[Bug target/59363] New: [4.9 Regression] r203886 miscompiles git

[Bug target/59363] New: [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

            Bug ID: 59363
           Summary: [4.9 Regression] r203886 miscompiles git
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: octoploid at yandex dot com

Starting with r203886 git gets miscompiled on my machine.
For example:

 % git blame gcc/tree-object-size.c

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000000000051240d in xdl_emit_hunk_hdr (s1=s1@entry=1291, c1=<optimized
out>, s2=s2@entry=1291, c2=c2@entry=1, func=func@entry=0x7fffffffd2d8 "",
funclen=0, 
    ecb=ecb@entry=0x7fffffffd580) at xdiff/xutils.c:460
#2  0x0000000000512af7 in xdl_emit_diff (xe=0x7fffffffd390, xscr=<optimized
out>, ecb=0x7fffffffd580, xecfg=0x7fffffffd590) at xdiff/xemit.c:237
#3  0x0000000000510a5d in xdl_diff (mf1=mf1@entry=0x7fffffffd510,
mf2=mf2@entry=0x7fffffffd520, xpp=xpp@entry=0x7fffffffd570,
xecfg=xecfg@entry=0x7fffffffd590, 
    ecb=ecb@entry=0x7fffffffd580) at xdiff/xdiffi.c:601
#4  0x000000000050b005 in xdi_diff (mf1=<optimized out>, mf2=<optimized out>,
xpp=xpp@entry=0x7fffffffd570, xecfg=xecfg@entry=0x7fffffffd590,
xecb=xecb@entry=0x7fffffffd580)
    at xdiff-interface.c:136
#5  0x00000000004104df in diff_hunks (file_a=<optimized out>, file_b=<optimized
out>, ctxlen=ctxlen@entry=0, hunk_func=hunk_func@entry=0x411320
<blame_chunk_cb>, 
    cb_data=cb_data@entry=0x7fffffffd830) at builtin/blame.c:105
#6  0x0000000000412b54 in pass_blame_to_parent (parent=0x144a7b0,
target=0x125dcb0, sb=0x7fffffffd6e0) at builtin/blame.c:815
#7  pass_blame (opt=0, origin=0x125dcb0, sb=0x7fffffffd6e0) at
builtin/blame.c:1281
#8  assign_blame (opt=<optimized out>, sb=0x7fffffffd6e0) at
builtin/blame.c:1559
#9  cmd_blame (argc=<optimized out>, argv=<optimized out>, prefix=<optimized
out>) at builtin/blame.c:2523
#10 0x00000000004060b5 in run_builtin (argv=0x7fffffffe528, argc=2, p=0x578bd8
<commands.22612+120>) at git.c:314
#11 handle_internal_command (argc=2, argv=0x7fffffffe528) at git.c:478
#12 0x0000000000405772 in main (argc=2, av=<optimized out>) at git.c:575

This only happens when I compile git with -march=native (=amdfam10 on this
machine).

I will try to come up with a testcase tomorrow.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #1 from Markus Trippelsdorf <octoploid at yandex dot com> ---
Created attachment 31346
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31346&action=edit
preprocessed file

Testcase.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #2 from Markus Trippelsdorf <octoploid at yandex dot com> ---

22209 static int diff_hunks(mmfile_t *file_a, mmfile_t *file_b, long ctxlen,
22210         xdl_emit_hunk_consume_func_t hunk_func, void *cb_data)
22211 {
22212  xpparam_t xpp = {0};
22213  xdemitconf_t xecfg = {0};
22214  xdemitcb_t ecb = {((void *)0)};
22215
22216  xpp.flags = xdl_opts;
22217  xecfg.ctxlen = ctxlen;
22218  xecfg.hunk_func = hunk_func;
22219  ecb.priv = cb_data;
22220  return xdi_diff(file_a, file_b, &xpp, &xecfg, &ecb);
22221 }
22222

"xdemitconf_t xecfg = {0};" is the problematic line.
If I leave the variable uninitialized the issue goes away.

