[Bug tree-optimization/65177] [5 Regression]: extend jump thread for finite state automata causes miscompilation

["marxin at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65177

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #0)
> Hello.
> 
> Starting with r218451, http://hmmer.janelia.org/ started to be miscompiled.
> 
> Steps to reproduce:
> wget
> http://selab.janelia.org/software/hmmer3/3.1b1/hmmer-3.1b1-linux-intel-
> x86_64.tar.gz
> tar xvzf hmmer-3.1b1-cygwin.tar.gz 
> cd hmmer-3.1b1-cygwin
> CFLAGS="-g -O1 -ftree-vrp -fexpensive-optimizations" ./configure
> make
> make check
> 
> and following test fails:
> gdb src/impl_sse/optacc_utest 
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000000000406a2c in select_i (k=<optimized out>, i=0, gx=0x45ed60,
> gm=0x470420) at generic_optacc.c:293
> 293	  path[0] = TSCDELTA(p7P_MI, k) * MMX(i-1,k);
> (gdb) bt
> #0  0x0000000000406a2c in select_i (k=<optimized out>, i=0, gx=0x45ed60,
> gm=0x470420) at generic_optacc.c:293

The reason for memory corruption is caused by select_i function called with i
== 0, which causes memory load for array[-1].

Martin

> #1  p7_GOATrace (gm=0x470420, pp=pp@entry=0x466150, gx=gx@entry=0x45ed60,
> tr=tr@entry=0x46e4e0) at generic_optacc.c:220
> #2  0x000000000040322f in utest_optacc (go=go@entry=0x44e010,
> r=r@entry=0x44e170, abc=abc@entry=0x44eb50, bg=bg@entry=0x44ed90,
> M=M@entry=45, L=L@entry=50, N=19) at ./optacc.c:659
> #3  0x0000000000403613 in main (argc=<optimized out>, argv=<optimized out>)
> at ./optacc.c:801
> 
> I really tried to reduce test case, but unfortunately it's very hard to do
> it for the project.
> Please tell me if you are capable of reproducing the issue?
> 
> Thanks,
> Martin
>From gcc-bugs-return-478193-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Feb 23 16:45:18 2015
Return-Path: <gcc-bugs-return-478193-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 28149 invoked by alias); 23 Feb 2015 16:45:18 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 28078 invoked by uid 48); 23 Feb 2015 16:45:13 -0000
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/65032] [5 Regression] ICE in reload_combine_note_use, at postreload.c:1556 on i686-linux-gnu
Date: Mon, 23 Feb 2015 17:46:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: ice-on-valid-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-65032-4-kE9AXyavg3@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-65032-4@http.gcc.gnu.org/bugzilla/>
References: <bug-65032-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-02/txt/msg02525.txt.bz2
Content-length: 2075

https://gcc.gnu.org/bugzilla/show_bug.cgi?ide032

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
So, from what I can see, the problem is that we have during IRA:
(insn 48 47 49 6 (parallel [
            (set (reg:DI 93 [ D.2201 ])
                (sign_extend:DI (reg/v:SI 88 [ b ])))
            (clobber (reg:CC 17 flags))
            (clobber (scratch:SI))
        ]) pr65032.C:79 143 {extendsidi2_1}
     (expr_list:REG_UNUSED (reg:CC 17 flags)
        (nil)))
(insn 50 93 51 6 (parallel [
            (set (reg:DI 111 [ D.2201 ])
                (neg:DI (reg:DI 93 [ D.2201 ])))
            (clobber (reg:CC 17 flags))
        ]) pr65032.C:79 450 {*negdi2_doubleword}
     (expr_list:REG_UNUSED (reg:CC 17 flags)
        (nil)))
and LRA turns this into:
(insn 48 47 49 6 (parallel [
            (set (mem/c:DI (plus:SI (reg/f:SI 7 sp)
                        (const_int 8 [0x8])) [13 %sfp+-24 S8 A64])
                (sign_extend:DI (reg/v:SI 5 di [orig:88 b ] [88])))
            (clobber (reg:CC 17 flags))
            (clobber (reg:SI 0 ax [118]))
        ]) pr65032.C:79 143 {extendsidi2_1}
     (nil))
(insn 104 93 101 6 (parallel [
            (set (reg:DI 0 ax [orig:111 D.2201 ] [111])
                (sign_extend:DI (reg/v:SI 5 di [orig:88 b ] [88])))
            (clobber (reg:CC 17 flags))
            (clobber (reg:SI 118))
        ]) pr65032.C:79 143 {extendsidi2_1}
     (nil))
(insn 50 101 102 6 (parallel [
            (set (reg:DI 0 ax [orig:111 D.2201 ] [111])
                (neg:DI (reg:DI 0 ax [orig:111 D.2201 ] [111])))
            (clobber (reg:CC 17 flags))
        ]) pr65032.C:79 450 {*negdi2_doubleword}
     (nil))
and the problem is the (clobber (reg:SI 118)) kept in the IL.  The constraint
for it there is "=X", but despite that accepting anything, postreload really
doesn't like pseudos kept around in the instructions.
Dunno if (scratch:SI) instead would be still acceptable post-reload, or if we
need some other way to express we really don't care about the clobber (the insn
will be split during split2 pass).