[Bug target/59744] New: miscompilation of unsigned comparison on aarch64

[Bug target/59744] New: miscompilation of unsigned comparison on aarch64

[michael.hudson at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

            Bug ID: 59744
           Summary: miscompilation of unsigned comparison on aarch64
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: michael.hudson at linaro dot org

Hi,

This slightly strangely written program (it's distilled down from
frame_offset_overflow in the gcc source itself) should print "bigger" if the
first argument is bigger than 10 (or negative, but let's ignore that please):

#include <stdlib.h>
#include <stdio.h>

int a[2] = { 10, 20 };

int
is_bigger (long offset, int index)
{
  unsigned long size = -offset;

  if (size > a[index])
    {
      printf("bigger\n");
      return 1;
    }

  return 0;
}


int
main (int argc, char** argv)
{
  long v;
  v = atol(argv[1]);
  is_bigger(-v, 0);
  return 0;
}

When compiled at -O1 or above (and with inlining disabled at -O2 and above),
though, it bungles the 0 case:

(t-doko)mwhudson@arm64:~$ gcc-4.9 -O3 test.c -o test -fno-inline -Wall
(t-doko)mwhudson@arm64:~$ ./test 1
(t-doko)mwhudson@arm64:~$ ./test 11
bigger
(t-doko)mwhudson@arm64:~$ ./test 0 
bigger
(t-doko)mwhudson@arm64:~$ gcc-4.9 -O0 test.c -o test -Wall
(t-doko)mwhudson@arm64:~$ ./test 1
(t-doko)mwhudson@arm64:~$ ./test 11
bigger
(t-doko)mwhudson@arm64:~$ ./test 0
(t-doko)mwhudson@arm64:~$ 

What's going on?  Here's the disassembly of is_bigger (at O3):

0000000000400608 <is_bigger>:
  400608:       b0000082        adrp    x2, 411000 <_GLOBAL_OFFSET_TABLE_+0x28>
  40060c:       91010042        add     x2, x2, #0x40
  400610:       a9bf7bfd        stp     x29, x30, [sp,#-16]!
  400614:       52800003        mov     w3, #0x0                        // #0
  400618:       910003fd        mov     x29, sp
  40061c:       b8a1d841        ldrsw   x1, [x2,w1,sxtw #2]
  400620:       ab00003f        cmn     x1, x0
  400624:       540000a2        b.cs    400638 <is_bigger+0x30>
  400628:       90000000        adrp    x0, 400000 <_init-0x3f8>
  40062c:       911b6000        add     x0, x0, #0x6d8
  400630:       97ffff90        bl      400470 <puts@plt>
  400634:       52800023        mov     w3, #0x1                        // #1
  400638:       2a0303e0        mov     w0, w3
  40063c:       a8c17bfd        ldp     x29, x30, [sp],#16
  400640:       d65f03c0        ret

Basically it seems that the condition "-offset > val" is being compiled as "val
+ offset does not overflow", which is not valid for offset == 0.

[Bug target/59744] miscompilation of unsigned comparison on aarch64

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-01-10
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(insn 14 13 15 2 (set (reg:CC_SWP 66 cc)
        (compare:CC_SWP (neg:DI (reg:DI 0 x0 [ offset ]))
            (reg:DI 1 x1 [orig:85 D.3895 ] [85]))) t7.c:11 114 {*compare_negdi}
     (expr_list:REG_DEAD (reg:DI 1 x1 [orig:85 D.3895 ] [85])
        (expr_list:REG_DEAD (reg:DI 0 x0 [ offset ])
            (nil))))

--- CUT ---
Here is a testcase that fails at -O1 and above without any arguments.

int a[2] = { 10, 20 };

int
is_bigger (long, int) __attribute__((noinline,noclone));

int
is_bigger (long offset, int index)
{
  unsigned long size = -offset;

  if (size > a[index])
   return 1;

  return 0;
}


int
main (int argc, char** argv)
{
  long v;
  if (is_bigger(0, 0))
    __builtin_abort ();
  if (!is_bigger(1, 0))
    __builtin_abort ();
  if (is_bigger(-10, 0))
    __builtin_abort ();
  if (!is_bigger(10, 0))
    __builtin_abort ();
  return 0;
}

[Bug target/59744] miscompilation of unsigned comparison on aarch64

[rearnsha at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

--- Comment #2 from Richard Earnshaw <rearnsha at gcc dot gnu.org> ---
Author: rearnsha
Date: Fri Jan 10 15:21:21 2014
New Revision: 206530

URL: http://gcc.gnu.org/viewcvs?rev=206530&root=gcc&view=rev
Log:
PR target/59744
Fix ChangeLog typos in previous commit (r206529).