The difference of:
cc -S -c -O2 -march=native blame.i
cc -S -c -O2 blame.i

@@ -256,38 +256,36 @@
 .LCOLDB5:
        .text
 .LHOTB5:
-       .p2align 5,,31
+       .p2align 4,,15
        .type   diff_hunks, @function
 diff_hunks:
 .LFB104:
        .cfi_startproc
-       subq    $88, %rsp
-       .cfi_def_cfa_offset 96
+       pushq   %rbx
+       .cfi_def_cfa_offset 16
+       .cfi_offset 3, -16
+       movq    %rdi, %r11
+       movq    %rcx, %rbx
        xorl    %eax, %eax
-.L31:
-       movl    %eax, %r9d
-       addl    $32, %eax
-       cmpl    $32, %eax
-       movq    $0, 32(%rsp,%r9)
-       movq    $0, 40(%rsp,%r9)
-       movq    $0, 48(%rsp,%r9)
-       movq    $0, 56(%rsp,%r9)
-       jb      .L31
-       leaq    32(%rsp), %r10
-       movq    %rdx, 32(%rsp)
-       movq    %rcx, 72(%rsp)
-       addq    %r10, %rax
+       movl    $6, %ecx
+       subq    $80, %rsp
+       .cfi_def_cfa_offset 96
+       leaq    32(%rsp), %rdi
        movq    %r8, 16(%rsp)
-       movq    %rsp, %rdx
-       movq    $0, (%rax)
-       movq    $0, 8(%rax)
        leaq    16(%rsp), %r8
-       movslq  xdl_opts(%rip), %rax
-       movq    %r10, %rcx
        movq    $0, 24(%rsp)
+       rep stosq
+       movslq  xdl_opts(%rip), %rax
+       leaq    32(%rsp), %rcx
+       movq    %rdx, 32(%rsp)
+       movq    %r11, %rdi
+       movq    %rsp, %rdx
+       movq    %rbx, 72(%rsp)
        movq    %rax, (%rsp)
        call    xdi_diff
-       addq    $88, %rsp
+       addq    $80, %rsp
+       .cfi_def_cfa_offset 16
+       popq    %rbx
        .cfi_def_cfa_offset 8
        ret
        .cfi_endproc

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Target|                            |x86_64-*-*
           Priority|P3                          |P1
   Target Milestone|---                         |4.9.0

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hjl.tools at gmail dot com

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> ---
Please show the output of

