[Bug rtl-optimization/70526] GCC 6 miscompiles Firefox JIT compiler

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70526

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Looks like a SRA bug to me replacing

  D.2447 = MEM[(const struct Register &)&D.2394];
  D.2404 = D.2447;
  _5 = D.2404.reg_;

with

  SR.8_3 = MEM[(struct TypedOrValueRegister *)&D.2394];
  SR.7_4 = SR.8_3;
  _5 = SR.7_4;

notice how it changes the alias type of the access of D.2394.

Will attempt to totally scalarize D.2447 (UID: 2447):
...
Created a replacement for D.2447 offset: 0, size: 32: SR.8

Access trees for D.2447 (UID: 2447):
access { base = (2447)'D.2447', offset = 0, size = 32, expr = D.2447.reg_, type
= uint32_t, non_addressable = 0, reverse = 0, grp_read = 1, grp_write = 1,
grp_assignment_read = 1, grp_assignment_write = 1, grp_scalar_read = 1,
grp_scalar_write = 0, grp_total_scalarization = 1, grp_hint = 1, grp_covered =
1, grp_unscalarizable_region = 0, grp_unscalarized_data = 0, grp_partial_lhs =
0, grp_to_be_replaced = 1, grp_to_be_debug_replaced = 0, grp_maybe_modified =
0, grp_not_necessarilly_dereferenced = 0

notice the bogus ->expr, possibly created from the D.2404 accesses.

Created a replacement for D.2404 offset: 0, size: 32: SR.7

Access trees for D.2404 (UID: 2404):
access { base = (2404)'D.2404', offset = 0, size = 32, expr = D.2404.reg_, type
= uint32_t, non_addressable = 0, reverse = 0, grp_read = 1, grp_write = 1,
grp_assignment_read = 1, grp_assignment_write = 1, grp_scalar_read = 1,
grp_scalar_write = 0, grp_total_scalarization = 0, grp_hint = 0, grp_covered =
1, grp_unscalarizable_region = 0, grp_unscalarized_data = 0, grp_partial_lhs =
0, grp_to_be_replaced = 1, grp_to_be_debug_replaced = 0, grp_maybe_modified =
0, grp_not_necessarilly_dereferenced = 0


Indeed the issue seems to be a simple typo and the following fixes it:

Index: gcc/tree-sra.c
===================================================================
--- gcc/tree-sra.c      (revision 234736)
+++ gcc/tree-sra.c      (working copy)
@@ -1673,7 +1673,7 @@ build_ref_for_offset (location_t loc, tr
     }
   else
     {
-      off = build_int_cst (reference_alias_ptr_type (base),
+      off = build_int_cst (reference_alias_ptr_type (prev_base),
                           base_offset + offset / BITS_PER_UNIT);
       base = build_fold_addr_expr (unshare_expr (base));
     }