tree-optimization/106131 - wrong code with FRE rewriting
Commit Message
The following makes sure to not use the original TBAA type for
looking up a value across an aggregate copy when we had to offset
the read.
Bootstrapped and tested on x86_64-unknown-linux-gnu, pushed to trunk.
2022-06-30 Richard Biener <rguenther@suse.de>
PR tree-optimization/106131
* tree-ssa-sccvn.cc (vn_reference_lookup_3): Force alias-set
zero when offsetting the read looking through an aggregate
copy.
* g++.dg/torture/pr106131.C: New testcase.
---
gcc/testsuite/g++.dg/torture/pr106131.C | 34 +++++++++++++++++++++++++
gcc/tree-ssa-sccvn.cc | 16 +++++++++---
2 files changed, 46 insertions(+), 4 deletions(-)
create mode 100644 gcc/testsuite/g++.dg/torture/pr106131.C
Comments
Richard Biener via Gcc-patches <gcc-patches@gcc.gnu.org> writes:
> The following makes sure to not use the original TBAA type for
> looking up a value across an aggregate copy when we had to offset
> the read.
>
> Bootstrapped and tested on x86_64-unknown-linux-gnu, pushed to trunk.
>
> 2022-06-30 Richard Biener <rguenther@suse.de>
>
> PR tree-optimization/106131
> * tree-ssa-sccvn.cc (vn_reference_lookup_3): Force alias-set
> zero when offsetting the read looking through an aggregate
> copy.
>
> * g++.dg/torture/pr106131.C: New testcase.
> ---
> gcc/testsuite/g++.dg/torture/pr106131.C | 34 +++++++++++++++++++++++++
> gcc/tree-ssa-sccvn.cc | 16 +++++++++---
> 2 files changed, 46 insertions(+), 4 deletions(-)
> create mode 100644 gcc/testsuite/g++.dg/torture/pr106131.C
>
> diff --git a/gcc/testsuite/g++.dg/torture/pr106131.C b/gcc/testsuite/g++.dg/torture/pr106131.C
> new file mode 100644
> index 00000000000..e110f4a8fe6
> --- /dev/null
> +++ b/gcc/testsuite/g++.dg/torture/pr106131.C
> @@ -0,0 +1,34 @@
> +// { dg-do run { target c++11 } }
> +
> +struct Pair {
> + int a, b;
> + Pair(const Pair &) = default;
> + Pair(int _a, int _b) : a(_a), b(_b) {}
> + Pair &operator=(const Pair &z) {
> + a = z.a;
> + b = z.b;
> + return *this;
> + }
> +};
> +
> +const int &max(const int &a, const int &b)
> +{
> + return a < b ? b : a;
> +}
> +
> +int foo(Pair x, Pair y)
> +{
> + return max(x.b, y.b);
> +}
> +
> +int main()
> +{
> + auto f = new Pair[3] {{0, -11}, {0, -8}, {0, 2}};
> + for (int i = 0; i < 1; i++) {
> + f[i] = f[0];
> + if(i == 0)
> + f[i] = f[2];
> + if (foo(f[i], f[1]) != 2)
> + __builtin_abort();
> + }
> +}
> diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
> index 9deedeac378..76d92895a3a 100644
> --- a/gcc/tree-ssa-sccvn.cc
> +++ b/gcc/tree-ssa-sccvn.cc
> @@ -3243,12 +3243,12 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> poly_int64 extra_off = 0;
> if (j == 0 && i >= 0
> && lhs_ops[0].opcode == MEM_REF
> - && maybe_ne (lhs_ops[0].off, -1))
> + && known_ne (lhs_ops[0].off, -1))
> {
> if (known_eq (lhs_ops[0].off, vr->operands[i].off))
> i--, j--;
> else if (vr->operands[i].opcode == MEM_REF
> - && maybe_ne (vr->operands[i].off, -1))
> + && known_ne (vr->operands[i].off, -1))
These changes don't look right. If -1 is a special marker,
it should be tested with known_eq (positive) or maybe_ne (negative).
In other words, we should enter the if body if off is not the
compile-time constant -1.
