From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 05978385841C; Tue, 9 Apr 2024 15:32:42 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 05978385841C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1712676763; bh=K9dFC4F66zD8el5FaZYn4Lygr1K4xmwA8Dw1PsgXVhs=; h=From:To:Subject:Date:From; b=wiRNH/JTsHWs5e+UOoowbx7qn0XIzrxb2Ezp8EnPy3/IdLiBD4UsZ+rClnNflMYzc upa5SXJ9bJaP8ng8eSnAnN2hv7uqEUSDLmv3y5aDOOBq7NClwxw9g2RY9SWSpkYPNd hGif2L+N+6ax7O2wyi42C/oRX9x8snjvAir1oLzw= From: "bruno at clisp dot org" To: gcc-bugs@gcc.gnu.org Subject: [Bug c/114659] New: gcc miscompiles a __builtin_memcpy on i386, leading to wrong results for SNaN Date: Tue, 09 Apr 2024 15:32:40 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: c X-Bugzilla-Version: 13.2.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: bruno at clisp dot org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D114659 Bug ID: 114659 Summary: gcc miscompiles a __builtin_memcpy on i386, leading to wrong results for SNaN Product: gcc Version: 13.2.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c Assignee: unassigned at gcc dot gnu.org Reporter: bruno at clisp dot org Target Milestone: --- Created attachment 57912 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=3D57912&action=3Dedit test case tf.c In the two attached test cases, gcc miscompiles a __builtin_memcpy invocati= on. In the first test case, the data type is a 'float' (4 bytes). In the second test case, the data type is a 'double' (8 bytes). A value of this data type exists in memory, given as *x and *y. A modified copy of this value, convert_snan_to_qnan(value), exists also in the stack, among the local variables. gcc implements the __builtin_memcpy operation by accessing convert_snan_to_qnan(value) instead of the original value. How to reproduce: $ gcc-version 13.2.0 -m32 -Wall tf.c $ ./a.out ; echo $? 0 $ gcc-version 13.2.0 -m32 -Wall -O2 tf.c $ ./a.out ; echo $? 1 $ gcc-version 13.2.0 -m32 -Wall td.c $ ./a.out ; echo $? 0 $ gcc-version 13.2.0 -m32 -Wall -O2 td.c $ ./a.out ; echo $? 1 Analysis: $ gcc-version 13.2.0 -m32 -Wall -O2 -S tf.c tf.c has this function: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D int my_totalorderf (float const *x, float const *y) { int xs =3D __builtin_signbit (*x); int ys =3D __builtin_signbit (*y); if (!xs !=3D !ys) return xs; int xn =3D __builtin_isnan (*x); int yn =3D __builtin_isnan (*y); if (!xn !=3D !yn) return !xn =3D=3D !xs; if (!xn) return *x <=3D *y; unsigned int extended_sign =3D -!!xs; union { unsigned int i; float f; } xu =3D {0}, yu =3D {0}; __builtin_memcpy (&xu.f, x, sizeof (float)); __builtin_memcpy (&yu.f, y, sizeof (float)); return (xu.i ^ extended_sign) <=3D (yu.i ^ extended_sign); } =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D tf.s looks like this: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D my_totalorderf: pushl %ebx subl $8, %esp ;; int xs =3D __builtin_signbit (*x); movl 16(%esp), %eax flds (%eax) fsts (%esp) ;; [%esp+0] :=3D convert_snan_to_qnan= (*x) fxam fnstsw %ax movl %eax, %edx movl 20(%esp), %eax andl $512, %edx ;; int ys =3D __builtin_signbit (*y); flds (%eax) sete %cl fsts 4(%esp) ;; [%esp+4] :=3D convert_snan_to_qnan= (*y) fxam fnstsw %ax testb $2, %ah sete %al ;; if (!xs !=3D !ys) cmpb %al, %cl jne .L12 ;; int xn =3D __builtin_isnan (*x); fxch %st(1) fucomi %st(0), %st fxch %st(1) setnp %bl ;; int yn =3D __builtin_isnan (*y); fucomip %st(0), %st setnp %al ;; if (!xn !=3D !yn) cmpb %al, %bl jne .L11 fstp %st(0) flds (%esp) fucomi %st(0), %st jp .L9 flds 4(%esp) xorl %edx, %edx fcomip %st(1), %st fstp %st(0) setnb %dl jmp .L6 .p2align 4,,10 .p2align 3 .L12: fstp %st(0) fstp %st(0) .L6: addl $8, %esp movl %edx, %eax popl %ebx ret .p2align 4,,10 .p2align 3 .L11: fucomip %st(0), %st setp %dl addl $8, %esp xorl %ecx, %edx popl %ebx movzbl %dl, %edx movl %edx, %eax ret .p2align 4,,10 .p2align 3 .L9: fstp %st(0) negl %edx ;; computes -xs movl (%esp), %eax ;; fetches convert_snan_to_qnan(*x) instead of *x movl 4(%esp), %ebx ;; fetches convert_snan_to_qnan(*y) instead of *y sbbl %edx, %edx ;; computes extended_sign =3D -!!xs; xorl %edx, %eax ;; computes (xu.i ^ extended_sign) xorl %ebx, %edx ;; computes (yu.i ^ extended_sign) cmpl %eax, %edx ;; compares (xu.i ^ extended_sign) and (xu.i ^ extended_sign) setnb %dl movzbl %dl, %edx jmp .L6 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D As you can see, (%esp) and 4(%esp) contain *not* the original *x and *y respectively, but the result of an flds/fsts instruction pair, that is, convert_snan_to_qnan(*x) and convert_snan_to_qnan(*y), respectivel= y. See https://lists.gnu.org/archive/html/bug-gnulib/2023-10/msg00060.html for some background about these instructions on i386. The analysis of td.c is similar; here the value is stored to memory through an fldl/fstl pair.=