From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-prs-return-13129-listarch-gcc-prs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 24931 invoked by alias); 21 Dec 2001 14:56:00 -0000
Mailing-List: contact gcc-prs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Archive: <http://gcc.gnu.org/ml/gcc-prs/>
List-Post: <mailto:gcc-prs@gcc.gnu.org>
List-Help: <mailto:gcc-prs-help@gcc.gnu.org>
Sender: gcc-prs-owner@gcc.gnu.org
Received: (qmail 24904 invoked by uid 71); 21 Dec 2001 14:56:00 -0000
Resent-Date: 21 Dec 2001 14:56:00 -0000
Resent-Message-ID: <20011221145600.24903.qmail@sources.redhat.com>
Resent-From: gcc-gnats@gcc.gnu.org (GNATS Filer)
Resent-To: nobody@gcc.gnu.org
Resent-Cc: gcc-prs@gcc.gnu.org, gcc-bugs@gcc.gnu.org
Resent-Reply-To: gcc-gnats@gcc.gnu.org, Klaus.k.pedersen@nokia.com
Received:(qmail 23551 invoked by uid 61); 21 Dec 2001 14:50:08 -0000
Message-Id:<20011221145008.23546.qmail@sources.redhat.com>
Date: Fri, 21 Dec 2001 06:56:00 -0000
From: Klaus.k.pedersen@nokia.com
Reply-To: Klaus.k.pedersen@nokia.com
To: gcc-gnats@gcc.gnu.org
X-Send-Pr-Version:gnatsweb-2.9.3 (1.1.1.1.2.31)
Subject: target/5170: Supicious code in arm.md
X-SW-Source: 2001-12/txt/msg01037.txt.bz2
List-Id: <gcc-prs.sourceware.org>


>Number:         5170
>Category:       target
>Synopsis:       Supicious code in arm.md
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Dec 21 06:56:00 PST 2001
>Closed-Date:
>Last-Modified:
>Originator:     Klaus Pedersen
>Release:        gcc version 3.1 20011203 (experimental)
>Organization:
>Environment:
nice
>Description:
See also target/5107, investigated by Richard Earnshaw <rearnsha@arm.com>

The arm.md file defines the split pattern
 
 (define_split 
   [(set (match_operand:SI 0 "register_operand" "")
         (match_operand:SI 1 "const_int_operand" ""))]
   "TARGET_THUMB && CONST_OK_FOR_THUMB_LETTER (INTVAL (operands[1]), 'K')"
   [(set (match_dup 0) (match_dup 1))
    (set (match_dup 0) (ashift:SI (match_dup 0) (match_dup 2)))]
   "
   {
     unsigned HOST_WIDE_INT val = INTVAL (operands[1]);
     unsigned HOST_WIDE_INT mask = 0xff;
     int i;
     
     for (i = 0; i < 25; i++)
       if ((val & (mask << i)) == val)
         break;
 
     if (i == 0)
       FAIL;
 
     operands[1] = GEN_INT (val >> i);
     operands[2] = GEN_INT (i);
   }"


I think that there is a bug here:
 
>     for (i = 0; i < 25; i++)
>       if ((val & (mask << i)) == val)
>         break;
> 
>     if (i == 0)
>       FAIL;
 
Consider "val = 0x55", which can be represented as 0x55 << 0, but
calling the function with this value causes the function FAIL to
be called.
 
On the other hand, FAIL isn't called when passing the constant 0x101, 
which can't be represented, therefor I think that:
 
>     if (i == 0)
>       FAIL;
 
should read:
 
>     if (i == 25)
>       FAIL;
 
 
BR, Klaus Pedersen
 
>How-To-Repeat:
Well I have to admit it - I haven't been able to find
code affected by this typo. So if it is redundant - it
probably should be removed.
>Fix:
change 
   if (i == 0)
to 
   if (i == 25)
>Release-Note:
>Audit-Trail:
>Unformatted: