[Bug c/15438] New: miscompilation of simple test with __errno_location ()

[Bug c/15438] New: miscompilation of simple test with __errno_location ()

[belyshev at lubercy dot com]

cat > bug.c << EOF
typedef unsigned int size_t;
extern int *__errno_location (void) __attribute__ ((__const__));
extern int printf (__const char *__restrict __format, ...);
extern void *malloc (size_t __size) __attribute__ ((__malloc__));
extern void abort (void) __attribute__ ((__noreturn__));
#define ENOMEM 12

int
main (void)
{
  void *p;
  *__errno_location () = 0;
  p = malloc (-1);
  if (*__errno_location () != ENOMEM)
	  abort ();
  return 0;
}
EOF
gcc bug.c -O
./a.out

Aborted

-- 
           Summary: miscompilation of simple test with __errno_location ()
           Product: gcc
           Version: 3.5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: belyshev at lubercy dot com
                CC: gcc-bugs at gcc dot gnu dot org
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug c/15438] miscompilation of simple test with __errno_location ()

[belyshev at lubercy dot com]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |3.5.0
      Known to work|                            |3.4.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug c/15438] miscompilation of simple test with __errno_location ()

[belyshev at lubercy dot com]

------- Additional Comments From belyshev at lubercy dot com  2004-05-14 16:28 -------
Created an attachment (id=6287)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=6287&action=view)
testcase (436 bytes)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] miscompilation of simple testcase

[belyshev at lubercy dot com]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |tree-optimization
            Summary|miscompilation of simple    |miscompilation of simple
                   |test with __errno_location  |testcase
                   |()                          |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation of simple testcase

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-05-14 16:58 -------
I think the issue is that const is wrong here so glibc is wrong.
Yes I am right glibc is wrong:
const
Many functions do not examine any values except their arguments, and have no effects except the 
return value. Basically this is just slightly more strict class than the pure attribute above, since function 
is not allowed to read global memory.

They should instead be using the pure attribute:
pure
Many functions have no effects except the return value and their return value depends only on the 
parameters and/or global variables. Such a function can be subject to common subexpression 
elimination and loop optimization just as an arithmetic operator would be. These functions should be 
declared with the attribute pure. For example,
          int square (int) __attribute__ ((pure));
          


says that the hypothetical function square is safe to call fewer times than the program says.

Some of common examples of pure functions are strlen or memcmp. Interesting non-pure functions 
are functions with infinite loops or those depending on volatile memory or other system resource, that 
may change between two consecutive calls (such as feof in a multithreading environment).

The attribute pure is not implemented in GCC versions earlier than 2.96. 


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID
            Summary|miscompilation of simple    |[3.5 Regression]
                   |testcase                    |miscompilation of simple
                   |                            |testcase


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation of simple testcase

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-05-14 17:13 -------
I will let someone else decide if glibc is wrong here but I think it is.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug c/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[belyshev at lubercy dot com]

------- Additional Comments From belyshev at lubercy dot com  2004-05-14 17:47 -------
This testcase really 2-in-1 8-)

int *f (void) __attribute__ ((__const__));
void* g () __attribute__ ((__malloc__));
void h ();

int main (void)
{
	int *p = f ();
	*p = 0;
	g ();
	if (*p)
		h ();
	return 0;
}

Wrong code produced if -ftree-dominator-opts is not disabled (see bug.c.t34.dom2)


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |c
            Summary|[3.5 Regression]            |[3.5 Regression]
                   |miscompilation of simple    |miscompilation with
                   |testcase                    |attribute (__malloc__)


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug c/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[belyshev at lubercy dot com]

------- Additional Comments From belyshev at lubercy dot com  2004-05-15 16:25 -------
Created an attachment (id=6305)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=6305&action=view)
testcase (223 bytes)

I think this one clarifies situation:

cat > bug.i << EOF
int a;

void __attribute__ ((malloc)) *foo ()
{
	a = 1;
}

int main (void)
{
	int *p = &a;
	*p = 0;
	foo ();
	if (!*p)
		abort ();
	return 0;
}
EOF
gcc bug.i -O
./a.out
Aborted


