[Bug middle-end/103762] New: [12 Regression] glibc master branch is miscompiled by r12-897

[Bug middle-end/103762] New: [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

            Bug ID: 103762
           Summary: [12 Regression] glibc master branch is miscompiled by
                    r12-897
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: hjl.tools at gmail dot com
                CC: luoxhu at cn dot ibm.com
  Target Milestone: ---
            Target: x86-64

On x86-64, r12-897

commit de56f95afaaa22c67cbeec780921d63e8b34514e
Author: Xionghu Luo <luoxhu@linux.ibm.com>
Date:   Tue May 18 21:34:18 2021 -0500

    Run pass_sink_code once more before store_merging

    Gimple sink code pass runs quite early, there may be some new
    oppertunities exposed by later gimple optmization passes, this patch
    runs the sink code pass once more before store_merging.  For detailed
    discussion, please refer to:
    https://gcc.gnu.org/pipermail/gcc-patches/2020-December/562352.html

    Tested the SPEC2017 performance on P8LE, 544.nab_r is improved
    by 2.43%, but no big changes to other cases, GEOMEAN is improved quite
    small with 0.25%.

    gcc/ChangeLog:

    2021-05-18  Xionghu Luo  <luoxhu@linux.ibm.com>

            * passes.def: Add sink_code pass before store_merging.
            * tree-ssa-sink.c (pass_sink_code:clone): New.

    gcc/testsuite/ChangeLog:

    2021-05-18  Xionghu Luo  <luoxhu@linux.ibm.com>

            * gcc.dg/tree-ssa/ssa-sink-1.c: Adjust.
            * gcc.dg/tree-ssa/ssa-sink-2.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-3.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-4.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-5.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-6.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-7.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-8.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-9.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-10.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-13.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-14.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-16.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-17.c: Ditto.
            * gcc.dg/tree-ssa/ssa-sink-18.c: New.

miscompiled glibc master branch:

FAIL: elf/tst-env-setuid

[hjl@gnu-skx-1 build-x86_64-linux]$ env
GCONV_PATH=/export/build/gnu/tools-build/glibc-cet/build-x86_64-linux/iconvdata
LOCPATH=/export/build/gnu/tools-build/glibc-cet/build-x86_64-linux/localedata
LC_ALL=C MALLOC_CHECK_=2 MALLOC_MMAP_THRESHOLD_=4096 LD_HWCAP_MASK=0x1
/export/build/gnu/tools-build/glibc-test/build-x86_64-linux/elf/tst-env-setuid
Segmentation fault (core dumped)
[hjl@gnu-skx-1 build-x86_64-linux]$ 

(gdb) set env MALLOC_CHECK_=2
(gdb) r --direct
Starting program:
/export/build/gnu/tools-build/glibc-test/build-x86_64-linux/elf/tst-env-setuid
--direct

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f67053 in do_tunable_update_val (cur=cur@entry=0xffffefefe7f0,
valp=valp@entry=0x7fffffffdd38, minp=minp@entry=0x0, maxp=maxp@entry=0x0) at
dl-tunables.c:102
102       if (cur->type.type_code == TUNABLE_TYPE_STRING)
(gdb) bt
#0  0x00007ffff7f67053 in do_tunable_update_val (cur=cur@entry=0xffffefefe7f0, 
    valp=valp@entry=0x7fffffffdd38, minp=minp@entry=0x0, maxp=maxp@entry=0x0)
    at dl-tunables.c:102
#1  0x00007ffff7f6733c in tunable_initialize (strval=0x7fffffffefa7 "2", 
    cur=<optimized out>) at dl-tunables.c:151
#2  __tunables_init (envp=0x7fffffffe058) at dl-tunables.c:349
#3  0x00007ffff7f15f67 in __libc_start_main_impl (main=0x7ffff7f128f0 <main>, 
    argc=2, argv=0x7fffffffdea8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=0x0, stack_end=0x7fffffffde98) at ../csu/libc-start.c:291
#4  0x00007ffff7f129c5 in _start () at ../sysdeps/x86_64/start.S:115
(gdb)

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0
   Last reconfirmed|                            |2021-12-18
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
elf/dl-tunables.c is miscompiled by -fpie.

