[Bug ipa/66424] New: wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[Bug ipa/66424] New: wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

            Bug ID: 66424
           Summary: wrong code at -O2 and -O3 on x86_64-linux-gnu in
                    32-bit mode
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu
  Target Milestone: ---

The current gcc trunk (and 5.1.x) miscompiles the following code on
x86_64-linux at -O2 and -O3 in 32-bit mode (but not in 64-bit mode).  

This is a regression from 4.9.x.


$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 6.0.0 20150604 (experimental) [trunk revision 224114] (GCC) 
$ 
$ gcc-trunk -m32 -Os small.c; ./a.out
small.c: In function ‘fn1’:
small.c:7:1: warning: type of ‘p’ defaults to ‘int’ [-Wimplicit-int]
 fn1 (p)
 ^
$ gcc-trunk -m64 -O2 small.c; ./a.out
small.c: In function ‘fn1’:
small.c:7:1: warning: type of ‘p’ defaults to ‘int’ [-Wimplicit-int]
 fn1 (p)
 ^
$ gcc-4.9.2 -m32 -O2 small.c; ./a.out
$ 
$ gcc-trunk -m32 -O2 small.c
small.c: In function ‘fn1’:
small.c:7:1: warning: type of ‘p’ defaults to ‘int’ [-Wimplicit-int]
 fn1 (p)
 ^
$ ./a.out
Aborted (core dumped)
$ 


---------------------------------------


int a, b, c, d, e[2], f, l, m, n, o;
long long g = 1, j;
static unsigned int h;
static int i, k;

void
fn1 (p)
{
  f = 1 ^ e[f ^ (p & 1)];
}

static void
fn2 (long long p)
{
  f = 1 ^ e[(f ^ 1) & 1];
  fn1 (p >> 1 & 1);
  fn1 (p >> 32 & 1);
}

void
fn3 (int p)
{
  g |= j = p;
}

int
main ()
{
  e[0] = 1;
  char p = l;
  h = --g;
  i = o = c;
  m = d ? 1 / d : 0;
  fn3 (l || 0);
  b = a;
  n = j++;
  k--;
  fn2 (g);
  fn2 (h);
  fn2 (i);

  if (k + f)
    __builtin_abort ();

  return 0;
}
>From gcc-bugs-return-488129-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jun 04 23:26:46 2015
Return-Path: <gcc-bugs-return-488129-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 70807 invoked by alias); 4 Jun 2015 23:26:46 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 70778 invoked by uid 48); 4 Jun 2015 23:26:42 -0000
From: "dje at google dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug libstdc++/65669] Don't emit debug info for fake_ostream version of cerr (and others)
Date: Thu, 04 Jun 2015 23:26:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: libstdc++
X-Bugzilla-Version: 4.9.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: dje at google dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-65669-4-31zvChOtkB@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-65669-4@http.gcc.gnu.org/bugzilla/>
References: <bug-65669-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-06/txt/msg00461.txt.bz2
Content-length: 370

https://gcc.gnu.org/bugzilla/show_bug.cgi?ide669

--- Comment #3 from Doug Evans <dje at google dot com> ---
(In reply to Doug Evans from comment #2)
> I was wondering if one could just do a strip --strip-debug of globals_io.o
> in the Makefile.

This doesn't work, as is, because gdb ignores the DIE with the real type (from
ios_init.cc) because it's a declaration.

[Bug ipa/66424] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |jakub at gcc dot gnu.org
         Resolution|---                         |INVALID

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
That looks like undefined behavior in the testcase.  fn1 is K&R function with
int argument, like if it was:
void
fn1 (p)
  int p;
{
  f = 1 ^ e[f ^ (p & 1)];
}
but you are calling it with long long argument instead in fn2.  If I change
it to void fn1 (p) long long p; { ... } or void fn1 (int p) { ... } or
change fn2 callers to cast the expressions to (int), it works fine.

[Bug ipa/66424] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

--- Comment #2 from Zhendong Su <su at cs dot ucdavis.edu> ---
Jakub, I'm not sure that the code is invalid. First, the type of p in fn1 is
defaulted to int. Second, all the invocations of fn1 from fn2 are with the same
argument 0LL, which int can represent. 

Also, none of ubsan, Frama-C, and CompCert's reference interpreter complains
about the code.

[Bug ipa/66424] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[joseph at codesourcery dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

--- Comment #3 from joseph at codesourcery dot com <joseph at codesourcery dot com> ---
See C11 6.5.2.2#6 regarding when calls to unprototyped functions involve 
undefined behavior.  Being able to represent the value is only relevant 
where the case is a mismatch of corresponding signed/unsigned types.