cc -v -S -c -O2 -march=native blame.i

so that it can be reproduced.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #4 from Markus Trippelsdorf <octoploid at yandex dot com> ---
git % cc -v -S -c -O2 -march=native blame.i
Using built-in specs.
COLLECT_GCC=/usr/x86_64-pc-linux-gnu/gcc-bin/4.9.0/gcc
Target: x86_64-pc-linux-gnu
Configured with: ../gcc/configure --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/4.9.0
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.9.0
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.9.0/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/4.9.0/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/include/g++-v4
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --disable-altivec
--disable-fixed-point --without-ppl --without-cloog --enable-lto --enable-nls
--without-included-gettext --with-system-zlib --disable-werror
--enable-initfini-array --with-gold --enable-secureplt --disable-multilib
--disable-libvtv --disable-libitm --disable-libcilkrts --disable-libssp
--disable-libgomp --enable-cld
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/4.9.0/python
--enable-checking=release --disable-libgcj --enable-languages=c,c++
--enable-shared --enable-threads=posix --enable-__cxa_atexit
--enable-clocale=gnu
--with-boot-ldflags=-Wl,-O1,--hash-style=gnu,--as-needed,--gc-sections,--icf=safe,--icf-iterations=3
--enable-version-specific-runtime-libs --disable-libstdcxx-pch
--enable-libstdcxx-time=yes --with-build-config=bootstrap-lto
Thread model: posix
gcc version 4.9.0 20131129 (experimental) (GCC) 
COLLECT_GCC_OPTIONS='-v' '-S' '-c' '-O2' '-march=native'
 /usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1 -fpreprocessed blame.i
-march=amdfam10 -mmmx -m3dnow -msse -msse2 -msse3 -mno-ssse3 -msse4a -mcx16
-msahf -mno-movbe -mno-aes -mno-pclmul -mpopcnt -mabm -mno-lwp -mno-fma
-mno-fma4 -mno-xop -mno-bmi -mno-bmi2 -mno-tbm -mno-avx -mno-avx2 -mno-sse4.2
-mno-sse4.1 -mlzcnt -mno-rtm -mno-hle -mno-rdrnd -mno-f16c -mno-fsgsbase
-mno-rdseed -mprfchw -mno-adx -mfxsr -mno-xsave -mno-xsaveopt -mno-avx512f
-mno-avx512er -mno-avx512cd -mno-avx512pf --param l1-cache-size=64 --param
l1-cache-line-size=64 --param l2-cache-size=512 -mtune=amdfam10 -quiet
-dumpbase blame.i -auxbase blame -O2 -version -o blame.s
GNU C (GCC) version 4.9.0 20131129 (experimental) (x86_64-pc-linux-gnu)
        compiled by GNU C version 4.9.0 20131129 (experimental), GMP version
5.1.3, MPFR version 3.1.2, MPC version 1.0.1
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
GNU C (GCC) version 4.9.0 20131129 (experimental) (x86_64-pc-linux-gnu)
        compiled by GNU C version 4.9.0 20131129 (experimental), GMP version
5.1.3, MPFR version 3.1.2, MPC version 1.0.1
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: 3b47e15390e8cb82192637cabb8398ab
COMPILER_PATH=/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/:/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/:/usr/libexec/gcc/x86_64-pc-linux-gnu/:/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/:/usr/lib/gcc/x86_64-pc-linux-gnu/:/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/../../../../x86_64-pc-linux-gnu/bin/
LIBRARY_PATH=/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/:/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/../../../../lib64/:/lib/../lib64/:/usr/lib/../lib64/:/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/../../../../x86_64-pc-linux-gnu/lib/:/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-S' '-c' '-O2' '-march=native'

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #5 from Markus Trippelsdorf <octoploid at yandex dot com> ---
(In reply to Markus Trippelsdorf from comment #2)
> 22209 static int diff_hunks(mmfile_t *file_a, mmfile_t *file_b, long ctxlen,
> 22210         xdl_emit_hunk_consume_func_t hunk_func, void *cb_data)
> 22211 {
> 22212  xpparam_t xpp = {0};
> 22213  xdemitconf_t xecfg = {0};
> 22214  xdemitcb_t ecb = {((void *)0)};
> 22215
> 22216  xpp.flags = xdl_opts;
> 22217  xecfg.ctxlen = ctxlen;
> 22218  xecfg.hunk_func = hunk_func;
> 22219  ecb.priv = cb_data;
> 22220  return xdi_diff(file_a, file_b, &xpp, &xecfg, &ecb);
> 22221 }
> 22222

The problem seems to be that xecfg.hunk_func is empty even though
hunk_func is not. 
So the assignment might get overwritten by the initialization.

