[Bug target/50341] New: calls via function pointer wrongly scheduled giving invalid TOC pointer

[Bug target/50341] New: calls via function pointer wrongly scheduled giving invalid TOC pointer

[amodra at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50341

             Bug #: 50341
           Summary: calls via function pointer wrongly scheduled giving
                    invalid TOC pointer
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: amodra@gmail.com


-mcmodel=medium and -mcmodel=large code containing calls via function pointer
may schedule code in the indirect call sequence such that the load of r2 for
the indirect call precedes instructions using r2.

[Bug target/50341] calls via function pointer wrongly scheduled giving invalid TOC pointer

[amodra at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50341

Alan Modra <amodra at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2011-09-09
         AssignedTo|unassigned at gcc dot       |amodra at gmail dot com
                   |gnu.org                     |
     Ever Confirmed|0                           |1

--- Comment #1 from Alan Modra <amodra at gmail dot com> 2011-09-09 13:01:36 UTC ---
Created attachment 25233
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25233
testcase extracted from qemu

compile with -m64 -O2, look before bctrl instructions in resulting assembly.

[Bug target/50341] calls via function pointer wrongly scheduled giving invalid TOC pointer

[meissner at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50341

--- Comment #2 from Michael Meissner <meissner at gcc dot gnu.org> 2011-09-09 20:51:23 UTC ---
Author: meissner
Date: Fri Sep  9 20:51:18 2011
New Revision: 178740

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=178740
Log:
Branch for bug 50341

Added:
    branches/ibm/gcc-4_7-pr50341/
      - copied from r178641, trunk/

[Bug target/50341] calls via function pointer wrongly scheduled giving invalid TOC pointer

[meissner at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50341

Michael Meissner <meissner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |meissner at gcc dot gnu.org

--- Comment #3 from Michael Meissner <meissner at gcc dot gnu.org> 2011-09-15 18:32:45 UTC ---
>From the example in the bug, it is the 3rd cpu_fprintf, where it decides to
move loading up an address into register 27, and move the load of the address
before the call, since register 27 is preserved across calls.

void cpu_dump_state (struct CPUPPCState *env, FILE *f, fprintf_function
cpu_fprintf,
                     int flags)
{



    int i;

    cpu_fprintf(f, "NIP " "%016" "l" "x" "   LR " "%016" "l" "x" " CTR "
                "%016" "l" "x" " XER " "%016" "l" "x" "\n",
                env->nip, env->lr, env->ctr, env->xer);
    cpu_fprintf(f, "MSR " "%016" "l" "x" " HID0 " "%016" "l" "x" "  HF "
                "%016" "l" "x" " idx %d\n", env->msr, env->spr[(0x3F0)],
                env->hflags, env->mmu_idx);

    cpu_fprintf(f, "TB %08" "u" " %08" "l" "u"

                " DECR %08" "u"

                "\n",
                cpu_ppc_load_tbu(env), cpu_ppc_load_tbl(env)

                , cpu_ppc_load_decr(env)

                );

These are the insns that are moved before the call:

(insn 1105 153 203 2 (set (reg/f:DI 27 27 [603])
        (const:DI (plus:DI (reg:DI 2 2)
                (high:DI (const:DI (unspec:DI [
                                (symbol_ref/f:DI ("*.LC5") [flags 0x82] 
<var_decl 0xfff931e6360 *.LC5>)
                            ] UNSPEC_TOCREL)))))) 513 {largetoc_high}
     (expr_list:REG_EQUIV (const:DI (plus:DI (reg:DI 2 2)
                (high:DI (const:DI (unspec:DI [
                                (symbol_ref/f:DI ("*.LC5") [flags 0x82] 
<var_decl 0xfff931e6360 *.LC5>)
                            ] UNSPEC_TOCREL)))))
        (nil)))

(insn 1107 161 204 2 (set (reg/f:DI 27 27 [601])
        (lo_sum:DI (reg/f:DI 27 27 [603])
            (const:DI (unspec:DI [
                        (symbol_ref/f:DI ("*.LC5") [flags 0x82]  <var_decl
0xfff931e6360 *.LC5>)
                    ] UNSPEC_TOCREL)))) 514 {largetoc_low}
     (expr_list:REG_EQUIV (symbol_ref/f:DI ("*.LC5") [flags 0x82]  <var_decl
0xfff931e6360 *.LC5>)
        (nil)))

The RTL logic is not looking into the const.

This is triggered by Alan's patch in June:

2011-06-20  Alan Modra  <amodra@gmail.com>

    * config/rs6000/rs6000.c (create_TOC_reference): Wrap high part
    of toc-relative address in CONST.
    (rs6000_delegitimize_address): Recognize changed address.
    (rs6000_legitimize_reload_address): Likewise.
    (rs6000_emit_move): Don't force these constants to memory.
    * config/rs6000/rs6000.md (tls_gd, tls_gd_high): Wrap high part of
    toc-relative address in CONST.
    (tls_ld, tls_ld_high, tls_got_dtprel, tls_got_dtprel_high): Likewise.
    (tls_got_tprel, tls_got_tprel_high, largetoc_high): Likewise.

Now, I anticipate that the patch in 4.7 will be temporary until we are
confident that we have the right solution, but it is better to put a bandaid on
the patch to limit the damage.

[Bug target/50341] calls via function pointer wrongly scheduled giving invalid TOC pointer

[meissner at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50341

--- Comment #4 from Michael Meissner <meissner at gcc dot gnu.org> 2011-09-15 18:34:11 UTC ---
Created attachment 25295
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25295
Patch for GCC 4.6 that disables the split of the load of the new TOC

[Bug target/50341] calls via function pointer wrongly scheduled giving invalid TOC pointer

[meissner at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50341

--- Comment #5 from Michael Meissner <meissner at gcc dot gnu.org> 2011-09-15 18:34:44 UTC ---
Created attachment 25296
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25296
Patch for GCC 4.7 that disables the split of the load of the new TOC

[Bug target/50341] calls via function pointer wrongly scheduled giving invalid TOC pointer

[meissner at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50341

Michael Meissner <meissner at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from Michael Meissner <meissner at gcc dot gnu.org> 2011-09-19 17:08:47 UTC ---
Patch applied to trunk and GCC 4.6 branches not to split the load of the new
TOC and the call.  If we want to fix the underlying cause of the HIGH/LO_SUM
not being optimized so the split can be re-enabled, reopen the bug.