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

--- Comment #2 from H.J. Lu <hjl.tools at gmail dot com> ---
Good:

There are 16 section headers, starting at offset 0x21d8:

Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg
Lk Inf Al
  [ 0]                   NULL            0000000000000000 000000 000000 00     
0   0  0
  [ 1] .text             PROGBITS        0000000000000000 000040 00084d 00  AX 
0   0 16
  [ 2] .rela.text        RELA            0000000000000000 001d80 000348 18   I
13   1  8
  [ 3] .data             PROGBITS        0000000000000000 00088d 000000 00  WA 
0   0  1
  [ 4] .bss              NOBITS          0000000000000000 00088d 000000 00  WA 
0   0  1
  [ 5] .rodata.str1.1    PROGBITS        0000000000000000 00088d 000044 01 AMS 
0   0  1
  [ 6] .rodata.str1.8    PROGBITS        0000000000000000 0008d8 000070 01 AMS 
0   0  8
  [ 7] .data.rel.ro      PROGBITS        0000000000000000 000960 000f50 00  WA 
0   0 32
  [ 8] .comment          PROGBITS        0000000000000000 0018b0 00007e 01  MS 
0   0  1
  [ 9] .note.GNU-stack   PROGBITS        0000000000000000 00192e 000000 00     
0   0  1
  [10] .note.gnu.property NOTE            0000000000000000 001930 000050 00   A
 0   0  8
  [11] .eh_frame         PROGBITS        0000000000000000 001980 0000f0 00   A 
0   0  8
  [12] .rela.eh_frame    RELA            0000000000000000 0020c8 000078 18   I
13  11  8
  [13] .symtab           SYMTAB          0000000000000000 001a70 000228 18    
14  14  8
  [14] .strtab           STRTAB          0000000000000000 001c98 0000e4 00     
0   0  1
  [15] .shstrtab         STRTAB          0000000000000000 002140 000097 00     
0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  L (link order), O (extra OS processing required), G (group), T (TLS),
  C (compressed), x (unknown), o (OS specific), E (exclude),
  D (mbind), l (large), p (processor specific)

Bad:

There are 18 section headers, starting at offset 0x2208:

Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg
Lk Inf Al
  [ 0]                   NULL            0000000000000000 000000 000000 00     
0   0  0
  [ 1] .text             PROGBITS        0000000000000000 000040 00083d 00  AX 
0   0 16
  [ 2] .rela.text        RELA            0000000000000000 001d80 000348 18   I
15   1  8
  [ 3] .data             PROGBITS        0000000000000000 00087d 000000 00  WA 
0   0  1
  [ 4] .bss              NOBITS          0000000000000000 00087d 000000 00  WA 
0   0  1
  [ 5] .rodata.str1.1    PROGBITS        0000000000000000 00087d 000044 01 AMS 
0   0  1
  [ 6] .rodata.str1.8    PROGBITS        0000000000000000 0008c8 000070 01 AMS 
0   0  8
  [ 7] .data.rel.ro      PROGBITS        0000000000000000 000940 000f50 00  WA 
0   0 32
  [ 8] .data.rel.ro.local PROGBITS        0000000000000000 001890 000008 00  WA
 0   0  8
  [ 9] .rela.data.rel.ro.local RELA            0000000000000000 0020c8 000018
18   I 15   8  8
  [10] .comment          PROGBITS        0000000000000000 001898 00007e 01  MS 
0   0  1
  [11] .note.GNU-stack   PROGBITS        0000000000000000 001916 000000 00     
0   0  1
  [12] .note.gnu.property NOTE            0000000000000000 001918 000050 00   A
 0   0  8
  [13] .eh_frame         PROGBITS        0000000000000000 001968 0000f0 00   A 
0   0  8
  [14] .rela.eh_frame    RELA            0000000000000000 0020e0 000078 18   I
15  13  8
  [15] .symtab           SYMTAB          0000000000000000 001a58 000240 18    
16  15  8
  [16] .strtab           STRTAB          0000000000000000 001c98 0000e4 00     
0   0  1
  [17] .shstrtab         STRTAB          0000000000000000 002158 0000af 00     
0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  L (link order), O (extra OS processing required), G (group), T (TLS),
  C (compressed), x (unknown), o (OS specific), E (exclude),
  D (mbind), l (large), p (processor specific)

These

  [ 8] .data.rel.ro.local PROGBITS        0000000000000000 001890 000008 00  WA
 0   0  8
  [ 9] .rela.data.rel.ro.local RELA            0000000000000000 0020c8 000018
18   I 15   8  8

are only on bad elf/dl-tunables.o.