...
(gdb) up
#5  0x00000000004104df in diff_hunks (file_a=<optimized out>, file_b=<optimized
out>, ctxlen=ctxlen@entry=0, hunk_func=hunk_func@entry=0x411320
<blame_chunk_cb>, 
    cb_data=cb_data@entry=0x7fffffffd830) at builtin/blame.c:105
105             return xdi_diff(file_a, file_b, &xpp, &xecfg, &ecb);
(gdb) l
100
101             xpp.flags = xdl_opts;
102             xecfg.ctxlen = ctxlen;
103             xecfg.hunk_func = hunk_func;
104             ecb.priv = cb_data;
105             return xdi_diff(file_a, file_b, &xpp, &xecfg, &ecb);
106     }
107
108     /*
109      * Prepare diff_filespec and convert it using diff textconv API
(gdb) p hunk_func
$1 = (xdl_emit_hunk_consume_func_t) 0x411320 <blame_chunk_cb>
(gdb) p xecfg.hunk_func
$2 = (xdl_emit_hunk_consume_func_t) 0x0

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[michael.v.zolotukhin at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #6 from Michael Zolotukhin <michael.v.zolotukhin at gmail dot com> ---
I wasn't able to reproduce the problem, though I got the same asm-files as you
showed.

However, the both asms look correct to me, and equivalent to each other.

Could the problem be in function xdi_diff?
Maybe it's compiled with some different flags?

Though, I might miss something - I'll continue digging into the problem.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #7 from Markus Trippelsdorf <octoploid at yandex dot com> ---
Antoine Pelisse explained the control flow:
 http://thread.gmane.org/gmane.comp.version-control.git/238629/focus=238631

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #8 from Markus Trippelsdorf <octoploid at yandex dot com> ---
To reproduce the issue:
 % git clone https://github.com/git/git
 % cd git
 % vim Makefile (add "-march=amdfam10" to CFLAGS
                 and point CC to gcc trunk)
 % make
 % ./git-blame Makefile (crash)

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #9 from H.J. Lu <hjl.tools at gmail dot com> ---
Steps to reproduce this bug on Intel Core i7 processors:

1. Checkout GCC revision 203886.
2. Configure GCC with

--with-arch=corei7 --with-tune=amdfam10

3. Bootstrap/install GCC.
4. Checkout git 1.8.4.4.
5. Configure git with

CC=GCC-203886/bin/gcc CXX=GCC-203886/bin/g++ ./configure
6. Build/install git.
7. Run "git blame gcc/tree-object-size.c" in GCC revision 203886 tree.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-12-02
     Ever confirmed|0                           |1

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #11 from H.J. Lu <hjl.tools at gmail dot com> ---
A testcase:

[hjl@gnu-6 pr59363]$ cat x.h
typedef struct s_mmbuffer {
 char *ptr;
 long size;
} mmbuffer_t;
typedef struct s_mmfile {
 char *ptr;
 long size;
} mmfile_t;
typedef struct s_xpparam {
 unsigned long flags;
} xpparam_t;
typedef long (*find_func_t)(const char *line, long line_len, char *buffer, long
buffer_size, void *priv);
typedef int (*xdl_emit_hunk_consume_func_t)(void);
typedef struct s_xdemitconf {
 long ctxlen;
 long interhunkctxlen;
 unsigned long flags;
 find_func_t find_func;
 void *find_func_priv;
 xdl_emit_hunk_consume_func_t hunk_func;
} xdemitconf_t;
typedef struct s_xdemitcb {
 void *priv;
 int (*outf)(void *, mmbuffer_t *, int);
} xdemitcb_t;
extern int xdi_diff(xpparam_t const *xpp,
            xdemitconf_t const *xecfg, xdemitcb_t *ecb);
extern int diff_hunks(long ctxlen, xdl_emit_hunk_consume_func_t hunk_func,
              void *cb_data);
[hjl@gnu-6 pr59363]$ cat x.c
#include "x.h"

int
xdi_diff(xpparam_t const *xpp,
     xdemitconf_t const *xecfg, xdemitcb_t *ecb)
{
  if (xecfg->hunk_func == 0)
    __builtin_abort ();

