Re: Clang __built_assume

[Bruno Haible <bruno@clisp.org>]

Paul Eggert wrote:
> On 8/17/20 4:37 PM, Bruno Haible wrote:
> >> +   Avoid Clang’s __builtin_assume, as clang 9.0.1 -Wassume can
> >> +   generate a bogus diagnostic "the argument to '__builtin_assume' has
> >> +   side effects that will be discarded" even when the argument has no
> >> +   side effects.  */
> > Do you have a test case, that we could check on clang 10 and on future
> > clang versions?
> 
> Here's a short test that elicits the bogus warning for me now.
> 
> static int f (int x) { return x; }
> int main (void) { __builtin_assume (f (1)); return 0; }

Thanks. I confirm it's still the same with clang 10.

But a small modification of the test case produces no warning:

  static __attribute__ ((__const__)) int f (int x) { return x; }
  int main (void) { __builtin_assume (f (1)); return 0; }

I find it quite natural that

  * If you want to tell the compiler that it can make assumptions about
    a function call, the compiler can evaluate the function call at
    compile-time. If you don't want this, write
      static int f (int x) { return x; }
      int main (void) { int r = f (1); __builtin_assume (r); return 0; }

  * You need to mark those functions that the compiler may evaluate
    at compile-time.

  * There is a diagnostic if the compiler can't take benefit of the
    __builtin_assume invocation, although you intended it to have some.

So, I don't think the warning is bogus.

Back to the verify module. The warning tells us to move the side effect
outside of __builtin_assume. If I do this, I get an assume() macro that

  * produces no warning,

  * in clang versions < 9, has the desired optimization effect, whereas
    the current definition doesn't.

Test case:
==================================================================
#if 1
/* Current definition */
# define assume(R) ((R) ? (void) 0 : __builtin_unreachable ())
#else
/* Proposed definition */
# define assume(R) \
    ((void) ({ __typeof__ (R) _gl_verify_temp = (R); \
               __builtin_assume (_gl_verify_temp); }))
#endif

static int f (int x) { return x; }
int main (void) { assume (f (1)); return 0; }

int g (int x)
{
  assume (x >= 4);
  return (x > 1 ? x + 3 : 2 * x + 10);
}
==================================================================

With clang 8 and the current definition:

g:                                      # @g
        leal    3(%rdi), %ecx
        cmpl    $1, %edi
        leal    10(%rdi,%rdi), %eax
        cmovgl  %ecx, %eax
        retq

With clang 8 and the proposed definition:

g:                                      # @g
        leal    3(%rdi), %eax
        retq


Here's a proposed patch.


2020-08-22  Bruno Haible  <bruno@clisp.org>

	verify: Do use __built_assume on clang.
	* lib/verify.h (assume): Use clang’s __builtin_assume, with a temporary
	variable in a statement expression.

diff --git a/lib/verify.h b/lib/verify.h
index d485a02..0f3c6f9 100644
--- a/lib/verify.h
+++ b/lib/verify.h
@@ -246,6 +246,13 @@ template <int w>
 
 /* @assert.h omit start@  */
 
+#if defined __has_builtin
+/* <https://clang.llvm.org/docs/LanguageExtensions.html#builtin-functions> */
+# define _GL_HAS_BUILTIN_ASSUME __has_builtin (__builtin_assume)
+#else
+# define _GL_HAS_BUILTIN_ASSUME 0
+#endif
+
 #if 3 < __GNUC__ + (3 < __GNUC_MINOR__ + (4 <= __GNUC_PATCHLEVEL__))
 # define _GL_HAS_BUILTIN_TRAP 1
 #elif defined __has_builtin
@@ -305,14 +312,16 @@ template <int w>
 
    Although assuming R can help a compiler generate better code or
    diagnostics, performance can suffer if R uses hard-to-optimize
-   features such as function calls not inlined by the compiler.
-
-   Avoid Clang’s __builtin_assume, as clang 9.0.1 -Wassume can
-   generate a bogus diagnostic "the argument to '__builtin_assume' has
-   side effects that will be discarded" even when the argument has no
-   side effects.  */
-
-#if _GL_HAS_BUILTIN_UNREACHABLE
+   features such as function calls not inlined by the compiler.  */
+
+#if _GL_HAS_BUILTIN_ASSUME
+/* Use a temporary variable, to avoid a clang warning
+   "the argument to '__builtin_assume' has side effects that will be discarded"
+   if R contains invocations of functions not marked as 'const'.  */
+# define assume(R) \
+    ((void) ({ __typeof__ (R) _gl_verify_temp = (R); \
+               __builtin_assume (_gl_verify_temp); }))
+#elif _GL_HAS_BUILTIN_UNREACHABLE
 # define assume(R) ((R) ? (void) 0 : __builtin_unreachable ())
 #elif 1200 <= _MSC_VER
 # define assume(R) __assume (R)