[Bug ipa/66424] [5/6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |NEW
   Last reconfirmed|                            |2015-06-05
                 CC|                            |vmakarov at gcc dot gnu.org
         Resolution|INVALID                     |---
   Target Milestone|---                         |5.2
            Summary|wrong code at -O2 and -O3   |[5/6 Regression] wrong code
                   |on x86_64-linux-gnu in      |at -O2 and -O3 on
                   |32-bit mode                 |x86_64-linux-gnu in 32-bit
                   |                            |mode
     Ever confirmed|0                           |1

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Apparently it reproduces also with following, which doesn't have at least this
kind of undefined behavior in it.  Started with r217588, thus most likely a
register allocation issue.

int a, b, c, d, e[2], f, l, m, n, o;
long long g = 1, j;
static unsigned int h;
static int i, k;

void
fn1 (long long p)
{
  int q = p;
  f = 1 ^ e[f ^ (q & 1)];
}

static void
fn2 (long long p)
{
  f = 1 ^ e[(f ^ 1) & 1];
  fn1 (p >> 1 & 1);
  fn1 (p >> 32 & 1);
}

void
fn3 (int p)
{
  g |= j = p;
}

int
main ()
{
  e[0] = 1;
  char p = l;
  h = --g;
  i = o = c;
  m = d ? 1 / d : 0;
  fn3 (l || 0);
  b = a;
  n = j++;
  k--;
  fn2 (g);
  fn2 (h);
  fn2 (i);

  if (k + f)
    __builtin_abort ();

  return 0;
}

[Bug ipa/66424] [5/6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
      Known to work|                            |4.9.3

[Bug ipa/66424] [5/6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|5.2                         |5.3

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 5.2 is being released, adjusting target milestone to 5.3.

[Bug ipa/66424] [5/6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[vmakarov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

--- Comment #8 from Vladimir Makarov <vmakarov at gcc dot gnu.org> ---
Author: vmakarov
Date: Tue Jul 21 19:54:23 2015
New Revision: 226053

URL: https://gcc.gnu.org/viewcvs?rev=226053&root=gcc&view=rev
Log:
2015-07-21  Vladimir Makarov  <vmakarov@redhat.com>

        PR ipa/66424.
        * lra-remat.c (operand_to_remat): Prevent using insns with input
        subregs processed separately by IRA.

2015-07-21  Vladimir Makarov  <vmakarov@redhat.com>

        PR ipa/66424.
        * gcc.target/i386/pr66424.c: New.


Added:
    trunk/gcc/testsuite/gcc.target/i386/pr66424.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/lra-remat.c
    trunk/gcc/testsuite/ChangeLog

[Bug ipa/66424] [5/6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[vmakarov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

--- Comment #9 from Vladimir Makarov <vmakarov at gcc dot gnu.org> ---
Author: vmakarov
Date: Tue Sep 29 16:37:26 2015
New Revision: 228256

URL: https://gcc.gnu.org/viewcvs?rev=228256&root=gcc&view=rev
Log:
2015-09-29  Vladimir Makarov  <vmakarov@redhat.com>

        Backport from mainline
        2015-07-21  Vladimir Makarov  <vmakarov@redhat.com>

        PR ipa/66424.
        * lra-remat.c (operand_to_remat): Prevent using insns with input
        subregs processed separately by IRA.

2015-09-29  Vladimir Makarov  <vmakarov@redhat.com>

        Backport from mainline
        2015-07-21  Vladimir Makarov  <vmakarov@redhat.com>

        PR ipa/66424.
        * gcc.target/i386/pr66424.c: New.


Added:
    branches/gcc-5-branch/gcc/testsuite/gcc.target/i386/pr66424.c
Modified:
    branches/gcc-5-branch/gcc/ChangeLog
    branches/gcc-5-branch/gcc/lra-remat.c
    branches/gcc-5-branch/gcc/testsuite/ChangeLog

[Bug ipa/66424] [5/6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[doko at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

Matthias Klose <doko at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Matthias Klose <doko at gcc dot gnu.org> ---
fixed on trunk and the gcc-5 branch.

[Bug ipa/66424] [5/6 Regression] wrong code at -O2 and -O3 on x86_64-linux-gnu in 32-bit mode

[aurelien at aurel32 dot net]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66424

Aurelien Jarno <aurelien at aurel32 dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aurelien at aurel32 dot net

--- Comment #11 from Aurelien Jarno <aurelien at aurel32 dot net> ---
For the record this bug badly affects the MIPS target when using
-mtune=mips32r2, option which is implied by the -march=mips32r2 option. This
causes for example ffmpeg to be miscompiled, which causes its testsuite to fail
completely.

It's not a problem anymore now that the bug has been fixed on the gcc-5-branch,
however I prefer to mention it here, so that people debugging this issue find
this bug.