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> ---
Created attachment 52028
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52028&action=edit
A testcase

There are dl-tunables.i good.s bad.s.  Compiler options are

-std=gnu11 -fgnu89-inline  -O2 -g -Wall -Wwrite-strings -Wundef
-fmerge-all-constants -frounding-math -fno-stack-protector -fno-common
-Wstrict-prototypes -Wold-style-definition -fmath-errno    -fpie 
-fno-stack-protector -DSTACK_PROTECTOR_LEVEL=0 -fcf-protection
-fno-tree-loop-distribute-patterns  -ftls-model=initial-exec      -I../include
-I/export/build/gnu/tools-build/glibc-gitlab-test/build-x86_64-linux/elf 
-I/export/build/gnu/tools-build/glibc-gitlab-test/build-x86_64-linux 
-I../sysdeps/unix/sysv/linux/x86_64/64  -I../sysdeps/unix/sysv/linux/x86_64 
-I../sysdeps/unix/sysv/linux/x86/include -I../sysdeps/unix/sysv/linux/x86 
-I../sysdeps/x86/nptl  -I../sysdeps/unix/sysv/linux/wordsize-64 
-I../sysdeps/x86_64/nptl  -I../sysdeps/unix/sysv/linux/include
-I../sysdeps/unix/sysv/linux  -I../sysdeps/nptl  -I../sysdeps/pthread 
-I../sysdeps/gnu  -I../sysdeps/unix/inet  -I../sysdeps/unix/sysv 
-I../sysdeps/unix/x86_64  -I../sysdeps/unix  -I../sysdeps/posix 
-I../sysdeps/x86_64/64  -I../sysdeps/x86_64/fpu/multiarch 
-I../sysdeps/x86_64/fpu  -I../sysdeps/x86/fpu  -I../sysdeps/x86_64/multiarch 
-I../sysdeps/x86_64  -I../sysdeps/x86/include -I../sysdeps/x86 
-I../sysdeps/ieee754/float128  -I../sysdeps/ieee754/ldbl-96/include
-I../sysdeps/ieee754/ldbl-96  -I../sysdeps/ieee754/dbl-64 
-I../sysdeps/ieee754/flt-32  -I../sysdeps/wordsize-64  -I../sysdeps/ieee754 
-I../sysdeps/generic  -I.. -I../libio -I.  -D_LIBC_REENTRANT -include
/export/build/gnu/tools-build/glibc-gitlab-test/build-x86_64-linux/libc-modules.h
-DMODULE_NAME=libc -include ../include/libc-symbols.h  -DPIC 
-DTUNABLES_FRONTEND=TUNABLES_FRONTEND_yes   -DTOP_NAMESPACE=glibc

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> ---
Good __tunables_init code:

.L35:
        movq    $-88, %rax 
        leaq    tunable_list(%rip), %rbx 
        movq    %r8, %r12 
        subq    %rbx, %rax 
        movq    %rax, %r15 

Bad __tunables_init code:

.L34:
        movq    $-88, %rax 
        subq    .LC3(%rip), %rax 
        movq    %r8, %rbx 
        movq    %rax, 8(%rsp)
...
        .section        .data.rel.ro.local,"aw"
        .align 8
.LC3:
        .quad   tunable_list

The bad code requires run-time relocation and a memory load.  But this piece
of code is called from

  __tunables_init (__environ);

  ARCH_INIT_CPU_FEATURES (); 

  /* Do static pie self relocation after tunables and cpu features
     are setup for ifunc resolvers. Before this point relocations
     must be avoided.  */
  _dl_relocate_static_pie (); 

For __tunables_init isn't good for performance and fails to run before
static PIE has been relocated.

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ra

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> ---
LRA turns

(insn 370 325 371 2 (set (reg:DI 261)
        (const_int -88 [0xffffffffffffffa8])) "dl-tunables.c":264:15 76
{*movdi_internal}
     (expr_list:REG_EQUIV (const_int -88 [0xffffffffffffffa8])
        (nil)))
(insn 371 370 749 2 (parallel [
            (set (reg:DI 262)
                (minus:DI (reg:DI 261)
                    (reg/f:DI 259)))
            (clobber (reg:CC 17 flags))
        ]) "dl-tunables.c":264:15 299 {*subdi_1}
     (expr_list:REG_DEAD (reg:DI 261)
        (expr_list:REG_UNUSED (reg:CC 17 flags)
            (expr_list:REG_EQUIV (minus:DI (const_int -88 [0xffffffffffffffa8])
                    (symbol_ref:DI ("tunable_list") [flags 0x2]  <var_decl
0x7f7d6f7b1cf0 tunable_list>))
                (nil)))))

into

insn 370 325 371 2 (set (reg:DI 0 ax [261])
        (const_int -88 [0xffffffffffffffa8])) "dl-tunables.c":264:15 76
{*movdi_internal}
     (expr_list:REG_EQUIV (const_int -88 [0xffffffffffffffa8])
        (nil)))
(insn 371 370 966 2 (parallel [
            (set (reg:DI 0 ax [261])
                (minus:DI (reg:DI 0 ax [261])
                    (mem/u/c:DI (symbol_ref/u:DI ("*.LC2") [flags 0x2]) [0  S8
A64])))
            (clobber (reg:CC 17 flags))
        ]) "dl-tunables.c":264:15 299 {*subdi_1}
     (expr_list:REG_EQUIV (minus:DI (const_int -88 [0xffffffffffffffa8])
            (symbol_ref:DI ("tunable_list") [flags 0x2]  <var_decl
0x7f7d6f7b1cf0 tunable_list>))
        (nil)))

(symbol_ref/u:DI ("*.LC2") [flags 0x2]) requires run-time relocation.

