PR tree-optimization/109238 - Ranger cache dominator queries should ignore backedges.
Commit Message
Detailed info in the PR.
As we walk the DOM tree to calculate ranges, any block with multiple
predecessors is processed by evaluating and unioning incoming values.
This catches more complex cases where the dominator node itself may not
carry range adjustments that we care about.
What was missing was the "quick check" doesn't propagate any info. If
the edge we check is dominated by this block (ie, its a back edge), then
no additional useful information can be provided as it just leads back
to where we currently are. Only edges which are not dominated by the
current block need be checked.
The issue arose because this "quick check" mechanism gives up on complex
cases and returns VARYING... so any backedge would union the real value
from the dominators with the failed result "VARYING" from that edge, and
we get VARYING instead of the correct result.
The patch simply checks if the current block dominates the predecessor
of an edge before launching the query.
Performance impact in negligible. slight slowdown for the check, slight
speedup by doing less work.. its a wash.
Bootstraps on x86_64-pc-linux-gnu with no regressions.
Ok for trunk?
Andrew
PS I have not managed to produce a reduced testcase yet.. If I do I will
supply it.
Comments
On Thu, Mar 23, 2023 at 02:37:01PM -0400, Andrew MacLeod via Gcc-patches wrote:
> PS I have not managed to produce a reduced testcase yet.. If I do I will
> supply it.
Here is one:
/* PR tree-optimization/10923 */
/* { dg-do compile } */
/* { dg-options "-O2 -Wall" } */
void foo (void *) __attribute__((noreturn));
void bar (void *);
void
baz (void *p)
{
void *c = __builtin_realloc (p, 16);
if (c)
foo (c);
for (;;)
bar (__builtin_realloc (p, 8)); /* { dg-bogus "pointer 'p' may be used after '__builtin_realloc'" } */
}
Better than what I've attached in the PR, because this one actually
doesn't contain a leak. If first realloc fails, foo can still free it and
exit, if first realloc fails, bar will be called with result of second
realloc and can exit there too. Oh, it would need global variable from
caller to pas p to it in case even the second realloc fails.
Jakub
On Thu, Mar 23, 2023 at 7:37 PM Andrew MacLeod via Gcc-patches
<gcc-patches@gcc.gnu.org> wrote:
>
> Detailed info in the PR.
>
> As we walk the DOM tree to calculate ranges, any block with multiple
> predecessors is processed by evaluating and unioning incoming values.
> This catches more complex cases where the dominator node itself may not
> carry range adjustments that we care about.
>
> What was missing was the "quick check" doesn't propagate any info. If
> the edge we check is dominated by this block (ie, its a back edge), then
> no additional useful information can be provided as it just leads back
> to where we currently are. Only edges which are not dominated by the
> current block need be checked.
>
> The issue arose because this "quick check" mechanism gives up on complex
> cases and returns VARYING... so any backedge would union the real value
> from the dominators with the failed result "VARYING" from that edge, and
> we get VARYING instead of the correct result.
>
> The patch simply checks if the current block dominates the predecessor
> of an edge before launching the query.
>
> Performance impact in negligible. slight slowdown for the check, slight
> speedup by doing less work.. its a wash.
>
> Bootstraps on x86_64-pc-linux-gnu with no regressions.
>
> Ok for trunk?
LGTM with the testcase Jakub provided.
Richard.
> Andrew
>
> PS I have not managed to produce a reduced testcase yet.. If I do I will
> supply it.
>
>
>
commit d54ae54c13276adbfc5b27227a3630ad40002705
Author: Andrew MacLeod <amacleod@redhat.com>
Date: Thu Mar 23 10:28:34 2023 -0400
Ranger cache dominator queries should ignore backedges.
When querying dominators for cache values, ignore back edges in
read-only mode.
PR tree-optimization/109238
* gimple-range-cache.cc (ranger_cache::resolve_dom): Ignore
predecessors which this block dominates.
@@ -1510,6 +1510,11 @@ ranger_cache::resolve_dom (vrange &r, tree name, basic_block bb)
Value_Range er (TREE_TYPE (name));
FOR_EACH_EDGE (e, ei, bb->preds)
{
+ // If the predecessor is dominated by this block, then there is a back
+ // edge, and won't provide anything useful. We'll actually end up with
+ // VARYING as we will not resolve this node.
+ if (dominated_by_p (CDI_DOMINATORS, e->src, bb))
+ continue;
edge_range (er, e, name, RFD_READ_ONLY);
r.union_ (er);
}