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
Attachment #6287 is|0                           |1
           obsolete|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-05-16 14:35 -------
Confirmed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |critical
             Status|UNCONFIRMED                 |NEW
          Component|c                           |tree-optimization
     Ever Confirmed|                            |1
           Keywords|                            |wrong-code
   Last reconfirmed|0000-00-00 00:00:00         |2004-05-16 14:35:14
               date|                            |
   Target Milestone|---                         |3.5.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-05-17 07:42 -------
This is an alias bug.  Just before dom2, the tree looks like this: 
 
main () 
{ 
  int * p; 
  int T.0; 
 
  # BLOCK 0 
  # PRED: ENTRY [100.0%]  (fallthru) 
  #   a_5 = VDEF <a_2>; 
  a = 0; 
  #   VUSE <a_5>; 
  foo (); 
  #   VUSE <a_5>; 
  T.0_3 = a; 
  if (T.0_3 == 0) goto <L0>; else goto <L1>; 
  # SUCC: 2 [53.5%]  (false) 1 [46.5%]  (true) 
 
  # BLOCK 1 
  # PRED: 0 [46.5%]  (true) 
<L0>:; 
  abort (); 
  # SUCC: 
 
  # BLOCK 2 
  # PRED: 0 [53.5%]  (false) 
<L1>:; 
  return 0; 
  # SUCC: EXIT [100.0%] 
 
} 
 
Notice that the call to foo() does not clobber a, so we have: 
 
  a = 0; 
  #   VUSE <a_5>; 
  foo (); 
  #   VUSE <a_5>; 
  T.0_3 = a; 
 
and dom2 thinks "T.0_3 = 0" is a valid constant propagation. 
 
The documentation for attribute malloc says: 
 
`malloc' 
     The `malloc' attribute is used to tell the compiler that a function 
     may be treated as if it were the malloc function.  The compiler 
     assumes that calls to malloc result in a pointers that cannot 
     alias anything.  This will often improve optimization. 
 
so while the returned pointer cannot alias anything, it doesn't mean 
that the function call may not call clobber global variables.  So in 
this case, 'a' may be clobbered by the call to foo(), and there should 
be a VDEF for a at the function call. 
 
 

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dnovillo at redhat dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-05-17 07:54 -------
This is interesting.  Before dom1, we have this: 
 
main () 
{ 
  int<D0> * p<D1457>; 
  int<D0> T.0<D1458>; 
 
  # BLOCK 0 
  # PRED: ENTRY (fallthru) 
  p<D1457>_1 = &a<D1451>; 
  *p<D1457>_1 = 0; 
  #   VUSE <a<D1451>_2>; 
  foo (); 
  T.0<D1458>_3 = *p<D1457>_1; 
  if (T.0<D1458>_3 == 0) goto <L0>; else goto <L1>; 
  # SUCC: 2 (false) 1 (true) 
 
  # BLOCK 1 
  # PRED: 0 (true) 
<L0>:; 
  abort (); 
  # SUCC: 
 
  # BLOCK 2 
  # PRED: 0 (false) 
<L1>:; 
  return 0; 
  # SUCC: EXIT 
 
} 
 
Note especially this: 
  #   VUSE <a<D1451>_2>; 
  foo (); 
  T.0<D1458>_3 = *p<D1457>_1; 
 
So foo() doesn't clobber a here. (And is it expected that 
dereferencing p is not a VUSE of a?) 
 
Then dom1 turns it into this: 
 
main () 
{ 
  int<D0> * p<D1457>; 
  int<D0> T.0<D1458>; 
 
  # BLOCK 0 
  # PRED: ENTRY (fallthru) 
  p<D1457>_1 = &a<D1451>; 
  #   a<D1451>_5 = VDEF <a<D1451>_2>; 
  a<D1451> = 0; 
  #   VUSE <a<D1451>_5>; 
  foo (); 
  #   VUSE <a<D1451>_5>; 
  T.0<D1458>_3 = a<D1451>; 
  if (T.0<D1458>_3 == 0) goto <L0>; else goto <L1>; 
  # SUCC: 2 (false) 1 (true) 
 
  # BLOCK 1 
  # PRED: 0 (true) 
<L0>:; 
  abort (); 
  # SUCC: 
 
  # BLOCK 2 
  # PRED: 0 (false) 
<L1>:; 
  return 0; 
  # SUCC: EXIT 
 
} 
 
 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-05-17 08:10 -------
Simpler test case: 
==================================== 
int a; 
 
void __attribute__ ((malloc)) *foo () 
{ 
  a = 0; 
} 
 
void bar (void) 
{ 
  a = 1; 
  foo (); 
  if (a) 
    abort (); 
} 
==================================== 
 
