[RISC-V] Miscompile on rv64gcv with -O[23]

[ewlu]

Testcase:

unsigned short a[][21];
long long p;
short c = 26161;
short h[21];
unsigned short a[21][21];
int main() {
  for (int k = 0; k < 21; ++k)
    h[k] = k;
  for (short k = 2; k < 18; k += 4)
    for (int l = 0; l < 21; l += c - 26158)
      a[k][l] = ({
                  int m = h[l];
                  int n = m > 0 ? m : 0;
                  n;
                }) > (h[l] ^ (h[l] ?: 8));
  for (int k = 0; k < 21; ++k)
    p ^= a[k][0];
  __builtin_printf("%llu\n", p);
}

Commands:

# O3
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv -flto -O3 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=128,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out 1
1

# O2
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv -flto -O2 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=128,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out 1
1

# O1
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv -flto -O1 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=128,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out 1
0

# x86
$ ./native.out
0

Bisected to 2b71269 as the first bad commit

Tried replacing

      a[k][l] = ({
                  int m = h[l];
                  int n = m > 0 ? m : 0;
                  n;
                }) > (h[l] ^ (h[l] ?: 8));

with

      a[k][l] = (h[l] > 0 ? h[l] : 0) > (h[l] ^ (h[l] ?: 8));

but the error goes away. Same with eliminating the computation with short c

Found via fuzzer

[topperc]

When I bisected, I get 9c388f1 as the first bad commit

[topperc]

CC: @alexey-bataev