[gcc r17-3556] ifcvt: Do not clobber a live condition-code register [PR126501, PR126747]

https://gcc.gnu.org/g:eef42c68c7f66835747f82e4532a26d7a0f6bb98

commit r17-3556-geef42c68c7f66835747f82e4532a26d7a0f6bb98
Author: Kyrylo Tkachov <[email protected]>
Date:   Thu Jul 30 12:20:54 2026 +0200

    ifcvt: Do not clobber a live condition-code register [PR126501, PR126747]
    
    If-conversion emits its replacement sequence at the end of the test block.
    Expanding a conditional move there can require a fresh comparison, which
    writes a condition-code register.  end_ifcvt_sequence already rejects a
    sequence that would destroy the condition code tested by the branch, but
    cc_in_cond only reports that register when the branch reads it directly.
    A branch such as AArch64 CBZ tests a general register, so the guard was
    inert and an unrelated live condition code could be destroyed.
    
    For the testcase at -O2 on aarch64, late-combine sinks a cset into the
    join block, which leaves the flags live across the branch:
    
      bb2:  cmp   w3, 1        // sets cc
            cset  w4, ls
            cbz   w1, .L2      // does not touch cc
      bb5:  cinc  w2, w2, ls   // reads cc
    
    ce2 then if-converted bb3 and bb4 and inserted "cmp w1, 0" ahead of the
    branch, so cinc read the wrong flags:
    
            cmp   w3, 1
            cset  w4, ls
            cmp   w1, 0        // clobbers the live flags
            csel  w2, w2, w3, eq
            cinc  w2, w2, ls   // reads cmp w1, 0
    
    rtl.h documents that ports in the "lowered" form, which includes aarch64
    before register allocation, may keep the flags live between instructions,
    so if-conversion has to respect that.  Reject a generated sequence that
    writes a condition-code register while it is live on exit from the test
    block.  Recognise condition-code registers from the mode of each store
    destination and from the target's fixed flags and condition-code register
    hooks.  The destination mode preserves condition-code semantics that
    reg_raw_mode can lose when a hard register also holds integers.  The hooks
    cover condition state that is itself represented in an integer mode.  DF
    liveness is already up to date here and the same paths query it for pseudos.
    
    noce_convert_multiple_sets validates its sequence itself rather than
    through end_ifcvt_sequence, and reaches noce_emit_cmove in the same way,
    so it gets the same check.
    
    PR126747 is the same defect reached from a different direction.  At -Os the
    multiplication overflow idiom becomes one .MUL_OVERFLOW, so both arms read a
    single cset, and late-combine folds it into the second one:
    
      bb2:  cmp   xzr, x0, lsr 32   // sets cc
            cset  w3, ne
            cbz   w0, .L4           // does not touch cc
      bb5:  cinc  w0, w0, ne        // reads cc
    
    ce2 if-converted bb3 the same way and "cmp w0, 0" landed ahead of the cinc, so
    foo (1, 1) returned 1 instead of 0.
    
    Bootstrapped and tested on aarch64-none-linux-gnu.
    
    gcc/ChangeLog:
    
            PR rtl-optimization/126501
            PR rtl-optimization/126747
            * ifcvt.cc (noce_cc_reg_set): New struct.
            (noce_record_cc_reg_set): New function.
            (noce_clobbers_live_cc_p): New function.
            (end_ifcvt_sequence): Use it to reject sequences that clobber a
            condition-code register that is live out of the test block.
            (noce_convert_multiple_sets): Likewise.
    
    gcc/testsuite/ChangeLog:
    
            PR rtl-optimization/126501
            PR rtl-optimization/126747
            * gcc.c-torture/execute/pr126501.c: New test.
            * gcc.c-torture/execute/pr126747.c: New test.
    
    Signed-off-by: Kyrylo Tkachov <[email protected]>

Diff:
---
 gcc/ifcvt.cc                                   | 63 +++++++++++++++++++++++++
 gcc/testsuite/gcc.c-torture/execute/pr126501.c | 64 ++++++++++++++++++++++++++
 gcc/testsuite/gcc.c-torture/execute/pr126747.c | 26 +++++++++++
 3 files changed, 153 insertions(+)

diff --git a/gcc/ifcvt.cc b/gcc/ifcvt.cc
index ecf59a21806e..add276ceb9be 100644
--- a/gcc/ifcvt.cc
+++ b/gcc/ifcvt.cc
@@ -1094,6 +1094,60 @@ cc_in_cond (rtx cond)
   return NULL_RTX;
 }
 
+struct noce_cc_reg_set
+{
+  HARD_REG_SET set;
+  unsigned int fixed_regno1;
+  unsigned int fixed_regno2;
+};
+
+/* If DEST is a hard condition-code register, add it to the set in DATA.
+   PAT is the SET or CLOBBER that writes DEST.  */
+
+static void
+noce_record_cc_reg_set (rtx dest, const_rtx pat ATTRIBUTE_UNUSED, void *data)
+{
+  noce_cc_reg_set *cc_regs = (noce_cc_reg_set *) data;
+
+  if (REG_P (dest) && HARD_REGISTER_P (dest)
+      && (GET_MODE_CLASS (GET_MODE (dest)) == MODE_CC
+	  || REGNO (dest) == targetm.flags_regnum
+	  || REGNO (dest) == cc_regs->fixed_regno1
+	  || REGNO (dest) == cc_regs->fixed_regno2))
+    add_to_hard_reg_set (&cc_regs->set, GET_MODE (dest), REGNO (dest));
+}
+
+/* Return true if SEQ writes a condition-code register that still holds a
+   value which is live on exit from TEST_BB.
+
+   An if-converted sequence is emitted immediately before the jump that ends
+   TEST_BB, and the conversion then removes that jump, so a condition code
+   that is live out of TEST_BB is one which a later block still reads.
+   Expanding a conditional move can emit a fresh comparison, and that would
+   destroy it.  */
+
+static bool
+noce_clobbers_live_cc_p (basic_block test_bb, rtx_insn *seq)
+{
+  noce_cc_reg_set cc_regs;
+  CLEAR_HARD_REG_SET (cc_regs.set);
+  cc_regs.fixed_regno1 = INVALID_REGNUM;
+  cc_regs.fixed_regno2 = INVALID_REGNUM;
+  targetm.fixed_condition_code_regs (&cc_regs.fixed_regno1,
+				     &cc_regs.fixed_regno2);
+  for (rtx_insn *insn = seq; insn; insn = NEXT_INSN (insn))
+    note_stores (insn, noce_record_cc_reg_set, &cc_regs);
+
+  bitmap live_out = df_get_live_out (test_bb);
+  hard_reg_set_iterator hrsi;
+  unsigned int regno;
+  EXECUTE_IF_SET_IN_HARD_REG_SET (cc_regs.set, 0, regno, hrsi)
+    if (bitmap_bit_p (live_out, regno))
+      return true;
+
+  return false;
+}
+
 /* Return sequence of instructions generated by if conversion.  This
    function calls end_sequence() to end the current stream, ensures
    that the instructions are unshared, recognizable non-jump insns.
@@ -1128,6 +1182,10 @@ end_ifcvt_sequence (struct noce_if_info *if_info)
 	|| (cc && set_of (cc, insn)))
       return NULL;
 
+  /* CC above only covers the condition code read by the converted branch.  */
+  if (noce_clobbers_live_cc_p (if_info->test_bb, seq))
+    return NULL;
+
   return seq;
 }
 
@@ -4015,6 +4073,11 @@ noce_convert_multiple_sets (struct noce_if_info *if_info)
 	|| recog_memoized (insn) == -1)
       return false;
 
+  /* This path does not go through end_ifcvt_sequence, so apply the same rule
+     about condition codes that outlive the if-region.  */
+  if (noce_clobbers_live_cc_p (test_bb, seq))
+    return false;
+
   emit_insn_before_setloc (seq, if_info->jump,
 			   INSN_LOCATION (insn_info.last ()->unmodified_insn));
 
diff --git a/gcc/testsuite/gcc.c-torture/execute/pr126501.c b/gcc/testsuite/gcc.c-torture/execute/pr126501.c
new file mode 100644
index 000000000000..c86f195ba2b6
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/execute/pr126501.c
@@ -0,0 +1,64 @@
+/* PR rtl-optimization/126501 */
+/* If-conversion emitted a fresh comparison at the end of the test block
+   while a condition-code value set earlier in that block was still live
+   in the join block.  */
+
+struct F { unsigned int f0 : 2, f1 : 2, f2 : 2; };
+struct G { unsigned int g : 2; };
+struct S { struct F f; struct G g[6]; };
+
+__attribute__((noipa)) int
+f (struct S *p, int x)
+{
+  p->g[1].g = (1 >= p->f.f1);
+  p->g[2].g = x ? p->f.f0 : p->f.f2;
+  p->g[0].g = p->g[1].g + p->g[2].g;
+  return p->g[0].g;
+}
+
+__attribute__((noipa)) int
+ref (struct S *p, int x)
+{
+  volatile int f0 = p->f.f0, f1 = p->f.f1, f2 = p->f.f2;
+  volatile int a = (1 >= f1);
+  volatile int b = (x ? f0 : f2);
+
+  p->g[1].g = a;
+  p->g[2].g = b;
+  p->g[0].g = (int) p->g[1].g + (int) p->g[2].g;
+  return p->g[0].g;
+}
+
+__attribute__((noipa)) int
+opaque (int v)
+{
+  return v;
+}
+
+int
+main (void)
+{
+  struct S s;
+  int i, j, k, xi;
+
+  for (i = 0; i < 4; i++)
+    for (j = 0; j < 4; j++)
+      for (k = 0; k < 4; k++)
+	for (xi = 0; xi < 2; xi++)
+	  {
+	    int x = opaque (xi);
+	    int got, want;
+
+	    __builtin_memset (&s, 0, sizeof s);
+	    s.f.f0 = i; s.f.f1 = j; s.f.f2 = k;
+	    got = f (&s, x);
+
+	    __builtin_memset (&s, 0, sizeof s);
+	    s.f.f0 = i; s.f.f1 = j; s.f.f2 = k;
+	    want = ref (&s, x);
+
+	    if (got != want)
+	      __builtin_abort ();
+	  }
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.c-torture/execute/pr126747.c b/gcc/testsuite/gcc.c-torture/execute/pr126747.c
new file mode 100644
index 000000000000..f9e597019152
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/execute/pr126747.c
@@ -0,0 +1,26 @@
+/* PR rtl-optimization/126747 */
+/* Both overflow tests read one condition-code value that late-combine left
+   live across the branches.  If-conversion emitted a fresh comparison at the
+   end of the test block and destroyed it.  */
+
+volatile int c[2];
+
+__attribute__((noipa)) int
+foo (unsigned x, unsigned y)
+{
+  unsigned r = x * y;
+  int t = 0;
+  if (c[0]) { int u = 0; if (x != 0) u = (r / x != y); t += u; }
+  if (c[1]) { int u = 0; if (x != 0) u = (r / x != y); t += u; }
+  return t;
+}
+
+int
+main (void)
+{
+  c[0] = 1;
+  c[1] = 1;
+  if (foo (1, 1) != 0)
+    __builtin_abort ();
+  return 0;
+}