNED --- Comment #11 from Jakub Jelinek --- Created attachment 52500 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52500=edit gcc12-pr104601.patch Full untested patch.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601
--- Comment #10 from Jakub Jelinek ---
But:
--- gcc/tree-ssa-sccvn.cc.jj2022-02-11 00:19:22.432063254 +0100
+++ gcc/tree-ssa-sccvn.cc 2022-02-23 16:16:25.873557626 +0100
@@ -5218,7 +5218,11 @@ visit_reference_op_call (tree lhs, gcall
if (vnresult)
{
- if (vnresult->result_vdef && vdef)
+ /* If stmt has non-SSA_NAME lhs, don't value number the vdef,
+as the call still acts as a lhs store. */
+ if (!lhs && vdef && gimple_call_lhs (stmt))
+ changed |= set_ssa_val_to (vdef, vdef);
+ else if (vnresult->result_vdef && vdef)
changed |= set_ssa_val_to (vdef, vnresult->result_vdef);
else if (vdef)
/* If the call was discovered to be pure or const reflect
@@ -5248,7 +5252,10 @@ visit_reference_op_call (tree lhs, gcall
if (TREE_CODE (fn) == ADDR_EXPR
&& TREE_CODE (TREE_OPERAND (fn, 0)) == FUNCTION_DECL
&& (flags_from_decl_or_type (TREE_OPERAND (fn, 0))
- & (ECF_CONST | ECF_PURE)))
+ & (ECF_CONST | ECF_PURE))
+ /* If stmt has non-SSA_NAME lhs, don't value number the
+vdef, as the call still acts as a lhs store. */
+ && (lhs || gimple_call_lhs (stmt) == NULL_TREE))
vdef_val = vuse_ssa_val (gimple_vuse (stmt));
}
changed |= set_ssa_val_to (vdef, vdef_val);
works for the testcase.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601
--- Comment #9 from Jakub Jelinek ---
But
--- gcc/tree-ssa-sccvn.cc.jj2022-02-11 00:19:22.432063254 +0100
+++ gcc/tree-ssa-sccvn.cc 2022-02-23 16:07:36.697893998 +0100
@@ -5218,7 +5218,11 @@ visit_reference_op_call (tree lhs, gcall
if (vnresult)
{
- if (vnresult->result_vdef && vdef)
+ /* If stmt has non-SSA_NAME lhs, don't value number the vdef,
+as the call still acts as a lhs store. */
+ if (!lhs && gimple_call_lhs (stmt))
+ ;
+ else if (vnresult->result_vdef && vdef)
changed |= set_ssa_val_to (vdef, vnresult->result_vdef);
else if (vdef)
/* If the call was discovered to be pure or const reflect
@@ -5248,7 +5252,10 @@ visit_reference_op_call (tree lhs, gcall
if (TREE_CODE (fn) == ADDR_EXPR
&& TREE_CODE (TREE_OPERAND (fn, 0)) == FUNCTION_DECL
&& (flags_from_decl_or_type (TREE_OPERAND (fn, 0))
- & (ECF_CONST | ECF_PURE)))
+ & (ECF_CONST | ECF_PURE))
+ /* If stmt has non-SSA_NAME lhs, don't value number the
+vdef, as the call still acts as a lhs store. */
+ && (lhs || gimple_call_lhs (stmt) == NULL_TREE))
vdef_val = vuse_ssa_val (gimple_vuse (stmt));
}
changed |= set_ssa_val_to (vdef, vdef_val);
results in ICEs later on - the
gcc_assert (x != VN_TOP);
assert in vuse_ssa_val.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601
Jakub Jelinek changed:
What|Removed |Added
CC||rguenth at gcc dot gnu.org
--- Comment #8 from Jakub Jelinek ---
I believe the bug is in visit_reference_op_call:
5241 /* If we value numbered an indirect functions function to
5242 one not clobbering memory value number its VDEF to its
5243 VUSE. */
5244 tree fn = gimple_call_fn (stmt);
5245 if (fn && TREE_CODE (fn) == SSA_NAME)
5246{
5247 fn = SSA_VAL (fn);
5248 if (TREE_CODE (fn) == ADDR_EXPR
5249 && TREE_CODE (TREE_OPERAND (fn, 0)) == FUNCTION_DECL
5250 && (flags_from_decl_or_type (TREE_OPERAND (fn, 0))
5251 & (ECF_CONST | ECF_PURE)))
5252vdef_val = vuse_ssa_val (gimple_vuse (stmt));
5253}
5254 changed |= set_ssa_val_to (vdef, vdef_val);
stmt in this case is:
# .MEM_140 = VDEF <.MEM_96>
*__pred$__d_43 = _50 (_49);
and _50 value numbers to where f is a const function.
