[Bug c/59138] New: possible packed struct miscompile

[Bug c/59138] New: possible packed struct miscompile

[regehr at cs dot utah.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

            Bug ID: 59138
           Summary: possible packed struct miscompile
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: regehr at cs dot utah.edu

[regehr@imp test1]$ clang -O -Wall ./work17/reduce_D0DDXs/small.c ; ./a.out 
0
[regehr@imp test1]$ gcc -O2 -Wall ./work17/reduce_D0DDXs/small.c ; ./a.out
0
[regehr@imp test1]$ gcc -Os -Wall ./work17/reduce_D0DDXs/small.c ; ./a.out
1
[regehr@imp test1]$ cat ./work17/reduce_D0DDXs/small.c
int printf(const char *, ...);
#pragma pack(1)
struct S0 {
  int f0;
  int f1;
  int f2;
  short f3;
};
short a = 1;
struct S0 b = { 1 }, c, d, e;

struct S0 fn1() { return c; }

void fn2() {
  b = fn1();
  a = 0;
  d = e;
}

int main() {
  fn2();
  printf("%d\n", a);
  return 0;
}
[regehr@imp test1]$ gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/mnt/local/randomtest/compiler-install/gcc-r204770-install/bin/../libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: /users/regehr/z/compiler-source/gcc/configure
--prefix=/users/regehr/z/compiler-install/gcc-r204770-install
--enable-languages=c,c++ --enable-multilib
Thread model: posix
gcc version 4.9.0 20131114 (experimental) (GCC)

[Bug c/59138] [4.8/4.9 Regression] possible packed struct miscompile

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-11-15
      Known to work|                            |4.7.3
   Target Milestone|---                         |4.8.3
            Summary|possible packed struct      |[4.8/4.9 Regression]
                   |miscompile                  |possible packed struct
                   |                            |miscompile
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

[Bug c/59138] [4.8/4.9 Regression] possible packed struct miscompile

[mikpelinux at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

Mikael Pettersson <mikpelinux at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mikpelinux at gmail dot com

--- Comment #2 from Mikael Pettersson <mikpelinux at gmail dot com> ---
Started with r191302, a fix for missed-optimization PR44194 "struct returned by
value generates useless stores".

[Bug rtl-optimization/59138] [4.8/4.9 Regression] possible packed struct miscompile

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
                 CC|                            |ebotcazou at gcc dot gnu.org
          Component|c                           |rtl-optimization

[Bug rtl-optimization/59138] [4.8/4.9 Regression] possible packed struct miscompile

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|ebotcazou at gcc dot gnu.org       |
           Assignee|unassigned at gcc dot gnu.org      |ebotcazou at gcc dot gnu.org

--- Comment #3 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Looking into it.

[Bug rtl-optimization/59138] [4.8/4.9 Regression] possible packed struct miscompile

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

--- Comment #4 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Latent issue in the alias.c machinery: output_dependence returns 0 on

(insn 21 20 22 2 (set (mem/c:DI (const:DI (plus:DI (symbol_ref:DI ("b") [flags
0x2]  <var_decl 0x7ffff6e4d2f8 b>)
                    (const_int 8 [0x8]))) [0 +8 S8 A64])
        (reg:DI 1 dx [99])) pr59138.c:20 85 {*movdi_internal}
     (expr_list:REG_DEAD (reg:DI 1 dx [99])
        (nil)))

(insn 22 21 23 2 (set (mem/c:HI (symbol_ref:DI ("a") [flags 0x2]  <var_decl
0x7ffff6e4d260 a>) [2 a+0 S2 A16])
        (const_int 0 [0])) pr59138.c:21 87 {*movhi_internal}
     (nil))

because base_alias_check returns 0 for different symbols...

[Bug rtl-optimization/59138] [4.8/4.9 Regression] possible packed struct miscompile

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

--- Comment #5 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
> Latent issue in the alias.c machinery: output_dependence returns 0 on
> 
> (insn 21 20 22 2 (set (mem/c:DI (const:DI (plus:DI (symbol_ref:DI ("b")
> [flags 0x2]  <var_decl 0x7ffff6e4d2f8 b>)
>                     (const_int 8 [0x8]))) [0 +8 S8 A64])
>         (reg:DI 1 dx [99])) pr59138.c:20 85 {*movdi_internal}
>      (expr_list:REG_DEAD (reg:DI 1 dx [99])
>         (nil)))
> 
> (insn 22 21 23 2 (set (mem/c:HI (symbol_ref:DI ("a") [flags 0x2]  <var_decl
> 0x7ffff6e4d260 a>) [2 a+0 S2 A16])
>         (const_int 0 [0])) pr59138.c:21 87 {*movhi_internal}
>      (nil))
> 
> because base_alias_check returns 0 for different symbols...

I guess this means that we shouldn't be accessing "a" when writing to "b" in
the first place, but get_best_mode decides otherwise.  So this seems to be the
old issue with get_best_mode, visible directly on a bitfield write:

extern void abort (void);

#pragma pack(1)

struct S0 {
  int f0;
  int f1;
  long long f2 : 48;
};

short a = 1;

struct S0 b = { 1 }, c;

long long fn1() { return c.f2; }

void fn2 (void)
{
  b.f2 = fn1 ();
  a = 0;
}

int main (void)
{
  fn2 ();
  if (a != 0)
    abort ();
  return 0;
}

with GCC 4.6 or earlier and presumably fixed by the implementation of the new
memory model.

[Bug middle-end/59138] [4.8/4.9 Regression] possible packed struct miscompile

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|rtl-optimization            |middle-end

--- Comment #6 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Recategorizing.

[Bug middle-end/59138] [4.8/4.9 Regression] possible packed struct miscompile

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

--- Comment #7 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Author: ebotcazou
Date: Wed Nov 27 09:17:23 2013
New Revision: 205436

URL: http://gcc.gnu.org/viewcvs?rev=205436&root=gcc&view=rev
Log:
    PR middle-end/59138
    * expr.c (emit_group_store): Don't write past the end of the structure.
    (store_bit_field): Fix formatting.

Added:
    trunk/gcc/testsuite/gcc.c-torture/execute/20131127-1.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/expr.c
    trunk/gcc/testsuite/ChangeLog

[Bug middle-end/59138] [4.8/4.9 Regression] possible packed struct miscompile

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

--- Comment #8 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Author: ebotcazou
Date: Wed Nov 27 09:19:47 2013
New Revision: 205437

URL: http://gcc.gnu.org/viewcvs?rev=205437&root=gcc&view=rev
Log:
    PR middle-end/59138
    * expr.c (emit_group_store): Don't write past the end of the structure.
    (store_bit_field): Fix formatting.

Added:
    branches/gcc-4_8-branch/gcc/testsuite/gcc.c-torture/execute/20131127-1.c
      - copied unchanged from r205436,
trunk/gcc/testsuite/gcc.c-torture/execute/20131127-1.c
Modified:
    branches/gcc-4_8-branch/gcc/ChangeLog
    branches/gcc-4_8-branch/gcc/expr.c
    branches/gcc-4_8-branch/gcc/testsuite/ChangeLog

[Bug middle-end/59138] [4.8/4.9 Regression] possible packed struct miscompile

[ebotcazou at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59138

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Thanks for reporting the problem.