  return 0;
}

int hunk_func (void)
{
  return 0;
}

int
main ()
{
  return diff_hunks (1, hunk_func, (void *) 0);
}
[hjl@gnu-6 pr59363]$ cat y.c
#include "x.h"
int diff_hunks(long ctxlen, xdl_emit_hunk_consume_func_t hunk_func,
           void *cb_data)
{
 xpparam_t xpp = {0};
 xdemitconf_t xecfg = {0};
 xdemitcb_t ecb = {((void *)0)};
 xpp.flags = 0;
 xecfg.ctxlen = ctxlen;
 xecfg.hunk_func = hunk_func;
 ecb.priv = cb_data;
 return xdi_diff(&xpp, &xecfg, &ecb);
}
[hjl@gnu-6 pr59363]$ make
/export/build/gnu/gcc/build-x86_64-linux/gcc/xgcc
-B/export/build/gnu/gcc/build-x86_64-linux/gcc/ -O2 -mtune=amdfam10   -c -o x.o
x.c
/export/build/gnu/gcc/build-x86_64-linux/gcc/xgcc
-B/export/build/gnu/gcc/build-x86_64-linux/gcc/ -O2 -mtune=amdfam10   -c -o y.o
y.c
/export/build/gnu/gcc/build-x86_64-linux/gcc/xgcc
-B/export/build/gnu/gcc/build-x86_64-linux/gcc/ -O2 -mtune=amdfam10 -o x x.o
y.o
./x
make: *** [all] Aborted
[hjl@gnu-6 pr59363]$

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #12 from H.J. Lu <hjl.tools at gmail dot com> ---
Smaller testcase:

[hjl@gnu-6 pr59363]$ cat x.h
typedef struct s_xdemitconf {
 long ctxlen;
 long interhunkctxlen;
 unsigned long flags;
 unsigned long find_func;
 void *find_func_priv;
 unsigned long hunk_func;
} xdemitconf_t;
extern int xdi_diff(xdemitconf_t const *xecfg);
extern int diff_hunks(unsigned long hunk_func);
[hjl@gnu-6 pr59363]$ cat x.c
#include "x.h"

int
xdi_diff(xdemitconf_t const *xecfg)
{
  if (xecfg->hunk_func == 0)
    __builtin_abort ();
  return 0;
}

int
main ()
{
  return diff_hunks (20);
}
[hjl@gnu-6 pr59363]$ cat y.c
#include "x.h"
int diff_hunks(unsigned long hunk_func)
{
 xdemitconf_t xecfg = {0};
 xecfg.hunk_func = hunk_func;
 return xdi_diff(&xecfg);
}
[hjl@gnu-6 pr59363]$ make
/export/build/gnu/gcc/build-x86_64-linux/gcc/xgcc
-B/export/build/gnu/gcc/build-x86_64-linux/gcc/ -O2 -mtune=amdfam10   -c -o x.o
x.c
/export/build/gnu/gcc/build-x86_64-linux/gcc/xgcc
-B/export/build/gnu/gcc/build-x86_64-linux/gcc/ -O2 -mtune=amdfam10   -c -o y.o
y.c
/export/build/gnu/gcc/build-x86_64-linux/gcc/xgcc
-B/export/build/gnu/gcc/build-x86_64-linux/gcc/ -O2 -mtune=amdfam10 -o x x.o
y.o
./x
make: *** [all] Aborted
[hjl@gnu-6 pr59363]$

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #31346|0                           |1
        is obsolete|                            |

--- Comment #13 from H.J. Lu <hjl.tools at gmail dot com> ---
Created attachment 31356
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31356&action=edit
A patch for GCC testsuite

Here is a patch for GCC testsuite.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #14 from Markus Trippelsdorf <octoploid at yandex dot com> ---
Further reduced:

markus@x4 tmp % cat test.i
typedef struct {
  int ctxlen;
  long interhunkctxlen;
  int flags;
  long find_func;
  void *find_func_priv;
  int hunk_func;
} xdemitconf_t;