--> 
bar () 
{ 
  int<D0> a.0<D1457>; 
 
  #   a<D1451>_2 = VDEF <a<D1451>_1>; 
  a<D1451> = 1; 
  #   VUSE <a<D1451>_2>; 
  foo (); 
  abort (); 
} 
 
 

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2004-05-16 14:35:14         |2004-05-17 08:10:38
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-05-17 08:37 -------
I don't think it is safe to not add call clobbered ops if the  
function has the malloc attribute.  It is definitely not safe 
if the function _may_ be alloca (ECF_MAY_BE_ALLOCA does not 
mean the call _is_ alloca, afaict). 
 
Index: tree-ssa-operands.c 
=================================================================== 
RCS file: /cvs/gcc/gcc/gcc/tree-ssa-operands.c,v 
retrieving revision 2.2 
diff -c -3 -p -r2.2 tree-ssa-operands.c 
*** tree-ssa-operands.c 14 May 2004 02:32:58 -0000      2.2 
--- tree-ssa-operands.c 17 May 2004 08:35:00 -0000 
*************** get_expr_operands (tree stmt, tree *expr 
*** 1023,1034 **** 
 
        if (bitmap_first_set_bit (call_clobbered_vars) >= 0) 
        { 
!         if (!(call_flags 
!               & (ECF_PURE 
!                  | ECF_CONST 
!                  | ECF_NORETURN 
!                  | ECF_MALLOC 
!                  | ECF_MAY_BE_ALLOCA))) 
            add_call_clobber_ops (stmt, prev_vops); 
          else if (!(call_flags & (ECF_CONST | ECF_NORETURN))) 
            add_call_read_ops (stmt, prev_vops); 
--- 1023,1032 ---- 
 
        if (bitmap_first_set_bit (call_clobbered_vars) >= 0) 
        { 
!         /* A 'pure' or a 'const' functions never call clobber anything. 
!            A 'noreturn' function might, but since we don't return anyway 
!            there is no point in recording that.  */ 
!         if (!(call_flags & (ECF_PURE | ECF_CONST | ECF_NORETURN))) 
            add_call_clobber_ops (stmt, prev_vops); 
          else if (!(call_flags & (ECF_CONST | ECF_NORETURN))) 
            add_call_read_ops (stmt, prev_vops); 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-05-17 17:19 -------
diego loves alias bugs ;-) 

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|dnovillo at redhat dot com  |
         AssignedTo|unassigned at gcc dot gnu   |dnovillo at gcc dot gnu dot
                   |dot org                     |org
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[dnovillo at redhat dot com]

------- Additional Comments From dnovillo at redhat dot com  2004-05-17 18:25 -------
Subject: Re:  [3.5 Regression] miscompilation
	with attribute (__malloc__)

On Mon, 2004-05-17 at 04:10, steven at gcc dot gnu dot org wrote:
> ------- Additional Comments From steven at gcc dot gnu dot org  2004-05-17 08:10 -------
> Simpler test case: 
> ==================================== 
> int a; 
>  
> void __attribute__ ((malloc)) *foo () 
> { 
>   a = 0; 
> } 
>  
> void bar (void) 
> { 
>   a = 1; 
>   foo (); 
>   if (a) 
>     abort (); 
> } 
> ==================================== 
>  
> --> 
> bar () 
> { 
>   int<D0> a.0<D1457>; 
>  
>   #   a<D1451>_2 = VDEF <a<D1451>_1>; 
>   a<D1451> = 1; 
>   #   VUSE <a<D1451>_2>; 
>   foo (); 
>   abort (); 
> } 
>  
The patch in comment #10 is OK.

I had added a call to ignore ECF_MALLOC in the big alias re-write
(http://gcc.gnu.org/ml/gcc-patches/2004-02/msg00891.html).  I offer no
reasonable explanation for the change, so I guess the lack of test cases
in the testsuite allowed that brain fart to slip in.

Could you also add this test case to the testsuite?


Thanks.  Diego.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438

[Bug tree-optimization/15438] [3.5 Regression] miscompilation with attribute (__malloc__)

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2004-05-26 10:42 -------
Fixed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15438