[Bug libstdc++/51667] New: [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[Bug libstdc++/51667] New: [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

             Bug #: 51667
           Summary: [4.7 Regression] new FAIL: 27_io/basic_*stream/*
                    execution test with -m32
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: dominiq@lps.ens.fr
                CC: hjl.tools@gmail.com, iains@gcc.gnu.org,
                    rth@gcc.gnu.org, ubizjak@gmail.com
              Host: *86*-*-*
            Target: *86*-*-*
             Build: *86*-*-*


Between revisions 182603 (OK) and 182605 the following tests have started to
fail on *86*-*-* in 32 bit mode:

Running target unix/-m32
FAIL: 27_io/basic_istream/extractors_arithmetic/char/dr696.cc execution test
FAIL: 27_io/basic_istream/extractors_arithmetic/wchar_t/dr696.cc execution test
FAIL: 27_io/basic_ostream/inserters_arithmetic/char/7.cc execution test
FAIL: 27_io/basic_ostream/inserters_arithmetic/wchar_t/7.cc execution test

[Bug libstdc++/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011-12-23
     Ever Confirmed|0                           |1

--- Comment #1 from Dominique d'Humieres <dominiq at lps dot ens.fr> 2011-12-23 16:48:07 UTC ---
>From http://gcc.gnu.org/ml/gcc-regression/2011-12/msg00543.html this pr has
been caused/exposed by revision 182605.

[Bug libstdc++/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

Uros Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ebotcazou at gcc dot
                   |                            |gnu.org, tocarip.intel at
                   |                            |gmail dot com
         Depends on|                            |50038
   Target Milestone|---                         |4.7.0

--- Comment #2 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-23 18:05:07 UTC ---
Something is wrong with new REE pass. CCs added.

[Bug libstdc++/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #3 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 08:00:38 UTC ---
Following testcase shows the problem in libstdc++:

--cut here--
#include <iostream>
#include <sstream>
#include <cassert>

void test01()
{
  using namespace std;

  stringstream ostr1;

  ostr1.setf(ios_base::oct);
  ostr1.setf(ios_base::hex);

  short s = -1;
  ostr1 << s;

  cout << "result: " << ostr1.str() << endl;

  assert( ostr1.str() == "-1" );
}

int main()
{
  test01();
  return 0;
}
--cut here--

[uros@localhost test]$ ./a.out
result: 65535
a.out: 7.cc:19: void test01(): Assertion `ostr1.str() == "-1"' failed.
Aborted

Sign-extension from short is missing somewhere.

[Bug libstdc++/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #4 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-12-24 10:17:00 UTC ---
Note that the library code for this is very old and didn't change lately. I'll
have a look but a compiler issue seems much more likely.

[Bug tree-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libstdc++                   |tree-optimization

--- Comment #5 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-12-24 10:44:55 UTC ---
Ah now I see you already identified a pass.

[Bug tree-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #6 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2011-12-24 10:50:45 UTC ---
Does it occur with the 32-bit compiler as well?  If so, how come the pass has
been enabled in 32-bit mode by default?

[Bug tree-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #7 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 12:20:24 UTC ---
REE pass miscompiles std::ostream::operator<<(short):

Dump of assembler code for function std::ostream::operator<<(short):
=> 0x001998f0 <+0>:     push   %ebx
   0x001998f1 <+1>:     sub    $0x18,%esp
   0x001998f4 <+4>:     call   0x156e4b <__x86.get_pc_thunk.bx>
   0x001998f9 <+9>:     add    $0x5a6fb,%ebx
   0x001998ff <+15>:    mov    0x20(%esp),%edx
   0x00199903 <+19>:    movzwl 0x24(%esp),%ecx
   0x00199908 <+24>:    mov    %edx,(%esp)
   0x0019990b <+27>:    mov    %ecx,0x4(%esp)
   0x0019990f <+31>:    call   0x154630 <_ZNSo9_M_insertIlEERSoT_@plt>
   0x00199914 <+36>:    add    $0x18,%esp
   0x00199917 <+39>:    pop    %ebx
   0x00199918 <+40>:    ret    
End of assembler dump.