__attribute__((noinline))
int xdi_diff(xdemitconf_t *xecfg) {
  if (xecfg->hunk_func == 0)
    __builtin_abort();
  return 0;
}
int main() {
  xdemitconf_t xecfg = {0};
  xecfg.hunk_func = 1;
  return xdi_diff(&xecfg);
}

markus@x4 tmp % gcc -O2 -mtune=amdfam10 test.i && ./a.out
[1]    2079 abort      ./a.out
markus@x4 tmp % gcc -O2 test.i && ./a.out
markus@x4 tmp %

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |harsha.jagasia at amd dot com

--- Comment #15 from H.J. Lu <hjl.tools at gmail dot com> ---
It may be a latent bug in amdfam10 scheduler. Before z.i.234r.sched2.
there are

(insn 24 23 26 4 (set (mem/c:DI (plus:DI (reg:DI 0 ax [85])
                (const_int 8 [0x8])) [2 xecfg+32 S8 A128])
        (const_int 0 [0])) z.i:12 85 {*movdi_internal}
     (expr_list:REG_DEAD (reg:DI 0 ax [85])
        (nil)))
(insn 26 24 28 4 (set (mem/c:SI (plus:DI (reg/f:DI 7 sp)
                (const_int 40 [0x28])) [3 xecfg.hunk_func+0 S4 A64])
        (const_int 1 [0x1])) z.i:13 86 {*movsi_internal}
     (nil))
(insn 28 26 29 4 (set (reg:DI 5 di)
        (reg/f:DI 7 sp)) z.i:14 85 {*movdi_internal}
     (expr_list:REG_EQUAL (plus:DI (reg/f:DI 20 frame)
            (const_int -48 [0xffffffffffffffd0]))
        (nil)))

z.i.234r.sched2 has

(insn 26 28 22 4 (set (mem/c:SI (plus:DI (reg/f:DI 7 sp)
                (const_int 40 [0x28])) [3 xecfg.hunk_func+0 S4 A64])
        (const_int 1 [0x1])) z.i:13 86 {*movsi_internal}
     (nil))
(insn:TI 22 26 24 4 (set (mem/c:DI (reg:DI 0 ax [85]) [2 xecfg+32 S8 A128])
        (const_int 0 [0])) z.i:12 85 {*movdi_internal}
     (nil))
(insn 24 22 29 4 (set (mem/c:DI (plus:DI (reg:DI 0 ax [85])
                (const_int 8 [0x8])) [2 xecfg+32 S8 A128])
        (const_int 0 [0])) z.i:12 85 {*movdi_internal}
     (expr_list:REG_DEAD (reg:DI 0 ax [85])
        (nil)))

insn 24 is moved after insn 26, which clears xecfg.hunk_func
set by insn 26.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #16 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to H.J. Lu from comment #15)
> It may be a latent bug in amdfam10 scheduler. Before z.i.234r.sched2.
> there are

The question comes down to if the aliasing oracle says if they are conflicting
ones.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[octoploid at yandex dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #17 from Markus Trippelsdorf <octoploid at yandex dot com> ---
(In reply to H.J. Lu from comment #15)
> It may be a latent bug in amdfam10 scheduler. Before z.i.234r.sched2.
> there are

BTW -mtune=opteron is also affected.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ubizjak at gmail dot com

--- Comment #18 from H.J. Lu <hjl.tools at gmail dot com> ---
emit_memset generates

(insn 22 21 23 (set (mem/c:DI (reg:DI 85) [2 xecfg+32 S8 A128])
        (reg:DI 86)) z.i:12 -1
     (nil))

(insn 23 22 24 (parallel [
            (set (reg:DI 85)
                (plus:DI (reg:DI 85)
                    (const_int 8 [0x8])))
            (clobber (reg:CC 17 flags))
        ]) z.i:12 -1
     (nil))

(insn 24 23 25 (set (mem/c:DI (reg:DI 85) [2 xecfg+32 S8 A128])
        (reg:DI 86)) z.i:12 -1
     (nil))

