[Bug rtl-optimization/48181] New: [4.5/4.6/4.7 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[Bug rtl-optimization/48181] New: [4.5/4.6/4.7 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

           Summary: [4.5/4.6/4.7 Regression] wrong code with -O -fgcse
                    --param ira-max-conflict-table-size=0
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
                CC: jakub@gcc.gnu.org
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 23705
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=23705
reduced testcase

Output:
$ gcc -O -fgcse --param ira-max-conflict-table-size=0 testcase.c
$ valgrind -q ./a.out 
==11903== Invalid read of size 8
==11903==    at 0x4C2B44C: memcpy (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==11903==    by 0x400602: foo (testcase.c:47)
==11903==    by 0x4006AA: main (testcase.c:65)
==11903==  Address 0x38 is not stack'd, malloc'd or (recently) free'd

The way it crashes is similiar to PR48156:
...
    lea    rcx, [rsp+128]    # tmp126,
    cmp    QWORD PTR [rsp+8], 0    # %sfp,
    jne    .L11    #,
    mov    esi, r14d    #, qsize
    mov    rdi, rcx    #, tmp126
    call    bar    #
.L11:
    mov    rdx, r12    #, D.2735
    mov    rsi, rcx    #, tmp126 # -fno-gcse: lea rsi, [rsp+128]
    lea    rdi, [rsp+64]    #,
    call    memcpy    #
    mov    rdx, r12    #, D.2735
    mov    rsi, rcx    #, tmp126 # -fno-gcse: lea rsi, [rsp+128]
    lea    rdi, [rsp+32]    #,
    call    memcpy    #
...

both calls to memcpy() read rcx to set its parameters, but rcx is not preserved
across function call (changes either by call to bar(), or by first memcpy())

Tested revisions:
r171088 - fail
4.6 r170095 - fail
4.5 r170095 - fail
4.4 r170095 - OK

[Bug rtl-optimization/48181] [4.5/4.6/4.7 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.5.3

--- Comment #1 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-03-18 14:41:47 UTC ---
I suppose a more reasonable minimum value for this param makes sense ;)

[Bug rtl-optimization/48181] [4.5/4.6/4.7 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011.03.21 23:20:59
     Ever Confirmed|0                           |1

[Bug rtl-optimization/48181] [4.5/4.6/4.7 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug rtl-optimization/48181] [4.5/4.6/4.7 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.5.3                       |4.5.4

--- Comment #2 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-04-28 14:51:16 UTC ---
GCC 4.5.3 is being released, adjusting target milestone.

[Bug rtl-optimization/48181] [4.5/4.6/4.7/4.8 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.5.4                       |4.6.4

--- Comment #3 from Richard Guenther <rguenth at gcc dot gnu.org> 2012-07-02 11:07:41 UTC ---
The 4.5 branch is being closed, adjusting target milestone.

[Bug rtl-optimization/48181] [4.6/4.7/4.8 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-01-08 15:16:52 UTC ---
But then, won't the exact same issues potentially happen in very large
functions where ira_conflicts_p isn't also true, because the conflict table
would be too big?  I'd say zero MB conflict table is reasonable parameter
value, it says don't use the conflict table.  If table larger than the param
would be needed, no table is created at all.

[Bug rtl-optimization/48181] [4.6/4.7/4.8 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[steven at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hjl.tools at gmail dot com,
                   |                            |steven at gcc dot gnu.org

--- Comment #5 from Steven Bosscher <steven at gcc dot gnu.org> 2013-01-16 22:48:49 UTC ---
(In reply to comment #4)
> But then, won't the exact same issues potentially happen in very large
> functions where ira_conflicts_p isn't also true, because the conflict table
> would be too big?

Yup. 0 is a valid value for the parameter, just exposing a bug somewhere
else.

FWIW I can't reproduce the problem with trunk.  I see rcx being saved
and restored around the calls, e.g.:

        movq    %rcx, (%rsp)
        call    bar
        movq    (%rsp), %rcx

and likewise around the second memcpy.  Unfortunately (an old) valgrind
on gcc17 doesn't work with with "valgrind -q ./a.out" as in comment #0.