I think we can value number the vdef to vuse_ssa_val (gimple_vuse (stmt))
only if the lhs of the call is not present or is an SSA_NAME, when the call
(const or pure) acts as a store, we shouldn't do that.
A few lines before this there is also:
if (vnresult->result_vdef && vdef)
changed |= set_ssa_val_to (vdef, vnresult->result_vdef);
else if (vdef)
/* If the call was discovered to be pure or const reflect
that as far as possible. */
changed |= set_ssa_val_to (vdef, vuse_ssa_val (gimple_vuse (stmt)));
I wonder if that doesn't suffer from the same problem.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601 Richard Biener changed: What|Removed |Added Priority|P3 |P2
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601 --- Comment #7 from Jakub Jelinek --- And it ICEs again with -O2 -fno-ipa-pure-const if I add [[gnu::const]] or [[gnu::pure]] attribute to f. The function seems to be const in that it only returns the result and doesn't access any other memory, but the return value does not have a gimple reg type (but is returned in registers on x86_64): _Z1fi: movl$1, -8(%rsp) movb$1, -4(%rsp) movq-8(%rsp), %rax ret And we really should do something to make it movabsq $4294967297, %rax ret or so.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601 --- Comment #6 from Jakub Jelinek --- -O2 -fno-ipa-pure-const helps though and the patch affected both.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601
--- Comment #5 from Andrew Pinski ---
But adding noipa to f does though:
[[gnu::noipa]]
std::optional f() { return 1; }
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601 --- Comment #4 from Andrew Pinski --- (In reply to Jakub Jelinek from comment #2) > This changed with r11-3408-ge977dd5edbcc3a3b88c3bd7efa1026c845af7487 Hmm, even -fno-ipa-modref does not prevent the wrong code from showing up.
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601
--- Comment #3 from Jakub Jelinek ---
Testcase without the unneeded which aborts if miscompiled.
#include
#include
inline std::optional a(std::vector::iterator b,
std::vector::iterator c,
std::optional h(int)) {
std::optional d;
find_if(b, c, [&](auto e) {
d = h(e);
return d;
});
return d;
}
std::optional f(int) { return 1; }
int
main() {
std::vector g(100);
auto b = g.begin();
auto c = g.end();
auto e = a(b, c, f);
if (!e)
__builtin_abort();
}
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601 Jakub Jelinek changed: What|Removed |Added Last reconfirmed||2022-02-18 Status|UNCONFIRMED |NEW Ever confirmed|0 |1 CC||hubicka at gcc dot gnu.org, ||jakub at gcc dot gnu.org --- Comment #2 from Jakub Jelinek --- This changed with r11-3408-ge977dd5edbcc3a3b88c3bd7efa1026c845af7487
[Bug tree-optimization/104601] [11/12 Regression] Invalid branch elimination at -O2
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104601 Andrew Pinski changed: What|Removed |Added Summary|[11 Regression] Invalid |[11/12 Regression] Invalid |branch elimination at -O2 |branch elimination at -O2 Target Milestone|--- |11.3 --- Comment #1 from Andrew Pinski --- >From fre3 (with details): Value numbering stmt = *__pred$__d_53 = _58 (); Setting value number of .MEM_143 to .MEM_135 (changed) Value numbering stmt = SR.60_59 = MEM [(const struct optional &)__pred$__d_53 + 4]; Setting value number of SR.60_59 to 0 (changed) Value numbering stmt = _60 = VIEW_CONVERT_EXPR(SR.60_59); Match-and-simplified VIEW_CONVERT_EXPR(SR.60_59) to 0 RHS VIEW_CONVERT_EXPR(SR.60_59) simplified to 0 Hmm, Somehow *__pred$__d_53 is missed.
