From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-475807-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 29136 invoked by alias); 2 Feb 2015 17:25:47 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Received: (qmail 29086 invoked by uid 48); 2 Feb 2015 17:25:43 -0000
From: "spop at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/64878] [5 Regression] Miscompilation of nntpgrab
Date: Mon, 02 Feb 2015 17:25:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: spop at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P1
X-Bugzilla-Assigned-To: spop at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-64878-4-lPteMXkfLH@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-64878-4@http.gcc.gnu.org/bugzilla/>
References: <bug-64878-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-02/txt/msg00140.txt.bz2

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64878

--- Comment #4 from Sebastian Pop <spop at gcc dot gnu.org> ---
The problem is in the recursion step of
fsm_find_control_statement_thread_paths:


  for (i = 0; i < gimple_phi_num_args (phi); i++)
    {
      tree arg = gimple_phi_arg_def (phi, i);
      basic_block bbi = gimple_phi_arg_edge (phi, i)->src;
[...]
      if (TREE_CODE (arg) == SSA_NAME)
    {
      vec_safe_push (path, bbi);
      /* Recursively follow SSA_NAMEs looking for a constant definition.  */
      fsm_find_control_statement_thread_paths (arg, visited_phis, path);
      path->pop ();
      continue;
    }

We are not supposed to register a jump-thread following only one of the PHI
arguments, as the other arguments may resolve into a non-constant or a
different constant.

In the current case, we have 

      c = x->c1[x->c2];
      switch (a)
    {
    case 0:
      if (c == ' ')
        x->c2++;
      else if (c == '/')
        {
          a = 4;   // here is the first argument of the phi node
          j = x->c2++;
        }
      else
        a = b;    // recursive call will follow b and resolve into 15

         // here the phi node looks like
         // a0 = phi (4, b)

      break;
    case 1:
      switch (c)
        {
        case '{':
          a = 0;
          b = 15;
          f = f10 ();
          x->c2++;
          break;