Modified:
    trunk/gcc/ChangeLog

[Bug target/59744] miscompilation of unsigned comparison on aarch64

[rearnsha at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

Richard Earnshaw <rearnsha at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |4.9.0

--- Comment #3 from Richard Earnshaw <rearnsha at gcc dot gnu.org> ---
Fixed on trunk

[Bug target/59744] miscompilation of unsigned comparison on aarch64

[michael.hudson at linaro dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

--- Comment #4 from Michael Hudson-Doyle <michael.hudson at linaro dot org> ---
Hi, thanks for the super fast fix.  Could it be backported to 4.8?  git
cherry-pick gives a conflict in aarch64.md which is probably easy to fix if you
know how this code works:

(define_insn "*compare_neg<mode>"
<<<<<<< HEAD
  [(set (reg:CC CC_REGNUM)
    (compare:CC
     (match_operand:GPI 0 "register_operand" "r")
     (neg:GPI (match_operand:GPI 1 "register_operand" "r"))))]
||||||| parent of 46b590a...     PR target/9744
  [(set (reg:CC_SWP CC_REGNUM)
    (compare:CC_SWP
     (neg:GPI (match_operand:GPI 0 "register_operand" "r"))
     (match_operand:GPI 1 "register_operand" "r")))]
=======
  [(set (reg:CC_Z CC_REGNUM)
    (compare:CC_Z
     (neg:GPI (match_operand:GPI 0 "register_operand" "r"))
     (match_operand:GPI 1 "register_operand" "r")))]
>>>>>>> 46b590a... 	PR target/9744
  ""
  "cmn\\t%<w>0, %<w>1"
  [(set_attr "v8type" "alus")
   (set_attr "mode" "<MODE>")]
)
>From gcc-bugs-return-440167-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Jan 13 01:22:07 2014
Return-Path: <gcc-bugs-return-440167-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 9344 invoked by alias); 13 Jan 2014 01:22:06 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 9321 invoked by uid 55); 13 Jan 2014 01:22:03 -0000
From: "joseph at codesourcery dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/59778] FAIL: gcc.dg/atomic/c11-atomic-exec-5.c
Date: Mon, 13 Jan 2014 01:22:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: joseph at codesourcery dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-59778-4-StYUn7asQ7@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-59778-4@http.gcc.gnu.org/bugzilla/>
References: <bug-59778-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-01/txt/msg01309.txt.bz2
Content-length: 245

http://gcc.gnu.org/bugzilla/show_bug.cgi?idY778

--- Comment #1 from joseph at codesourcery dot com <joseph at codesourcery dot com> ---
Please see the advice to architecture maintainers at
<http://gcc.gnu.org/ml/gcc/2013-11/msg00131.html>.

[Bug target/59744] miscompilation of unsigned comparison on aarch64

[rearnsha at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

--- Comment #5 from Richard Earnshaw <rearnsha at gcc dot gnu.org> ---
I don't expect that pattern to match on 4.8 (the pattern is not canonical
form), which is why this wasn't seen before.

If you can find a test-case that triggers on that branch, I'll do a back-port;
otherwise, there's no point.

[Bug target/59744] miscompilation of unsigned comparison on aarch64

[ktkachov at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

--- Comment #6 from ktkachov at gcc dot gnu.org ---
I couldn't reproduce the failure using 4.8.

[Bug target/59744] miscompilation of unsigned comparison on aarch64

[yroux at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59744

--- Comment #8 from yroux at gcc dot gnu.org ---
Author: yroux
Date: Mon Aug 11 22:08:03 2014
New Revision: 213842

URL: https://gcc.gnu.org/viewcvs?rev=213842&root=gcc&view=rev
Log:
gcc/
2014-08-11  Michael Collison  <michael.collison@linaro.org>

    Backport from trunk r206529, r206530
    2014-01-10  Richard Earnshaw  <rearnsha@arm.com>

    PR target/59744
    * aarch64-modes.def (CC_Zmode): New flags mode.
    * aarch64.c (aarch64_select_cc_mode): Only allow NEG when the condition
    represents an equality.
    (aarch64_get_condition_code): Handle CC_Zmode.
    * aarch64.md (compare_neg<mode>): Restrict to equality operations.

gcc/testsuite/
2014-08-11  Michael Collison  <michael.collison@linaro.org>

    Backport from trunk r206529
    2014-01-10  Richard Earnshaw  <rearnsha@arm.com>

    PR target/59744
    * gcc.target/aarch64/cmn-neg.c: Use equality comparisons.
    * gcc.target/aarch64/cmn-neg2.c: New test.


Added:
    branches/linaro/gcc-4_8-branch/gcc/testsuite/gcc.target/aarch64/cmn-neg2.c
Modified:
    branches/linaro/gcc-4_8-branch/gcc/ChangeLog.linaro
    branches/linaro/gcc-4_8-branch/gcc/config/aarch64/aarch64-modes.def
    branches/linaro/gcc-4_8-branch/gcc/config/aarch64/aarch64.c
    branches/linaro/gcc-4_8-branch/gcc/config/aarch64/aarch64.md
    branches/linaro/gcc-4_8-branch/gcc/testsuite/ChangeLog.linaro
    branches/linaro/gcc-4_8-branch/gcc/testsuite/gcc.target/aarch64/cmn-neg.c