Thanks,
Richard
> {
> extra_off = vr->operands[i].off - lhs_ops[0].off;
> i--, j--;
> @@ -3275,6 +3275,7 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> copy_reference_ops_from_ref (rhs1, &rhs);
>
> /* Apply an extra offset to the inner MEM_REF of the RHS. */
> + bool force_no_tbaa = false;
> if (maybe_ne (extra_off, 0))
> {
> if (rhs.length () < 2)
> @@ -3287,6 +3288,10 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> rhs[ix].op0 = int_const_binop (PLUS_EXPR, rhs[ix].op0,
> build_int_cst (TREE_TYPE (rhs[ix].op0),
> extra_off));
> + /* When we have offsetted the RHS, reading only parts of it,
> + we can no longer use the original TBAA type, force alias-set
> + zero. */
> + force_no_tbaa = true;
> }
>
> /* Save the operands since we need to use the original ones for
> @@ -3339,8 +3344,11 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> /* Adjust *ref from the new operands. */
> ao_ref rhs1_ref;
> ao_ref_init (&rhs1_ref, rhs1);
> - if (!ao_ref_init_from_vn_reference (&r, ao_ref_alias_set (&rhs1_ref),
> - ao_ref_base_alias_set (&rhs1_ref),
> + if (!ao_ref_init_from_vn_reference (&r,
> + force_no_tbaa ? 0
> + : ao_ref_alias_set (&rhs1_ref),
> + force_no_tbaa ? 0
> + : ao_ref_base_alias_set (&rhs1_ref),
> vr->type, vr->operands))
> return (void *)-1;
> /* This can happen with bitfields. */
On Fri, 1 Jul 2022, Richard Sandiford wrote:
> Richard Biener via Gcc-patches <gcc-patches@gcc.gnu.org> writes:
> > The following makes sure to not use the original TBAA type for
> > looking up a value across an aggregate copy when we had to offset
> > the read.
> >
> > Bootstrapped and tested on x86_64-unknown-linux-gnu, pushed to trunk.
> >
> > 2022-06-30 Richard Biener <rguenther@suse.de>
> >
> > PR tree-optimization/106131
> > * tree-ssa-sccvn.cc (vn_reference_lookup_3): Force alias-set
> > zero when offsetting the read looking through an aggregate
> > copy.
> >
> > * g++.dg/torture/pr106131.C: New testcase.
> > ---
> > gcc/testsuite/g++.dg/torture/pr106131.C | 34 +++++++++++++++++++++++++
> > gcc/tree-ssa-sccvn.cc | 16 +++++++++---
> > 2 files changed, 46 insertions(+), 4 deletions(-)
> > create mode 100644 gcc/testsuite/g++.dg/torture/pr106131.C
> >
> > diff --git a/gcc/testsuite/g++.dg/torture/pr106131.C b/gcc/testsuite/g++.dg/torture/pr106131.C
> > new file mode 100644
> > index 00000000000..e110f4a8fe6
> > --- /dev/null
> > +++ b/gcc/testsuite/g++.dg/torture/pr106131.C
> > @@ -0,0 +1,34 @@
> > +// { dg-do run { target c++11 } }
> > +
> > +struct Pair {
> > + int a, b;
> > + Pair(const Pair &) = default;
> > + Pair(int _a, int _b) : a(_a), b(_b) {}
> > + Pair &operator=(const Pair &z) {
> > + a = z.a;
> > + b = z.b;
> > + return *this;
> > + }
> > +};
> > +
> > +const int &max(const int &a, const int &b)
> > +{
> > + return a < b ? b : a;
> > +}
> > +
> > +int foo(Pair x, Pair y)
> > +{
> > + return max(x.b, y.b);
> > +}
> > +
> > +int main()
> > +{
> > + auto f = new Pair[3] {{0, -11}, {0, -8}, {0, 2}};
> > + for (int i = 0; i < 1; i++) {
> > + f[i] = f[0];
> > + if(i == 0)
> > + f[i] = f[2];
> > + if (foo(f[i], f[1]) != 2)
> > + __builtin_abort();
> > + }
> > +}
> > diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
> > index 9deedeac378..76d92895a3a 100644
> > --- a/gcc/tree-ssa-sccvn.cc
> > +++ b/gcc/tree-ssa-sccvn.cc
> > @@ -3243,12 +3243,12 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> > poly_int64 extra_off = 0;
> > if (j == 0 && i >= 0
> > && lhs_ops[0].opcode == MEM_REF
> > - && maybe_ne (lhs_ops[0].off, -1))
> > + && known_ne (lhs_ops[0].off, -1))
> > {
> > if (known_eq (lhs_ops[0].off, vr->operands[i].off))
> > i--, j--;
> > else if (vr->operands[i].opcode == MEM_REF
> > - && maybe_ne (vr->operands[i].off, -1))
> > + && known_ne (vr->operands[i].off, -1))
>
> These changes don't look right. If -1 is a special marker,
> it should be tested with known_eq (positive) or maybe_ne (negative).
>
> In other words, we should enter the if body if off is not the
> compile-time constant -1.
Hmm, to me 'known_ne' was visually more correct (only if 'off' is
an actual offset we may treat it as such). Yes, -1 is a special
marker but still. Practically of course
known_ne (poly, integer constant) == maybe_ne (poly, integer_constant)?
That is, if we'd have a poly-int that might be -1 we should still
not use that as 'off'?
I can of course revert that hunk.
Thanks,
Richard.
> Thanks,
> Richard
>
> > {
> > extra_off = vr->operands[i].off - lhs_ops[0].off;
> > i--, j--;
> > @@ -3275,6 +3275,7 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> > copy_reference_ops_from_ref (rhs1, &rhs);
> >
> > /* Apply an extra offset to the inner MEM_REF of the RHS. */
> > + bool force_no_tbaa = false;
> > if (maybe_ne (extra_off, 0))
> > {
> > if (rhs.length () < 2)
> > @@ -3287,6 +3288,10 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> > rhs[ix].op0 = int_const_binop (PLUS_EXPR, rhs[ix].op0,
> > build_int_cst (TREE_TYPE (rhs[ix].op0),
> > extra_off));
> > + /* When we have offsetted the RHS, reading only parts of it,
> > + we can no longer use the original TBAA type, force alias-set
> > + zero. */
> > + force_no_tbaa = true;
> > }
> >
> > /* Save the operands since we need to use the original ones for
> > @@ -3339,8 +3344,11 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
> > /* Adjust *ref from the new operands. */
> > ao_ref rhs1_ref;
> > ao_ref_init (&rhs1_ref, rhs1);
> > - if (!ao_ref_init_from_vn_reference (&r, ao_ref_alias_set (&rhs1_ref),
> > - ao_ref_base_alias_set (&rhs1_ref),
> > + if (!ao_ref_init_from_vn_reference (&r,
> > + force_no_tbaa ? 0
> > + : ao_ref_alias_set (&rhs1_ref),
> > + force_no_tbaa ? 0
> > + : ao_ref_base_alias_set (&rhs1_ref),
> > vr->type, vr->operands))
> > return (void *)-1;
> > /* This can happen with bitfields. */
>
Richard Biener <rguenther@suse.de> writes:
> On Fri, 1 Jul 2022, Richard Sandiford wrote:
>
>> Richard Biener via Gcc-patches <gcc-patches@gcc.gnu.org> writes:
>> > The following makes sure to not use the original TBAA type for
>> > looking up a value across an aggregate copy when we had to offset
>> > the read.
>> >
>> > Bootstrapped and tested on x86_64-unknown-linux-gnu, pushed to trunk.
>> >
>> > 2022-06-30 Richard Biener <rguenther@suse.de>
>> >
>> > PR tree-optimization/106131
>> > * tree-ssa-sccvn.cc (vn_reference_lookup_3): Force alias-set
>> > zero when offsetting the read looking through an aggregate
>> > copy.
>> >
>> > * g++.dg/torture/pr106131.C: New testcase.
>> > ---
>> > gcc/testsuite/g++.dg/torture/pr106131.C | 34 +++++++++++++++++++++++++
>> > gcc/tree-ssa-sccvn.cc | 16 +++++++++---
>> > 2 files changed, 46 insertions(+), 4 deletions(-)
>> > create mode 100644 gcc/testsuite/g++.dg/torture/pr106131.C
>> >
>> > diff --git a/gcc/testsuite/g++.dg/torture/pr106131.C b/gcc/testsuite/g++.dg/torture/pr106131.C
>> > new file mode 100644
>> > index 00000000000..e110f4a8fe6
>> > --- /dev/null
>> > +++ b/gcc/testsuite/g++.dg/torture/pr106131.C
>> > @@ -0,0 +1,34 @@
>> > +// { dg-do run { target c++11 } }
>> > +
>> > +struct Pair {
>> > + int a, b;
>> > + Pair(const Pair &) = default;
>> > + Pair(int _a, int _b) : a(_a), b(_b) {}
>> > + Pair &operator=(const Pair &z) {
>> > + a = z.a;
>> > + b = z.b;
>> > + return *this;
>> > + }
>> > +};
>> > +
>> > +const int &max(const int &a, const int &b)
>> > +{
>> > + return a < b ? b : a;
>> > +}
>> > +
>> > +int foo(Pair x, Pair y)
>> > +{
>> > + return max(x.b, y.b);
>> > +}
>> > +
>> > +int main()
>> > +{
>> > + auto f = new Pair[3] {{0, -11}, {0, -8}, {0, 2}};
>> > + for (int i = 0; i < 1; i++) {
>> > + f[i] = f[0];
>> > + if(i == 0)
>> > + f[i] = f[2];
>> > + if (foo(f[i], f[1]) != 2)
>> > + __builtin_abort();
>> > + }
>> > +}
>> > diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
>> > index 9deedeac378..76d92895a3a 100644
>> > --- a/gcc/tree-ssa-sccvn.cc
>> > +++ b/gcc/tree-ssa-sccvn.cc
>> > @@ -3243,12 +3243,12 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
>> > poly_int64 extra_off = 0;
>> > if (j == 0 && i >= 0
>> > && lhs_ops[0].opcode == MEM_REF
>> > - && maybe_ne (lhs_ops[0].off, -1))
>> > + && known_ne (lhs_ops[0].off, -1))
>> > {
>> > if (known_eq (lhs_ops[0].off, vr->operands[i].off))
>> > i--, j--;
>> > else if (vr->operands[i].opcode == MEM_REF
>> > - && maybe_ne (vr->operands[i].off, -1))
>> > + && known_ne (vr->operands[i].off, -1))
>>
>> These changes don't look right. If -1 is a special marker,
>> it should be tested with known_eq (positive) or maybe_ne (negative).
>>
>> In other words, we should enter the if body if off is not the
>> compile-time constant -1.
>
> Hmm, to me 'known_ne' was visually more correct (only if 'off' is
> an actual offset we may treat it as such).
That's also the intention behind maybe_ne though. The point is that
-1 isn't really a number on a scale [M, N] (M < -1, N > -1). It's a
just a C way of representing "nothing" in an "X or nothing" (std::optional).
So whether an offset happens to be numerically equal to -1 at runtime
isn't relevant. A runtime off is an X in the "X or nothing" and so
needs to be treated in the same was as other Xs.
To put it another way: known_ne is harder to prove than maybe_ne.
known_ne must return false if it can't prove the arguments are
different for all possible combinations of indeterminates.
maybe_ne is instead the direct opposite of known_eq.
Another analogy might be: suppose that we used a -1 INTEGER_CST
as a special marker. (Not a good choice, but bear with me.)
If we wanted to test whether a tree was this special marker,
we'd use integer_minus_onep. To test that it isn't the marker
we'd use !integer_minus_onep. known_ne would instead be the
equivalent of:
integer_zerop (fold_build2 (boolean_type_node, NE_EXPR,
x, ...-1 node...))
and so a general x would be treated in the same way as -1.
> Yes, -1 is a special
> marker but still. Practically of course
> known_ne (poly, integer constant) == maybe_ne (poly, integer_constant)?
Not in general. E.g. if VL is the SVE vector length in bytes:
maybe_ne (VL, 16)
is true (VL can be [1,16]*16) but:
known_ne (VL, 16)
is false (VL might be 16 but might not).
> That is, if we'd have a poly-int that might be -1 we should still
> not use that as 'off'?
known_ne might be safe in this particular instance if no runtime offset
would ever evaluate to -1. But IMO it's harder to reason about and
less obviously safe.
Thanks,
Richard
> I can of course revert that hunk.
>
> Thanks,
> Richard.
