[Bug middle-end/59824] New: [4.9 Regression] r206418 miscompiles ffmpeg

[Bug middle-end/59824] New: [4.9 Regression] r206418 miscompiles ffmpeg

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59824

            Bug ID: 59824
           Summary: [4.9 Regression] r206418 miscompiles ffmpeg
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org

Starting with r206418 ffmpeg gets miscompiled:

 % mplayer movie.avi
...
Program received signal SIGSEGV, Segmentation fault.
ff_mpeg4_set_one_direct_mv (i=0, my=0, mx=0, s=0x55555588e180) at
libavcodec/mpeg4video.c:111
111             s->mv[0][i][1] = s->direct_scale_mv[0][p_my + tab_bias] + my;
(gdb) bt
#0  ff_mpeg4_set_one_direct_mv (i=0, my=0, mx=0, s=0x55555588e180) at
libavcodec/mpeg4video.c:111
#1  ff_mpeg4_set_direct_mv (s=s@entry=0x55555588e180, mx=mx@entry=0, my=0) at
libavcodec/mpeg4video.c:172
#2  0x00007ffff67e5f33 in mpeg4_decode_mb (s=0x55555588e180,
block=0x555555aa65c0) at libavcodec/mpeg4videodec.c:1580
#3  0x00007ffff6655a44 in decode_slice (s=s@entry=0x55555588e180) at
libavcodec/h263dec.c:238
#4  0x00007ffff6656666 in ff_h263_decode_frame (avctx=0x555555887c80,
data=0x5555558879e0, got_frame=0x7fffffffcfd4, avpkt=<optimized out>) at
libavcodec/h263dec.c:587
#5  0x00007ffff68ff5be in avcodec_decode_video2 (avctx=0x555555887c80,
picture=0x5555558879e0, got_picture_ptr=0x7fffffffcfd4, avpkt=0x7fffffffd000)
    at libavcodec/utils.c:2123
#6  0x00005555556b061a in decode ()
#7  0x00005555556012e4 in decode_video ()
#8  0x00005555555a8a3d in update_video ()
#9  0x000055555559c494 in main ()
(gdb) 

It looks like the following function (from libavcodec/mpeg4video.c) gets
miscompiled:

 90 static inline void ff_mpeg4_set_one_direct_mv(MpegEncContext *s, int mx,
 91                                               int my, int i)
 92 {
 93     int xy           = s->block_index[i];
 94     uint16_t time_pp = s->pp_time;
 95     uint16_t time_pb = s->pb_time;
 96     int p_mx, p_my;
 97
 98     p_mx = s->next_picture.motion_val[0][xy][0];
 99     if ((unsigned)(p_mx + tab_bias) < tab_size) {
100         s->mv[0][i][0] = s->direct_scale_mv[0][p_mx + tab_bias] + mx;
101         s->mv[1][i][0] = mx ? s->mv[0][i][0] - p_mx
102                             : s->direct_scale_mv[1][p_mx + tab_bias];
103     } else {
104         s->mv[0][i][0] = p_mx * time_pb / time_pp + mx;
105         s->mv[1][i][0] = mx ? s->mv[0][i][0] - p_mx
106                             : p_mx * (time_pb - time_pp) / time_pp;
107     }
108     p_my = s->next_picture.motion_val[0][xy][1];
109     if ((unsigned)(p_my + tab_bias) < tab_size) {
110         s->mv[0][i][1] = s->direct_scale_mv[0][p_my + tab_bias] + my;
111         s->mv[1][i][1] = my ? s->mv[0][i][1] - p_my
112                             : s->direct_scale_mv[1][p_my + tab_bias];
113     } else {
114         s->mv[0][i][1] = p_my * time_pb / time_pp + my;
115         s->mv[1][i][1] = my ? s->mv[0][i][1] - p_my
116                             : p_my * (time_pb - time_pp) / time_pp;
117     }
118 }

When I put an "__attribute__ ((optimize(0)))" above it, ffmpeg no longer
crashes.

I will attach the proprocessed file.

[Bug middle-end/59824] [4.9 Regression] r206418 miscompiles ffmpeg

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59824

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Created attachment 31839
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31839&action=edit
miscompiled proprocessed file

[Bug middle-end/59824] [4.9 Regression] r206418 miscompiles ffmpeg

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59824

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
 gcc --save-temps -g -I. -I./ -D_ISOC99_SOURCE -D_FILE_OFFSET_BITS=64
-D_LARGEFILE_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -DPIC
-DHAVE_AV_CONFIG_H -std=c99 -fomit-frame-pointer -fPIC -pthread -D_GNU_SOURCE=1
-D_REENTRANT -I/usr/include/SDL -g -Wdeclaration-after-statement -Wall
-Wdisabled-optimization -Wpointer-arith -Wredundant-decls -Wwrite-strings
-Wtype-limits -Wundef -Wmissing-prototypes -Wno-pointer-to-int-cast
-Wstrict-prototypes -Wno-parentheses -Wno-switch -Wno-format-zero-length
-Wno-pointer-sign -O3 -fno-math-errno -fno-signed-zeros -fno-tree-vectorize
-Werror=implicit-function-declaration -Werror=missing-prototypes
-Werror=return-type -Werror=vla -Wno-maybe-uninitialized -MMD -MF
libavcodec/mpeg4video.d -MT libavcodec/mpeg4video.o -c -o
libavcodec/mpeg4video.o libavcodec/mpeg4video.c

[Bug middle-end/59824] [4.9 Regression] r206418 miscompiles ffmpeg

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59824

--- Comment #3 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Created attachment 31841
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31841&action=edit
-S output good

[Bug middle-end/59824] [4.9 Regression] r206418 miscompiles ffmpeg

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59824

--- Comment #4 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Created attachment 31842
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31842&action=edit
-S output bad

[Bug middle-end/59824] [4.9 Regression] r206418 miscompiles ffmpeg

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59824

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Can you try the PR59747 fix
http://gcc.gnu.org/ml/gcc-patches/2014-01/msg00703.html first?

[Bug middle-end/59824] [4.9 Regression] r206418 miscompiles ffmpeg

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59824

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #6 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #5)
> Can you try the PR59747 fix
> http://gcc.gnu.org/ml/gcc-patches/2014-01/msg00703.html first?

Thanks Jakub. The patch fixes the issue.
So dup of PR59747.

*** This bug has been marked as a duplicate of bug 59747 ***