It'd be interesting if and when this PR got fixed. HJ, is this something
you can bisect?

[Bug rtl-optimization/48181] [4.6/4.7/4.8 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-01-16 23:07:19 UTC ---
http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=192719
fixed this (so, most likely reproduceable by disabling LRA).

[Bug rtl-optimization/48181] [4.7/4.8/4.9 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.6.4                       |4.7.4

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-12 15:16:42 UTC ---
GCC 4.6.4 has been released and the branch has been closed.

[Bug rtl-optimization/48181] [4.7/4.8/4.9/4.10 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.7.4                       |4.8.4

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
The 4.7 branch is being closed, moving target milestone to 4.8.4.

[Bug rtl-optimization/48181] [4.8/4.9/5 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.8.4                       |4.8.5

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 4.8.4 has been released.

[Bug rtl-optimization/48181] [4.8/4.9 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[steven at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Steven Bosscher <steven at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[4.8/4.9/5 Regression]      |[4.8/4.9 Regression] wrong
                   |wrong code with -O -fgcse   |code with -O -fgcse --param
                   |--param                     |ira-max-conflict-table-size
                   |ira-max-conflict-table-size |=0
                   |=0                          |

--- Comment #10 from Steven Bosscher <steven at gcc dot gnu.org> ---
Not a GCC5 regression. Disabling LRA isn't possible.
Anyway, if disabling LRA would make this bug resurface then it's more likely a
reload (or reload<->IRA interaction) issue than something in IRA.

[Bug rtl-optimization/48181] [4.8/4.9 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[bernhard.kaindl at thalesgroup dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Bernhard Kaindl <bernhard.kaindl at thalesgroup dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bernhard.kaindl@thalesgroup
                   |                            |.com

--- Comment #11 from Bernhard Kaindl <bernhard.kaindl at thalesgroup dot com> ---
Checked what Steven Bosscher said in comment #5 and what I understood from
Comment 6 that LRA fixed this issue:

> FWIW I can't reproduce the problem with trunk.  I see rcx being saved
> and restored around the calls, e.g.:
> 
>         movq    %rcx, (%rsp)
>         call    bar
>         movq    (%rsp), %rcx
> 
> and likewise around the second memcpy.  Unfortunately (an old) valgrind
> on gcc17 doesn't work with with "valgrind -q ./a.out" as in comment #0.

> http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=192719
> fixed this (so, most likely reproduceable by disabling LRA).

Indeed, gcc-4.8.4 and gcc-4.9.2 save and restore rcx as described,
valgrind-3.10.1 (current release) does not show an error,
and program does not crash at all.

So affected are only gcc-4.5, 4.6 and 4.7,
and only with --param ira-max-conflict-table-size=0 & -fgcse active.

[Bug rtl-optimization/48181] [4.8/4.9 Regression] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[bernhard.kaindl at thalesgroup dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

--- Comment #12 from Bernhard Kaindl <bernhard.kaindl at thalesgroup dot com> ---
x86 has no -fno-lra / -mno-lra flag in gcc-4.8.4 and 4.9.2,
so these compilers they can't show this issue.

Thus, the tag [4.8/4.9 Regression] does not apply and should be changed to
[4.5/4.6 regression].

Since 4.5 and 4.6 are closed, this should then be closed with verified/wontfix.

[Bug rtl-optimization/48181] wrong code with -O -fgcse --param ira-max-conflict-table-size=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48181

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
      Known to work|                            |4.8.0
         Resolution|---                         |FIXED
   Target Milestone|4.8.5                       |4.8.0
            Summary|[4.8/4.9 Regression] wrong  |wrong code with -O -fgcse
                   |code with -O -fgcse --param |--param
                   |ira-max-conflict-table-size |ira-max-conflict-table-size
                   |=0                          |=0

--- Comment #13 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.