[Bug c++/36115] New: wrong code generated with optimization on x86-64

[Bug c++/36115] New: wrong code generated with optimization on x86-64

[brett dot polivka at magnetar dot com]

This small program:

// built using g++ -o test -O2 main.cpp

#include <iostream>

struct stuff
{
    int x;
};

class MyException : public std::exception
{
  public:

    MyException() { }
};

// make this global so conditional below doesn't get eliminated
bool should_throw = false;

void calc_x(stuff& s, int n)
{
    // set s.x to max(s.x, n, 2)
    s.x = std::max(n, s.x);
    s.x = std::max(2, s.x);

    // bogus throw needed to generate error
    if(should_throw)
    {
        // throw MyException() won't trigger bug - must be separate lines
        // also, something like std::runtime_error won't trigger either
        MyException ex;
        throw ex;
    }
}

int main(int argc, char* argv[])
{
    stuff s = { 0 };

    int n = atoi(argv[1]);

    calc_x(s, n);

    std::cout << s.x << "\n";
    std::cout << (s.x == n ? "SUCCESS" : "FAILURE") << "\n";
}

will fail when passed any value greater than 2.

calc_x should be returning the maximum of s.x, n and 2, but for values of n >
2, always returns the original value of s.x.

Output:
-------------
% ./test 0
2
% ./test 1
2
% ./test 2
2
% ./test 3
0


I've attempted to distill it to a smaller example than this, but eliminating
almost anything causes it to start functioning again.

Looking at the generated assembly, gcc is generating two conditional moves,
corresponding to the two std::max calls. In the bad code, the final move is
moving the address of s.x into a register, which then gets dereferenced and
assigned into s.x. However, the intermediate result of the first comparison was
not stored in s.x, but a scratch temporary on the stack. Therefore, s.x is
being dereferenced and assigned to itself.

        movl    %esi, 12(%rsp)   <--- tmp1 = n
        cmpl    (%rdi), %esi     <--- compare s.x and n
        leaq    12(%rsp), %rax   <--- rax = &tmp1
        cmovl   %rdi, %rax       <--- rax = &s if n < s.x
        movl    (%rax), %edx     <--- edx = *rax
        leaq    28(%rsp), %rax   <--- rax = &tmp2
        movl    $2, 28(%rsp)     <--- tmp2 = 2
        cmpl    $2, %edx
        cmovg   %rdi, %rax       <--- rax = &s.x (!!!) if edx > 2
        cmpb    $0, should_throw(%rip)
        movl    (%rax), %eax     <--- eax = *rax
        movl    %eax, (%rdi)     <--- s.x = eax

This is using gcc 4.2.3 as distributed with Ubuntu 8.04, however I've also
verified the same results using an unpatched gcc 4.2.3, as well as the latest
gcc-4_2-branch branch from subversion.

Thanks,
Brett Polivka

% g++ -v
Using built-in specs.
Target: x86_64-linux-gnu
Configured with: ../src/configure -v
--enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr
--enable-shared --with-system-zlib --libexecdir=/usr/lib
--without-included-gettext --enable-threads=posix --enable-nls
--with-gxx-include-dir=/usr/include/c++/4.2 --program-suffix=-4.2
--enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr
--enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu
--target=x86_64-linux-gnu
Thread model: posix
gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7)


-- 
           Summary: wrong code generated with optimization on x86-64
           Product: gcc
           Version: 4.2.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: brett dot polivka at magnetar dot com
 GCC build triplet: x86_64-linux-gnu
  GCC host triplet: x86_64-linux-gnu
GCC target triplet: x86_64-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115

[Bug c++/36115] wrong code generated with optimization on x86-64

[brett dot polivka at magnetar dot com]

------- Comment #1 from brett dot polivka at magnetar dot com  2008-05-02 22:31 -------
Created an attachment (id=15563)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=15563&action=view)
preprocessed output of test program


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115

[Bug c++/36115] wrong code generated with optimization on x86-64

[brett dot polivka at magnetar dot com]

-- 

brett dot polivka at magnetar dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |major
      Known to fail|                            |4.2.3
      Known to work|                            |4.1.3


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115

[Bug target/36115] wrong code generated with optimization on x86-64

[brett dot polivka at magnetar dot com]

------- Comment #2 from brett dot polivka at magnetar dot com  2008-05-02 22:37 -------
Created an attachment (id=15564)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=15564&action=view)
preprocessed output of test program

Previous version was from wrong code


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115

[Bug target/36115] wrong code generated with optimization on x86-64

[pinskia at gcc dot gnu dot org]

-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|major                       |normal
          Component|c++                         |target


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115

[Bug tree-optimization/36115] [4.2 Regression] wrong code generated with optimization on x86-64

[rguenth at gcc dot gnu dot org]

------- Comment #3 from rguenth at gcc dot gnu dot org  2008-05-03 09:32 -------
Confirmed.  On the tree level we get aliasing wrong again:

<bb 2>:
  #   VUSE <n_50>;
  D.30804_7 = n;
  #   VUSE <SMT.294_51>;
  D.30805_8 = s_3->x;
  if (D.30804_7 < D.30805_8) goto <L3>; else goto <L5>;

<L3>:;
  __b_9 = &s_3->x;

  # __b_2 = PHI <__b_9(3), &n(2)>;
<L5>:;
  #   VUSE <n_50>;
  #   VUSE <D.30570_14>;
  D.30813_12 = *__b_2;
  #   D.30570_15 = V_MUST_DEF <D.30570_14>;
  D.30570 = 2;
  if (D.30813_12 > 2) goto <L6>; else goto <L8>;

<L6>:;
  __b_20 = &s_3->x;

  # __b_1 = PHI <__b_20(5), &D.30570(4)>;
<L8>:;
  #   VUSE <n_50>;
  #   VUSE <D.30570_15>;
  D.30636_23 = *__b_1;

DSE deleted the intermediate store to s_3->x:

   #   VUSE <n_50>;
   #   VUSE <D.30570_14>;
   D.30813_12 = *__b_2;
-  #   SMT.294_52 = V_MAY_DEF <SMT.294_51>;
-  s_3->x = D.30813_12;
   #   D.30570_15 = V_MUST_DEF <D.30570_14>;
   D.30570 = 2;

thus, a workaround is -fno-tree-dse.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|target                      |tree-optimization
     Ever Confirmed|0                           |1
           Keywords|                            |alias, wrong-code
      Known to work|4.1.3                       |4.1.3 4.3.0
   Last reconfirmed|0000-00-00 00:00:00         |2008-05-03 09:32:16
               date|                            |
            Summary|wrong code generated with   |[4.2 Regression] wrong code
                   |optimization on x86-64      |generated with optimization
                   |                            |on x86-64
   Target Milestone|---                         |4.2.4


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115

[Bug tree-optimization/36115] [4.2 Regression] wrong code generated with optimization on x86-64

[jsm28 at gcc dot gnu dot org]

------- Comment #4 from jsm28 at gcc dot gnu dot org  2008-05-19 20:25 -------
4.2.4 is being released, changing milestones to 4.2.5.


-- 

jsm28 at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.2.4                       |4.2.5


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115

[Bug tree-optimization/36115] [4.2 Regression] wrong code generated with optimization on x86-64

[jsm28 at gcc dot gnu dot org]

------- Comment #5 from jsm28 at gcc dot gnu dot org  2009-03-31 15:37 -------
Closing 4.2 branch, fixed in 4.3.


-- 

jsm28 at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
      Known to fail|4.2.3                       |4.2.3 4.2.5
         Resolution|                            |FIXED
   Target Milestone|4.2.5                       |4.3.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36115