Both addresses are pointing to xecfg+32.  gen_strset is expanded
to

  (set (mem:DI (match_operand:P 1 "register_operand" "0")) 
        (match_operand:DI 2 "register_operand" "a")) 
   (set (match_operand:P 0 "register_operand" "=D") 
        (plus:P (match_dup 1)
                (const_int 8)))

The destination register is incremented by 8 bytes. But we failed
to adjust its address. This patch:

diff --git a/gcc/config/i386/i386.c b/gcc/config/i386/i386.c
index aa221df..d395a99 100644
--- a/gcc/config/i386/i386.c
+++ b/gcc/config/i386/i386.c
@@ -22806,6 +22806,8 @@ emit_memset (rtx destmem, rtx destptr, rtx
promoted_val,
       if (piece_size <= GET_MODE_SIZE (word_mode))
     {
       emit_insn (gen_strset (destptr, dst, promoted_val));
+      dst = adjust_automodify_address_nv (dst, move_mode, destptr,
+                          piece_size);
       continue;
     }

changes the expansion to
(insn 22 21 23 (set (mem/c:DI (reg:DI 85) [2 xecfg+32 S8 A128])
        (reg:DI 86)) z.i:12 -1
     (nil))

(insn 23 22 24 (parallel [
            (set (reg:DI 85)
                (plus:DI (reg:DI 85)
                    (const_int 8 [0x8])))
            (clobber (reg:CC 17 flags))
        ]) z.i:12 -1
     (nil))

(insn 24 23 25 (set (mem/c:DI (reg:DI 85) [2 xecfg+40 S8 A64])
        (reg:DI 86)) z.i:12 -1
     (nil))

The second address is now xecfg+40 and the testcase works.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #31356|0                           |1
        is obsolete|                            |

--- Comment #19 from H.J. Lu <hjl.tools at gmail dot com> ---
Created attachment 31357
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31357&action=edit
A patch

I am testing this patch.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #20 from H.J. Lu <hjl.tools at gmail dot com> ---
expand_setmem_epilogue in i386,c has

     if (TARGET_64BIT)
        {
          dest = change_address (destmem, DImode, destptr);
          emit_insn (gen_strset (destptr, dest, value));
          emit_insn (gen_strset (destptr, dest, value));
        }
      else  
        {
          dest = change_address (destmem, SImode, destptr);
          emit_insn (gen_strset (destptr, dest, value));
          emit_insn (gen_strset (destptr, dest, value));
          emit_insn (gen_strset (destptr, dest, value));
          emit_insn (gen_strset (destptr, dest, value));
        }
...

          dest = change_address (destmem, SImode, destptr);
          emit_insn (gen_strset (destptr, dest, value));
          emit_insn (gen_strset (destptr, dest, value));

The second gen_strset doesnt have the correct address.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[michael.v.zolotukhin at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #21 from Michael Zolotukhin <michael.v.zolotukhin at gmail dot com> ---
Thanks, HJ! That seems to be the root cause of the fail.
Did I get it right, that you are testing a patch fixing the issue?

Similar issue could be in expand_movmem_epilogue, I'll take a look.

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

--- Comment #22 from hjl at gcc dot gnu.org <hjl at gcc dot gnu.org> ---
Author: hjl
Date: Tue Dec  3 12:56:32 2013
New Revision: 205630

URL: http://gcc.gnu.org/viewcvs?rev=205630&root=gcc&view=rev
Log:
Adjust destination address after gen_strset

gcc/

    PR target/59363
    * config/i386/i386.c (emit_memset): Adjust destination address
    after gen_strset.
    (expand_setmem_epilogue): Likewise.

gcc/testsuite/

    PR target/59363
    * gcc.target/i386/pr59363.c: New file.

Added:
    trunk/gcc/testsuite/gcc.target/i386/pr59363.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/config/i386/i386.c
    trunk/gcc/testsuite/ChangeLog

[Bug target/59363] [4.9 Regression] r203886 miscompiles git

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59363

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #23 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed.