[RISC-V] Miscompile at -O[23]

[ewlu]

Testcase:

unsigned short a[10];
void b(short c, short i[]) {
  for (short k = 1; k < 9; k += 2)
    a[k] = c ? i[k] : i[k + 1];
}
long long m;
short c;
short i[10];
void checksum() {
  for (int k = 0; k < 10; ++k)
    m ^= a[k] + (m < 6) + (m > 2);
}
int main() {
  for (int k = 0; k < 10; ++k)
    a[k] = 3;
  b(c, i);
  checksum();
  __builtin_printf("%llu\n", m);
}

Commands

# -O3
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv -O3 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=128,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out 1
65541

# -O2
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv -O2 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=128,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out 1
65541

# -O1
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv -O1 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=128,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out 1
0

Bisected to 60ad6e3 as the first bad commit.

Found via fuzzer

[topperc]

opt-bisect points to riscv-vector-peephole

CC @lukel97

[topperc]

Good code

          li      a1, 85                                                           
          vsetivli        zero, 7, e16, m1, ta, ma                                 
          vmv.s.x v0, a1                                                           
          vle16.v v8, (a0), v0.t                                                   
          vsetivli        zero, 8, e16, m1, ta, ma                                 
          vmv.v.i v9, 3                                                            
          vmerge.vvm      v8, v9, v8, v0                                           
          addi    a0, s0, 18                                                       
          vse16.v v8, (a0) 

Bad code

        li      a1, 85                                                           
        vsetivli        zero, 8, e16, m1, ta, ma                                 
        vmv.s.x v0, a1                                                           
        vmv.v.i v8, 3                                                            
        vsetivli        zero, 7, e16, m1, ta, mu                                 
        vle16.v v8, (a0), v0.t                                                   
        addi    a0, s0, 18                                                       
        vsetivli        zero, 8, e16, m1, ta, ma                                 
        vse16.v v8, (a0) 

Looks like we changed the VL of the vmerge by combining it into the load.

[topperc]

I think the issue is that convertSameMaskVMergeToVMv turned a vmerge into vmv without noticing that the load had a different VL than the vmerge.