[Bug rtl-optimization/56999] New: [4.8/4.9 Regression] LRA caused miscompilation of xulrunner

[Bug rtl-optimization/56999] New: [4.8/4.9 Regression] LRA caused miscompilation of xulrunner

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

             Bug #: 56999
           Summary: [4.8/4.9 Regression] LRA caused miscompilation of
                    xulrunner
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: jakub@gcc.gnu.org
                CC: vmakarov@gcc.gnu.org


With -fpic -O2 -m32 -march=i686 -mtune=atom the following testcase is
miscompiled with LRA (but, I don't have a runtime testcase, just eyeball
assembly right now).  The bad code is:
        movl    24(%esp), %eax
        addl    $12, %eax
        movl    %eax, 24(%esp)
        addl    $8, %eax
        testb   %cl, %cl
        movl    24(%esp), %ecx
        cmovne  %ecx, %eax
        movl    %eax, 24(%esp)
while reload has:
        movl    %ecx, %eax
        addl    $8, %ecx
        addl    $12, %eax
        cmpb    $0, 23(%esp)
        cmove   %ecx, %eax
instead.  So, reload performs the intentional ptr + (flag ? 12 : 8) while
the LRA code performs ptr + (flag ? 12 : 20) instead.  The source code related
to this is barriers ? &mJITInfo->jitHandleCtorBarriered :
&mJITInfo->jitHandleCtor where offsetof (JITScriptSet, jitHandleCtorBarriered)
== 12 and offsetof (JITScriptSet, jitHandleCtor) is 8, there is no field at
offset 20.

[Bug rtl-optimization/56999] [4.8/4.9 Regression] LRA caused miscompilation of xulrunner

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Target Milestone|---                         |4.8.1

[Bug rtl-optimization/56999] [4.8/4.9 Regression] LRA caused miscompilation of xulrunner

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-18 16:42:34 UTC ---
BTW, of course much lower priority, this also shows another spot where I think
reload code is better.

In the same ebb as the wrong-code, reload has code like:
        movl    %eax, %ecx
        shrb    $3, %cl
        andl    $1, %ecx
...
        movb    %cl, 23(%esp)
while LRA generates:
        movl    %eax, %ecx
        shrb    $3, %cl
        movb    %cl, 31(%esp)
...
        andb    $1, 31(%esp)

I'd think anding the value while we still have it in a register ought to be
better, though I admit I haven't benchmarked it.

[Bug rtl-optimization/56999] [4.8/4.9 Regression] LRA caused miscompilation of xulrunner

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-18 17:39:56 UTC ---
Created attachment 29897
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29897
gcc49-pr56999-test.patch

Adjusted testcase, so that it aborts if miscompiled, suitable for gcc
testsuite, in a form of a patch.

[Bug rtl-optimization/56999] [4.8/4.9 Regression] LRA caused miscompilation of xulrunner

[vmakarov at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

Vladimir Makarov <vmakarov at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |vmakarov at redhat dot com

--- Comment #4 from Vladimir Makarov <vmakarov at redhat dot com> 2013-04-18 18:28:21 UTC ---
The bug is in a complicated interactions inheritance and coalescing through
several inheritance/coalesce passes.

I think the patch will be ready tomorrow.


Jakub and Marek, thanks for working on extracting the testcase which required a
lot of your efforts.

[Bug rtl-optimization/56999] [4.8 Regression] LRA caused miscompilation of xulrunner

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2013-04-19
      Known to work|                            |4.7.3, 4.9.0
         AssignedTo|unassigned at gcc dot       |vmakarov at gcc dot gnu.org
                   |gnu.org                     |
            Summary|[4.8/4.9 Regression] LRA    |[4.8 Regression] LRA caused
                   |caused miscompilation of    |miscompilation of xulrunner
                   |xulrunner                   |
     Ever Confirmed|0                           |1
      Known to fail|                            |4.8.0

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-04-19 05:25:08 UTC ---
Author: vmakarov
Date: Fri Apr 19 03:57:22 2013
New Revision: 198082

URL: http://gcc.gnu.org/viewcvs?rev=198082&root=gcc&view=rev
Log:
2013-04-18  Vladimir Makarov  <vmakarov@redhat.com>

    PR rtl-optimization/56992
    * lra-coalesce.c (coalescable_pseudo_p): Remove 2nd parameter and
    related code.
    (lra_coalesce): Remove split_origin_bitmap and related code.
    * lra.c (lra): Coalesce after undoing inheritance.  Recreate live
    ranges if necessary.

