[Bug target/59137] New: Miscompilation at -O1 on mips/mipsel

[Bug target/59137] New: Miscompilation at -O1 on mips/mipsel

[aurelien at aurel32 dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

            Bug ID: 59137
           Summary: Miscompilation at -O1 on mips/mipsel
           Product: gcc
           Version: 4.8.2
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: aurelien at aurel32 dot net

Created attachment 31222
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31222&action=edit
Testcase

The attached code is miscompiled on MIPS at -O1 level, but works correctly at
-O0 or -O2 level:

$ gcc -Wall -Wextra gcc-mips-miscompilation-testcase.c -O0
$ ./a.out && echo $?
1
$ gcc -Wall -Wextra gcc-mips-miscompilation-testcase.c -O1
$ ./a.out && echo $?
0
$ gcc -Wall -Wextra gcc-mips-miscompilation-testcase.c -O2
$ ./a.out && echo $?
1

This happens with GCC 4.7.3, GCC 4.8.2 as well as with a snapshot from trunk
from 20131021, but not with GCC 4.6 or older. This happens with the o32 and n32
ABIs, but not with the n64 ABI.

Looking at the generated code:

004006f0 <fLlistp>:
  4006f0:       3c1c0042        lui     gp,0x42
  4006f4:       279c88a0        addiu   gp,gp,-30560
  4006f8:       8f828024        lw      v0,-32732(gp)
  4006fc:       1082000c        beq     a0,v0,400730 <fLlistp+0x40>
  400700:       8f828028        lw      v0,-32728(gp)
  400704:       0480000a        bltz    a0,400730 <fLlistp+0x40>
  400708:       00000000        nop
  40070c:       8c820000        lw      v0,0(a0)
  400710:       10400007        beqz    v0,400730 <fLlistp+0x40>
  400714:       8f828028        lw      v0,-32728(gp)
  400718:       8c820004        lw      v0,4(a0)
  40071c:       10400003        beqz    v0,40072c <fLlistp+0x3c>
  400720:       00000000        nop
  400724:       081001cc        j       400730 <fLlistp+0x40>
  400728:       8f828028        lw      v0,-32728(gp)
  40072c:       8f828024        lw      v0,-32732(gp)
  400730:       24040001        li      a0,1
  400734:       8f83802c        lw      v1,-32724(gp)
  400738:       03e00008        jr      ra
  40073c:       ac640000        sw      a0,0(v1)

At address 0x4006f8, the return register v0 is loaded with the address of
Cnil_body, to be able to do the comparison (x0 == &Cnil_body). Later at address
0x400700, it is reloaded with the address of Ct_body. This is done in the delay
slot, so in the case the branch is taken or not (in our case it is not). Later
at address 0x400704 the branch is taken, but the value of v0 is not anymore the
address of Cnil_body, but Ct_body instead (from the delay slot). Note that
there is a nop in the delay slow that can be used to load the correct value.

[Bug target/59137] [4.7/4.8/4.9 Regression] Miscompilation at -O1 on mips/mipsel

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu.org
   Target Milestone|---                         |4.7.4
            Summary|Miscompilation at -O1 on    |[4.7/4.8/4.9 Regression]
                   |mips/mipsel                 |Miscompilation at -O1 on
                   |                            |mips/mipsel

[Bug target/59137] [4.7/4.8/4.9 Regression] Miscompilation at -O1 on mips/mipsel

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-11-16
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I can reproduce it in 4.7.0, though I need to use -march=mips64 as my compiler
defaults to -march=octeon and the scheduling is different.

[Bug rtl-optimization/59137] [4.7/4.8/4.9 Regression] Miscompilation at -O1 on mips/mipsel

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|target                      |rtl-optimization

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The first difference between -march=mips64 and -march=octeon shows up in ce1
(ifcvt.c).

[Bug rtl-optimization/59137] [4.7/4.8/4.9 Regression] Miscompilation at -O1 on mips/mipsel

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug rtl-optimization/59137] [4.7/4.8/4.9 Regression] Miscompilation at -O1 on mips/mipsel

[rsandifo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |rsandifo at gcc dot gnu.org
           Assignee|unassigned at gcc dot gnu.org      |rsandifo at gcc dot gnu.org

--- Comment #3 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Looks like it's a bug in dbr_schedule liveness tracking (again).

[Bug rtl-optimization/59137] [4.7/4.8/4.9 Regression] Miscompilation at -O1 on mips/mipsel

[rsandifo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |http://gcc.gnu.org/ml/gcc-p
                   |                            |atches/2014-01/msg00403.htm
                   |                            |l

--- Comment #4 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Patch posted for review.

[Bug rtl-optimization/59137] [4.7/4.8/4.9 Regression] Miscompilation at -O1 on mips/mipsel

[rsandifo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

--- Comment #5 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Author: rsandifo
Date: Wed Jan  8 22:16:49 2014
New Revision: 206445

URL: http://gcc.gnu.org/viewcvs?rev=206445&root=gcc&view=rev
Log:
gcc/
    PR rtl-optimization/59137
    * reorg.c (steal_delay_list_from_target): Call update_block for
    elided insns.
    (steal_delay_list_from_fallthrough, relax_delay_slots): Likewise.

gcc/testsuite/
    PR rtl-optimization/59137
    * gcc.target/mips/pr59137.c: New test.

Added:
    trunk/gcc/testsuite/gcc.target/mips/pr59137.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/reorg.c
    trunk/gcc/testsuite/ChangeLog

[Bug rtl-optimization/59137] [4.7 Regression] Miscompilation at -O1 on mips/mipsel

[rsandifo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

--- Comment #7 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Author: rsandifo
Date: Thu Jan  9 19:58:52 2014
New Revision: 206489

URL: http://gcc.gnu.org/viewcvs?rev=206489&root=gcc&view=rev
Log:
gcc/
    PR rtl-optimization/59137
    * reorg.c (steal_delay_list_from_target): Call update_block for
    elided insns.
    (steal_delay_list_from_fallthrough, relax_delay_slots): Likewise.

gcc/testsuite/
    PR rtl-optimization/59137
    * gcc.target/mips/pr59137.c: New test.

Added:
    branches/gcc-4_8-branch/gcc/testsuite/gcc.target/mips/pr59137.c
Modified:
    branches/gcc-4_8-branch/gcc/ChangeLog
    branches/gcc-4_8-branch/gcc/reorg.c
    branches/gcc-4_8-branch/gcc/testsuite/ChangeLog

[Bug rtl-optimization/59137] [4.7 Regression] Miscompilation at -O1 on mips/mipsel

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59137

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to work|                            |4.8.3
         Resolution|---                         |FIXED
   Target Milestone|4.7.4                       |4.8.3
      Known to fail|                            |4.7.4

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed for 4.8.3.