[Bug libgcc/114755] New: wrong code with _BitInt() modulo at -O0 on aarch64

[Bug libgcc/114755] New: wrong code with _BitInt() modulo at -O0 on aarch64

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114755

            Bug ID: 114755
           Summary: wrong code with _BitInt() modulo at -O0 on aarch64
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: libgcc
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
                CC: jakub at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: aarch64-unknown-linux-gnu

Created attachment 57973
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57973&action=edit
reduced testcase

Output:
$ aarch64-unknown-linux-gnu-gcc testcase.c -O0 -static
$ qemu-aarch64 -- ./a.out 
qemu: uncaught target signal 6 (Aborted) - core dumped
Aborted

$ aarch64-unknown-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-aarch64/bin/aarch64-unknown-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-10007-20240417161722-g57056146f4f-checking-yes-rtl-df-extra-aarch64/bin/../libexec/gcc/aarch64-unknown-linux-gnu/14.0.1/lto-wrapper
Target: aarch64-unknown-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl
--with-sysroot=/usr/aarch64-unknown-linux-gnu --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=aarch64-unknown-linux-gnu
--with-ld=/usr/bin/aarch64-unknown-linux-gnu-ld
--with-as=/usr/bin/aarch64-unknown-linux-gnu-as --enable-libsanitizer
--disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-10007-20240417161722-g57056146f4f-checking-yes-rtl-df-extra-aarch64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.1 20240417 (experimental) (GCC)

[Bug libgcc/114755] wrong code with _BitInt() modulo at -O0 on aarch64

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114755

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-04-17
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 57974
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57974&action=edit
gcc14-pr114755.patch

Lightly tested fix so far.
In these problematic cases, we ended up after negation with 0 as most
significant limb of v2 and used __builtin_clz* on that.  On x86_64 that
returned 64 and kind of worked right after triggering UB several times, but on
aarch64 it returned 63 and misbehaved with the result.

[Bug libgcc/114755] wrong code with _BitInt() modulo at -O0 on aarch64

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114755

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:82d6d385f9708fb6d5e2a2bacd003155cfc41c08

commit r14-10013-g82d6d385f9708fb6d5e2a2bacd003155cfc41c08
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Apr 18 09:49:02 2024 +0200

    libgcc: Fix up __divmodbitint4 [PR114755]

    The following testcase aborts on aarch64-linux but does not on
x86_64-linux.
    In both cases there is UB in the __divmodbitint4 implemenetation.
    When the divisor is negative with most significant limb (even when partial)
    all ones, has at least 2 limbs and the second most significant limb has the
    most significant bit clear, when this number is negated, it will have 0
    in the most significant limb.
    Already in the PR114397 r14-9592 fix I was dealing with such divisors, but
    thought the problem is only if because of that un < vn doesn't imply the
    quotient is 0 and remainder u.
    But as this testcase shows, the problem is with such divisors always.
    What happens is that we use __builtin_clz* on the most significant limb,
    and assume it will not be 0 because that is UB for the builtins.
    Normally the most significant limb of the divisor shouldn't be 0, as
    guaranteed by the bitint_reduce_prec e.g. for the positive numbers, unless
    the divisor is just 0 (but for vn == 1 we have special cases).

    The following patch moves the handling of this corner case a few lines
    earlier before the un < vn check, because adjusting the vn later is harder.

    2024-04-18  Jakub Jelinek  <jakub@redhat.com>

            PR libgcc/114755
            * libgcc2.c (__divmodbitint4): Perform the decrement on negative
            v with most significant limb all ones and the second least
            significant limb with most significant bit clear always, regardless
of
            un < vn.

            * gcc.dg/torture/bitint-69.c: New test.

[Bug libgcc/114755] wrong code with _BitInt() modulo at -O0 on aarch64

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114755

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Should be fixed now.