https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62004
Bug ID: 62004
Summary: dead type-unsafe load replaces type-safe load
Product: gcc
Version: 4.8.4
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: rtl-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: vries at gcc dot gnu.org
Created attachment 33230
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33230&action=edit
test-case
I've tried to write a program in which there is a type-unsafe load, which is
never executed, to see if tail-merge would fail. In other words, I've tried to
come up with a 'load' variant of PR61964.
With attached test-case load-4.c and current 4.8 branch, I get the following
results:
...
$ gcc -O2 load-4.c; ./a.out ; echo $?
1
...
Adding -fno-strict-aliasing allows the test to pass:
...
$ gcc -O2 load-4.c -fno-strict-aliasing ; ./a.out ; echo $?
0
...
However AFAICT, the test-case is correct, in the sense that the only
type-unsafe code is dead, so -fno-strict-aliasing should not be necessary to
allow the test to pass.
My intention was to trigger a a problem in tail-merge. However, skipping
tail-merge still doesn't make the test pass:
...
$ gcc -O2 load-4.c -fstrict-aliasing -fno-tree-tail-merge; ./a.out ; echo $?
1
...
At rtl level, the same type of optimization as tail-merge is done. We start out
with the if-then-else-join before expand:
...
if (_13 == h_10)
goto <bb 3>;
else
goto <bb 4>;
<bb 3>:
p_14 = MEM[(struct head *)_13].first;
goto <bb 5>;
<bb 4>:
p_15 = _13->next;
<bb 5>:
...
And this is expanded into rtl:
...
(jump_insn 23 22 24 2 (set (pc)
(if_then_else (ne (reg:CCZ 17 flags)
(const_int 0 [0]))
(label_ref 28)
(pc))) load-4.c:44 -1
(expr_list:REG_BR_PROB (const_int 8986 [0x231a])
(nil))
-> 28)
(note 24 23 25 4 [bb 4] NOTE_INSN_BASIC_BLOCK)
(insn 25 24 26 4 (set (reg/v/f:DI 59 [ p ])
(mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 MEM[(struct head *)_13].first+0
S8 A64])) load-4.c:46 -1
(nil))
(jump_insn 26 25 27 4 (set (pc)
(label_ref 31)) -1
(nil)
-> 31)
(barrier 27 26 28)
(code_label 28 27 29 5 2 "" [1 uses])
(note 29 28 30 5 [bb 5] NOTE_INSN_BASIC_BLOCK)
(insn 30 29 31 5 (set (reg/v/f:DI 59 [ p ])
(mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 _13->next+0 S8 A64])) load-4.c:49
-1
(nil))
(code_label 31 30 32 6 3 "" [1 uses])
...
Already at into_cfglayout, the jump 26 is removed, causing the 'dead' bb4 to
become alive:
...
try_optimize_cfg iteration 1
Removing jump 26.
<SNIP>
(jump_insn 23 22 24 2 (set (pc)
(if_then_else (ne (reg:CCZ 17 flags)
(const_int 0 [0]))
(label_ref 28)
(pc))) load-4.c:44 612 {*jcc_1}
(expr_list:REG_BR_PROB (const_int 8986 [0x231a])
(nil))
-> 28)
(note 24 23 25 3 [bb 3] NOTE_INSN_BASIC_BLOCK)
(insn 25 24 28 3 (set (reg/v/f:DI 59 [ p ])
(mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 MEM[(struct head *)_13].first+0
S8 A64])) load-4.c:46 87 {*movdi_internal_rex64}
(nil))
(code_label 28 25 29 4 2 "" [1 uses])
(note 29 28 30 4 [bb 4] NOTE_INSN_BASIC_BLOCK)
(insn 30 29 31 4 (set (reg/v/f:DI 59 [ p ])
(mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 _13->next+0 S8 A64])) load-4.c:49
87 {*movdi_internal_rex64}
(nil))
...
And after ce1, we're just left with the code from bb4:
...
IF-THEN-ELSE-JOIN block found, pass 1, test 2, then 3, else 4, join 5
changing bb of uid 30
from 4 to 2
deleting insn with uid = 29.
deleting insn with uid = 28.
deleting block 4
Removing jump 23.
<SNIP>
(insn 30 22 33 2 (set (reg/v/f:DI 59 [ p ])
(mem/f:DI (reg/f:DI 66 [ D.1751 ]) [4 _13->next+0 S8 A64])) load-4.c:49
87 {*movdi_internal_rex64}
(expr_list:REG_DEAD (reg/f:DI 66 [ D.1751 ])
(nil)))
...
Using -fno-if-conversion allows the test to pass:
...
$ gcc -O2 load-4.c -fstrict-aliasing -fno-tree-tail-merge -fno-if-conversion;
./a.out ; echo $?
0
...
And indeed, the problem also triggers for tail-merge:
...
$ gcc.sh -O2 load-4.c -fstrict-aliasing -ftree-tail-merge -fno-if-conversion;
./a.out ; echo $?
1
...
