public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug target/102107] New: protocol register (r12) corrupted before a tail call
@ 2021-08-27 20:54 pc at us dot ibm.com
  2021-08-27 21:01 ` [Bug target/102107] " pc at us dot ibm.com
                   ` (22 more replies)
  0 siblings, 23 replies; 24+ messages in thread
From: pc at us dot ibm.com @ 2021-08-27 20:54 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102107

            Bug ID: 102107
           Summary: protocol register (r12) corrupted before a tail call
           Product: gcc
           Version: 11.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: pc at us dot ibm.com
  Target Milestone: ---

Created attachment 51367
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51367&action=edit
preprocessed source (large)

I've been working on an effort to improve Python performance, and hit an issue
when running with a libpython.so that was built with "-mcpu=power10". The
problem appears to be not correctly setting up (and preserving) register 12
before calling into a dynamically loaded, non-PCrel Python module in the form
of a shared object.

GDB shows the following instruction stream:
=> 0x7ffff7d25014 <do_mkvalue+1924>:    ld      r12,0(r9)
=> 0x7ffff7d25018 <do_mkvalue+1928>:    addi    r1,r1,112
r12            0x7fffe921af60      140737104686944
=> 0x7ffff7d2501c <do_mkvalue+1932>:    std     r10,0(r30)
=> 0x7ffff7d25020 <do_mkvalue+1936>:    ld      r3,8(r9)
=> 0x7ffff7d25024 <do_mkvalue+1940>:    ld      r9,0(r31)
=> 0x7ffff7d25028 <do_mkvalue+1944>:    ld      r29,-24(r1)
=> 0x7ffff7d2502c <do_mkvalue+1948>:    ld      r30,-16(r1)
=> 0x7ffff7d25030 <do_mkvalue+1952>:    mtctr   r12
=> 0x7ffff7d25034 <do_mkvalue+1956>:    lwz     r12,8(r1)
r12            0x4000              16384
=> 0x7ffff7d25038 <do_mkvalue+1960>:    addi    r9,r9,1
=> 0x7ffff7d2503c <do_mkvalue+1964>:    std     r9,0(r31)
=> 0x7ffff7d25040 <do_mkvalue+1968>:    ld      r31,-8(r1)
=> 0x7ffff7d25044 <do_mkvalue+1972>:    mtocrf  8,r12
=> 0x7ffff7d25048 <do_mkvalue+1976>:    bctr
=> 0x7fffe921af60 <return_none>:        addis   r2,r12,4  
=> 0x7fffe921af64 <return_none+4>:      addi    r2,r2,-12384
=> 0x7fffe921af68 <return_none+8>:      nop
=> 0x7fffe921af6c <return_none+12>:     ld      r3,-32728(r2)
Program received signal SIGSEGV, Segmentation fault.
0x00007fffe921af6c in _Py_INCREF (op=<optimized out>) at
../Python-3.9.6/Include/object.h:408
408         op->ob_refcnt++;

After setting r12 to the address of the caller (0x7ffff7d25014), the load at
0x7ffff7d25034 overwrites it with the CR save value just before the tail call
(bctr) at 0x7ffff7d25048, resulting in the badness when setting up and using
the TOC.

I suspect some sort of instruction scheduling issue?

I've attached a rather large pre-processed C file. It's complicated to reduce
because of functions calling other functions. I gave "creduce" a shot at it,
but it's challenging (for me, at least) to craft a script that knows what to
look for. I'll also attach the best I could get from creduce, but shield your
eyes before looking at it.

^ permalink raw reply	[flat|nested] 24+ messages in thread
end of thread, other threads:[~2021-09-27 22:26 UTC | newest]

Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-27 20:54 [Bug target/102107] New: protocol register (r12) corrupted before a tail call pc at us dot ibm.com
2021-08-27 21:01 ` [Bug target/102107] " pc at us dot ibm.com
2021-08-27 21:03 ` pc at us dot ibm.com
2021-08-28 21:56 ` pc at us dot ibm.com
2021-08-28 22:33 ` pc at us dot ibm.com
2021-08-30 16:24 ` pc at us dot ibm.com
2021-08-30 19:58 ` segher at gcc dot gnu.org
2021-08-30 20:19 ` wschmidt at gcc dot gnu.org
2021-08-30 20:42 ` pc at us dot ibm.com
2021-08-30 22:49 ` segher at gcc dot gnu.org
2021-08-30 23:42 ` segher at gcc dot gnu.org
2021-08-31 13:20 ` pc at us dot ibm.com
2021-08-31 15:22 ` segher at gcc dot gnu.org
2021-08-31 17:43 ` segher at gcc dot gnu.org
2021-09-01 17:50 ` segher at gcc dot gnu.org
2021-09-03 21:05 ` cvs-commit at gcc dot gnu.org
2021-09-03 21:08 ` segher at gcc dot gnu.org
2021-09-08 13:30 ` cvs-commit at gcc dot gnu.org
2021-09-21 23:45 ` cvs-commit at gcc dot gnu.org
2021-09-21 23:45 ` cvs-commit at gcc dot gnu.org
2021-09-21 23:47 ` cvs-commit at gcc dot gnu.org
2021-09-21 23:47 ` cvs-commit at gcc dot gnu.org
2021-09-21 23:53 ` segher at gcc dot gnu.org
2021-09-27 22:26 ` pc at us dot ibm.com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).