2013-04-18  Jakub Jelinek  <jakub@redhat.com>

    PR rtl-optimization/56992
    * g++.dg/opt/pr56999.C: New test.



Added:
    trunk/gcc/testsuite/g++.dg/opt/pr56999.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/lra-coalesce.c
    trunk/gcc/lra.c
    trunk/gcc/testsuite/ChangeLog

Author: vmakarov
Date: Fri Apr 19 04:00:57 2013
New Revision: 198083

URL: http://gcc.gnu.org/viewcvs?rev=198083&root=gcc&view=rev
Log:
Fixing PR number in Changelogs

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog

[Bug rtl-optimization/56999] [4.8 Regression] LRA caused miscompilation of xulrunner

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

--- Comment #7 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-04-19 08:19:50 UTC ---
Damn, wrong PR, sorry.

[Bug rtl-optimization/56999] [4.8 Regression] LRA caused miscompilation of xulrunner

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mpolacek at gcc dot gnu.org

--- Comment #6 from Marek Polacek <mpolacek at gcc dot gnu.org> 2013-04-19 08:19:16 UTC ---
Author: mpolacek
Date: Fri Apr 19 08:18:29 2013
New Revision: 198085

URL: http://gcc.gnu.org/viewcvs?rev=198085&root=gcc&view=rev
Log:
    Backport from mainline
    2013-01-08  Steven Bosscher  <steven@gcc.gnu.org>
            Jakub Jelinek  <jakub@redhat.com>

    PR tree-optimization/48189
    * predict.c (predict_loops): If max is 0, don't call compare_tree_int.
    If nitercst is 0, don't predict the exit edge.

    * gcc.dg/pr48189.c: New test.


Added:
    branches/gcc-4_7-branch/gcc/testsuite/gcc.dg/pr48189.c
Modified:
    branches/gcc-4_7-branch/gcc/ChangeLog
    branches/gcc-4_7-branch/gcc/predict.c
    branches/gcc-4_7-branch/gcc/testsuite/ChangeLog

[Bug rtl-optimization/56999] [4.8 Regression] LRA caused miscompilation of xulrunner

[evangelos at foutrelis dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

Evangelos Foutras <evangelos at foutrelis dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |evangelos at foutrelis dot
                   |                            |com

--- Comment #8 from Evangelos Foutras <evangelos at foutrelis dot com> 2013-04-30 06:57:39 UTC ---
r198082 applied on top of gcc-4.8-20130425 fixes the segfaults we were seeing
with Firefox 20 on Arch Linux. (The segfaults were reproducible only on i686
but not on x86_64.)

I assume this will get committed to the 4.8 branch soon?

[Bug rtl-optimization/56999] [4.8 Regression] LRA caused miscompilation of xulrunner

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56999

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> 2013-05-02 19:31:16 UTC ---
Author: vmakarov
Date: Thu May  2 17:46:58 2013
New Revision: 198554

URL: http://gcc.gnu.org/viewcvs?rev=198554&root=gcc&view=rev
Log:
2013-05-02  Vladimir Makarov  <vmakarov@redhat.com>

    Backport from mainline
    2013-04-18  Vladimir Makarov  <vmakarov@redhat.com>

        PR rtl-optimization/56992
        * lra-coalesce.c (coalescable_pseudo_p): Remove 2nd parameter and
        related code.
        (lra_coalesce): Remove split_origin_bitmap and related code.
        * lra.c (lra): Coalesce after undoing inheritance. Recreate live
        ranges if necessary.

2013-05-02  Vladimir Makarov  <vmakarov@redhat.com>

    Backport from mainline
    2013-04-18  Jakub Jelinek  <jakub@redhat.com>

        PR rtl-optimization/56992
        * g++.dg/opt/pr56999.C: New test.


Added:
    branches/gcc-4_8-branch/gcc/testsuite/g++.dg/opt/pr56999.C
Modified:
    branches/gcc-4_8-branch/gcc/ChangeLog
    branches/gcc-4_8-branch/gcc/lra-coalesce.c
    branches/gcc-4_8-branch/gcc/lra.c
    branches/gcc-4_8-branch/gcc/testsuite/ChangeLog