This is without REE pass:

Dump of assembler code for function std::ostream::operator<<(short):
=> 0x00199960 <+0>:     push   %ebx
   0x00199961 <+1>:     sub    $0x18,%esp
   0x00199964 <+4>:     mov    0x20(%esp),%edx
   0x00199968 <+8>:     call   0x156e4b <__x86.get_pc_thunk.bx>
   0x0019996d <+13>:    add    $0x5b687,%ebx
   0x00199973 <+19>:    movzwl 0x24(%esp),%ecx
   0x00199978 <+24>:    mov    (%edx),%eax
   0x0019997a <+26>:    mov    -0xc(%eax),%eax
   0x0019997d <+29>:    mov    0xc(%edx,%eax,1),%eax
   0x00199981 <+33>:    and    $0x4a,%eax
   0x00199984 <+36>:    cmp    $0x8,%eax
   0x00199987 <+39>:    je     0x1999a8 <std::ostream::operator<<(short)+72>
   0x00199989 <+41>:    cmp    $0x40,%eax
   0x0019998c <+44>:    je     0x1999a8 <std::ostream::operator<<(short)+72>
   0x0019998e <+46>:    movswl %cx,%ecx
   0x00199991 <+49>:    mov    %ecx,0x4(%esp)
   0x00199995 <+53>:    mov    %edx,(%esp)
   0x00199998 <+56>:    call   0x154630 <_ZNSo9_M_insertIlEERSoT_@plt>
   0x0019999d <+61>:    add    $0x18,%esp
   0x001999a0 <+64>:    pop    %ebx
   0x001999a1 <+65>:    ret    
   0x001999a2 <+66>:    lea    0x0(%esi),%esi
   0x001999a8 <+72>:    movzwl %cx,%ecx
   0x001999ab <+75>:    mov    %ecx,0x4(%esp)
   0x001999af <+79>:    mov    %edx,(%esp)
   0x001999b2 <+82>:    call   0x154630 <_ZNSo9_M_insertIlEERSoT_@plt>
   0x001999b7 <+87>:    add    $0x18,%esp
   0x001999ba <+90>:    pop    %ebx
   0x001999bb <+91>:    ret    
End of assembler dump.

Just break at _ZNSolsEs to see wrong code in action. Please also note movsl in
good code.

[Bug tree-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #8 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 12:23:17 UTC ---
(In reply to comment #6)
> Does it occur with the 32-bit compiler as well?  If so, how come the pass has
> been enabled in 32-bit mode by default?

The problem is exposed for 32bit targets. REE pass was enabled also for 32bit
targets with commit [1].

[1] http://gcc.gnu.org/ml/gcc-cvs/2011-12/msg00745.html

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

Uros Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |rtl-optimization

--- Comment #9 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 12:39:50 UTC ---
This is rtl-optimization problem.

FYI: 64bit targets compile to:

Dump of assembler code for function _ZNSolsEs:
=> 0x0000003dd2c98c10 <+0>:     mov    (%rdi),%rax
   0x0000003dd2c98c13 <+3>:     mov    -0x18(%rax),%rax
   0x0000003dd2c98c17 <+7>:     mov    0x18(%rdi,%rax,1),%eax
   0x0000003dd2c98c1b <+11>:    and    $0x4a,%eax
   0x0000003dd2c98c1e <+14>:    cmp    $0x8,%eax
   0x0000003dd2c98c21 <+17>:    je     0x3dd2c98c38 <_ZNSolsEs+40>
   0x0000003dd2c98c23 <+19>:    cmp    $0x40,%eax
   0x0000003dd2c98c26 <+22>:    je     0x3dd2c98c38 <_ZNSolsEs+40>
   0x0000003dd2c98c28 <+24>:    movswq %si,%rsi
   0x0000003dd2c98c2c <+28>:    jmpq   0x3dd2c58df0
<_ZNSo9_M_insertIlEERSoT_@plt>
   0x0000003dd2c98c31 <+33>:    nopl   0x0(%rax)
   0x0000003dd2c98c38 <+40>:    movzwl %si,%esi
   0x0000003dd2c98c3b <+43>:    jmpq   0x3dd2c58df0
<_ZNSo9_M_insertIlEERSoT_@plt>
End of assembler dump.

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #10 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 12:46:38 UTC ---
The problem is illustrated in the second code dump of Comment #7. The second
movzwl can be merged with the first one, but we still need movswl to correctly
extend the HImode value to SImode.

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #11 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 13:36:43 UTC ---
Testcase:

--cut here--
void abort (void);

void __attribute__((noinline))
bar (int a)
{
  if (a != -1)
    abort ();
}

void __attribute__((noinline))
foo (short *a, int t)
{
  unsigned int r = *a;

  if (t)
    bar ((unsigned short) r);
  else
    bar ((signed short) r);
}

short v = -1;

int main()
{
  foo (&v, 0);
  return 0;
}
--cut here--

Fails also on x86_64-pc-linux-gnu.

$ ~/gcc-build/gcc/xgcc -B ~/gcc-build/gcc -O2 -free pr51667.c
$ ./a.out
Aborted
$ ~/gcc-build/gcc/xgcc -B ~/gcc-build/gcc -O2 -fno-ree pr51667.c
$ ./a.out
$

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #12 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 13:50:16 UTC ---
foo can be simplified a bit:

void __attribute__((noinline))
foo (short *a, int t)
{
  short r = *a;

  if (t)
    bar ((unsigned short) r);
  else
    bar ((signed short) r);
}

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #13 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-24 14:10:44 UTC ---
I'll leave this one to somebody more familiar with dataflow.

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |ebotcazou at gcc dot
                   |gnu.org                     |gnu.org

--- Comment #14 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2011-12-24 16:37:25 UTC ---
Investigating.

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #15 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2011-12-26 21:54:37 UTC ---
Created attachment 26185
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26185
Tentative fix

To be more thoroughly tested.

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #16 from Dominique d'Humieres <dominiq at lps dot ens.fr> 2011-12-27 11:56:06 UTC ---
I confirm that the patch in comment #15 fixes the PR without visible side
effect so far. Thanks.

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #17 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2011-12-27 16:25:52 UTC ---
Author: ebotcazou
Date: Tue Dec 27 16:25:43 2011
New Revision: 182694

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=182694
Log:
    PR rtl-optimization/51667
    * ree.c (insn_merge_code): Delete.
    (is_insn_merge_attempted): Likewise.
    (get_insn_status): Likewise.
    (set_insn_status): Likewise.
    (struct ext_cand): Add CODE and MODE fields.
    (combine_set_extend): Rename to...
    (combine_set_extension): ...this.  Use above fields and tidy up.
    (transform_ifelse): Likewise.
    (get_defs): Return the chain of definitions.
    (is_this_a_cmove): Merge into...
    (is_cond_copy_insn): ...this.  Return bool.
    (make_defs_and_copies_lists): Adjust calls to get_defs and simplify.
    (merge_def_and_ext): Adjust call to combine_set_extend.
    (combine_reaching_defs): Remove calls to {g|s}et_insn_status.
    (struct extend_info): Rename to...
    (struct re_info): ...this.  Add DEF_MAP field.
    (add_ext_candidate): Merge into...
    (add_removable_extension): ...this.  Adjust calls to get_defs.  Ensure
    reaching definitions are associated with only one kind of extension.
    (find_removable_extensions): Create and destroy the definition map.
    (find_and_remove_re): Return void.  Change 'long' variables to 'int'.
    Do not deal with is_insn_merge_attempted.

Added:
    trunk/gcc/testsuite/gcc.c-torture/execute/20111227-1.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/ree.c
    trunk/gcc/testsuite/ChangeLog

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #18 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2011-12-27 16:28:42 UTC ---
Thanks for the testing.

[Bug rtl-optimization/51667] [4.7 Regression] new FAIL: 27_io/basic_*stream/* execution test with -m32

[ubizjak at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51667

--- Comment #19 from Uros Bizjak <ubizjak at gmail dot com> 2011-12-28 09:09:02 UTC ---
FYI, the patch also works correctly on alpha [1], a target with sign-extended
instructions.

[1] http://gcc.gnu.org/ml/gcc-testresults/2011-12/msg02710.html