[Bug target/93934] Unnecessary fld of uninitialized float stack variable results in ub of valid C++ code

["rguenther at suse dot de" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93934

--- Comment #22 from rguenther at suse dot de <rguenther at suse dot de> ---
On Thu, 14 Oct 2021, ubizjak at gmail dot com wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93934
> 
> --- Comment #20 from Uroš Bizjak <ubizjak at gmail dot com> ---
> (In reply to joseph@codesourcery.com from comment #16)
> > I don't think this bug is anything to do with -fsignaling-nans, for the 
> > same reason as applies to bug 58416 and bug 71460.
> 
> The situation is hopeless from the beginning. Please consider this testcase:
> 
> --cut here--
> #include <cpuid.h>
> #include <fenv.h>
> 
> double
> __attribute__((noinline,noipa))
> foo (double a, double b, char c)
> {
>   return c ? a : b;
> }
> 
> int main ()
> {
>   double a = __builtin_nans ("");
>   double b = 42.0;
> 
>   feclearexcept (FE_INVALID);
>   foo (a, b, 0);
>   if (fetestexcept (FE_INVALID))
>     __builtin_abort ();
> 
>   return 0;
> }
> --cut here--
> 
> $ gcc -O2 -m32 -march=i686 -lm fcmov.c
> $ ./a.out 
> Aborted (core dumped)
> $ gcc -O2 -m32 -march=i386 -lm fcmov.c
> $ ./a.out 
> Aborted (core dumped)
> 
> Because the compiler generates:
> 
> foo:
>         cmpb    $0, 20(%esp)
>         fldl    12(%esp)
>         fldl    4(%esp)
>         fcmove  %st(1), %st
>         fstp    %st(1)
>         ret
> 
> in the former case and:
> 
> foo:
>         fldl    4(%esp)
>         fldl    12(%esp)
>         cmpb    $0, 20(%esp)
>         jne     .L4
>         fstp    %st(1)
>         jmp     .L2
> .L4:
>         fstp    %st(0)
> .L2:
>         ret
> 
> in the later.
> 
> Since the ABI specifies the operand size on the stack, the above code will
> always trap.

Indeed and since those loads from the argument space appear as registers
in GIMPLE there's nothing avoiding "speculative" accesses to those so
the issue for argument slots are much harder to mitigate.  I also think
that RTL expansion happily puts those loads in the prologue rather
than next to the first use.