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://sourceware.org/bugz
                   |                            |illa/show_bug.cgi?id=28712
         Resolution|---                         |MOVED
             Status|NEW                         |RESOLVED

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
Moved:

https://sourceware.org/bugzilla/show_bug.cgi?id=28712

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Why MOVED?
One thing is the relocation, that is perhaps something glibc needs to avoid in
whatever way it wants, but another one is that the indirection of memory with
relocated symbol as opposed to direct use of the (%rip) based symbol is slower,
and that is a GCC bug.

[Bug middle-end/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ubizjak at gmail dot com,
                   |                            |vmakarov at redhat dot com
             Status|RESOLVED                    |REOPENED
         Resolution|MOVED                       |---

--- Comment #8 from H.J. Lu <hjl.tools at gmail dot com> ---
I am working on the glibc patch to work around this GCC bug.  It will be
nice to fix it in GCC.

[Bug rtl-optimization/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[fw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

Florian Weimer <fw at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fw at gcc dot gnu.org

--- Comment #9 from Florian Weimer <fw at gcc dot gnu.org> ---
glibc cannot easily work around such unexpected relocations for static or
hidden variables. Static PIE currently requires PI_STATIC_AND_HIDDEN, and with
the GCC 12 behavior, x86 would not be a PI_STATIC_AND_HIDDEN target anymore.
This really has to be fixed in GCC. It's also important to avoid such runtime
relocations for PIE startup time.

[Bug rtl-optimization/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

--- Comment #10 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Florian Weimer from comment #9)
> glibc cannot easily work around such unexpected relocations for static or
> hidden variables. Static PIE currently requires PI_STATIC_AND_HIDDEN, and
> with the GCC 12 behavior, x86 would not be a PI_STATIC_AND_HIDDEN target
> anymore. This really has to be fixed in GCC. It's also important to avoid
> such runtime relocations for PIE startup time.

RA should avoid runtime relocations against static symbol for PIC/PIE,
which is also good for performance.

[Bug target/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2021-Decembe
                   |                            |r/587164.html
          Component|rtl-optimization            |target
           Keywords|                            |patch
             Status|REOPENED                    |NEW

--- Comment #11 from H.J. Lu <hjl.tools at gmail dot com> ---
This is a latent bug on ix86.  Many integer patterns has the 'm' constraint
on x86_64_general_operand which different from general_operand for 64-bit
target.  As the result, LRA may pick a memory operand which satisfies
general_operand, doesn't satisfies x86_64_general_operand.

A patch is posted at

https://gcc.gnu.org/pipermail/gcc-patches/2021-December/587164.html

[Bug target/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by H.J. Lu <hjl@gcc.gnu.org>:

https://gcc.gnu.org/g:9407058a430316db5299bc7867e4a31f900cd197

commit r12-6122-g9407058a430316db5299bc7867e4a31f900cd197
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Sun Dec 19 08:47:03 2021 -0800

    ix86: Don't use the 'm' constraint for x86_64_general_operand

    The 'm' constraint is defined with define_memory_constraint which allows
    LRA to convert the operand to the form '(mem (reg X))', where X is a
    base register.  To prevent LRA from generating '(mem (reg X))' from a
    register:

    1. Add a 'BM' constraint which is similar to the 'm' constraint, but
    is defined with define_constraint.
    2. Add a 'm' mode attribute which is mapped to the 'm' constraint for
    general_operand and the 'BM' constraint for x86_64_general_operand.
    3. Replace the 'm' constraint on <general_operand> with the '<m>'
    constraint.
    4. Replace the 'm' constraint on x86_64_general_operand with the 'BM'
    constraint.

    gcc/

            PR target/103762
            * config/i386/constraints.md (BM): New constraint.
            * config/i386/i386.md (m): New mode attribute.
            Replace the 'm' constraint on <general_operand> with the '<m>'
            constraint.
            Replace the 'm' constraint on x86_64_general_operand with the
            'BM' constraint.

    gcc/testsuite/

            * gcc.target/i386/pr103762-1a.c: New test.
            * gcc.target/i386/pr103762-1b.c: Likewise.
            * gcc.target/i386/pr103762-1c.c: Likewise.

[Bug target/103762] [12 Regression] glibc master branch is miscompiled by r12-897

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103762

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #13 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed.