From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-487638-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 47352 invoked by alias); 30 May 2015 22:22:35 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Received: (qmail 47325 invoked by uid 48); 30 May 2015 22:22:31 -0000
From: "sebastiano.vigna at unimi dot it" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/66348] New: Simple loop with 64-bit index has only lower half initialized correctly
Date: Sat, 30 May 2015 22:22:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 4.9.2
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: sebastiano.vigna at unimi dot it
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created
Message-ID: <bug-66348-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-05/txt/msg02478.txt.bz2

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66348

            Bug ID: 66348
           Summary: Simple loop with 64-bit index has only lower half
                    initialized correctly
           Product: gcc
           Version: 4.9.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sebastiano.vigna at unimi dot it
  Target Milestone: ---

Created attachment 35657
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35657&action=edit
Source (buffer.c) and a bunch of header files

This is a fragment of ne, the nice editor:

line_desc *nth_line_desc(const buffer *b, const int64_t n) {
   if (n < 0 || n >= b->num_lines) return NULL;

   line_desc *ld;
   const int64_t best_absolute_cost = min(n, b->num_lines - 1 - n);
   const int64_t relative_cost = b->cur_line < n ? n - b->cur_line :
b->cur_line - n;

   if (best_absolute_cost < relative_cost) {
      if (n < b->num_lines / 2) {
         ld = (line_desc *)b->line_desc_list.head;
         for(int64_t i = 0; i < n; i++) ld = (line_desc *)ld->ld_node.next;
      }
      else {
         ld = (line_desc *)b->line_desc_list.tail_pred;
         // Problematic loop
         for(int64_t i = 0; i < b->num_lines - 1 - n; i++) ld = (line_desc
*)ld->ld_node.prev;;
      }
   }
   else {
      ld = (line_desc *)b->cur_line_desc;
      if (n < b->cur_line) for(int64_t i = 0; i < b->cur_line - n; i++) ld =
(line_desc *)ld->ld_node.prev;
      else for(int64_t i = 0; i < n - b->cur_line; i++) ld = (line_desc
*)ld->ld_node.next;
   }

   return ld;
}

The loop commented as "problematic loop" is compiled (with -O3) as

        xorl    %eax, %eax      # i
        .p2align 4,,10
        .p2align 3
.L527:
        addq    $1, %rax        #, i
        movq    8(%rbx), %rbx   # ld_64->ld_node.prev, ld
        cmpq    %rdx, %rax      # D.11490, i
        jne     .L527   #,


That is, the loop index i is in %rax, but only the lower half is zeroed at the
start of the loop. When we enter the loop with a large (>32-bit) value, the
loop never ends. This happens already with -O1. We had to #pragma the function
to -O0 to make it work.

I have attached a bunch of header files and the source of the file containing
the function. Compile with 

gcc -std=c99 -D_GNU_SOURCE -D__USE_GNU -DSTDC_HEADERS -Dinline=__inline__ -O3
-DNDEBUG -c -S -fverbose-asm buffer.c

to get the code above.