>
>> Thanks,
>> Richard
>>
>> > {
>> > extra_off = vr->operands[i].off - lhs_ops[0].off;
>> > i--, j--;
>> > @@ -3275,6 +3275,7 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
>> > copy_reference_ops_from_ref (rhs1, &rhs);
>> >
>> > /* Apply an extra offset to the inner MEM_REF of the RHS. */
>> > + bool force_no_tbaa = false;
>> > if (maybe_ne (extra_off, 0))
>> > {
>> > if (rhs.length () < 2)
>> > @@ -3287,6 +3288,10 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
>> > rhs[ix].op0 = int_const_binop (PLUS_EXPR, rhs[ix].op0,
>> > build_int_cst (TREE_TYPE (rhs[ix].op0),
>> > extra_off));
>> > + /* When we have offsetted the RHS, reading only parts of it,
>> > + we can no longer use the original TBAA type, force alias-set
>> > + zero. */
>> > + force_no_tbaa = true;
>> > }
>> >
>> > /* Save the operands since we need to use the original ones for
>> > @@ -3339,8 +3344,11 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
>> > /* Adjust *ref from the new operands. */
>> > ao_ref rhs1_ref;
>> > ao_ref_init (&rhs1_ref, rhs1);
>> > - if (!ao_ref_init_from_vn_reference (&r, ao_ref_alias_set (&rhs1_ref),
>> > - ao_ref_base_alias_set (&rhs1_ref),
>> > + if (!ao_ref_init_from_vn_reference (&r,
>> > + force_no_tbaa ? 0
>> > + : ao_ref_alias_set (&rhs1_ref),
>> > + force_no_tbaa ? 0
>> > + : ao_ref_base_alias_set (&rhs1_ref),
>> > vr->type, vr->operands))
>> > return (void *)-1;
>> > /* This can happen with bitfields. */
>>
new file mode 100644
@@ -0,0 +1,34 @@
+// { dg-do run { target c++11 } }
+
+struct Pair {
+ int a, b;
+ Pair(const Pair &) = default;
+ Pair(int _a, int _b) : a(_a), b(_b) {}
+ Pair &operator=(const Pair &z) {
+ a = z.a;
+ b = z.b;
+ return *this;
+ }
+};
+
+const int &max(const int &a, const int &b)
+{
+ return a < b ? b : a;
+}
+
+int foo(Pair x, Pair y)
+{
+ return max(x.b, y.b);
+}
+
+int main()
+{
+ auto f = new Pair[3] {{0, -11}, {0, -8}, {0, 2}};
+ for (int i = 0; i < 1; i++) {
+ f[i] = f[0];
+ if(i == 0)
+ f[i] = f[2];
+ if (foo(f[i], f[1]) != 2)
+ __builtin_abort();
+ }
+}
@@ -3243,12 +3243,12 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
poly_int64 extra_off = 0;
if (j == 0 && i >= 0
&& lhs_ops[0].opcode == MEM_REF
- && maybe_ne (lhs_ops[0].off, -1))
+ && known_ne (lhs_ops[0].off, -1))
{
if (known_eq (lhs_ops[0].off, vr->operands[i].off))
i--, j--;
else if (vr->operands[i].opcode == MEM_REF
- && maybe_ne (vr->operands[i].off, -1))
+ && known_ne (vr->operands[i].off, -1))
{
extra_off = vr->operands[i].off - lhs_ops[0].off;
i--, j--;
@@ -3275,6 +3275,7 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
copy_reference_ops_from_ref (rhs1, &rhs);
/* Apply an extra offset to the inner MEM_REF of the RHS. */
+ bool force_no_tbaa = false;
if (maybe_ne (extra_off, 0))
{
if (rhs.length () < 2)
@@ -3287,6 +3288,10 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
rhs[ix].op0 = int_const_binop (PLUS_EXPR, rhs[ix].op0,
build_int_cst (TREE_TYPE (rhs[ix].op0),
extra_off));
+ /* When we have offsetted the RHS, reading only parts of it,
+ we can no longer use the original TBAA type, force alias-set
+ zero. */
+ force_no_tbaa = true;
}
/* Save the operands since we need to use the original ones for
@@ -3339,8 +3344,11 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
/* Adjust *ref from the new operands. */
ao_ref rhs1_ref;
ao_ref_init (&rhs1_ref, rhs1);
- if (!ao_ref_init_from_vn_reference (&r, ao_ref_alias_set (&rhs1_ref),
- ao_ref_base_alias_set (&rhs1_ref),
+ if (!ao_ref_init_from_vn_reference (&r,
+ force_no_tbaa ? 0
+ : ao_ref_alias_set (&rhs1_ref),
+ force_no_tbaa ? 0
+ : ao_ref_base_alias_set (&rhs1_ref),
vr->type, vr->operands))
return (void *)-1;
/* This can happen with bitfields. */