From 1820137ba624d7eb2004a10f9632498b6bc1696a Mon Sep 17 00:00:00 2001
From: Jakub Jelinek <jakub@redhat.com>
Date: Thu, 30 Dec 2021 14:23:18 +0100
Subject: [PATCH] shrink-wrapping: Fix up prologue block discovery [PR103860]

The following testcase is miscompiled, because a prologue which
contains subq $8, %rsp instruction is emitted at the start of
a basic block which contains conditional jump that depends on
flags register set in an earlier basic block, the prologue instruction
then clobbers those flags.
Normally this case is checked by can_get_prologue predicate, but this
is done only at the start of the loop.  If we update pro later in the
loop (because some bb shouldn't be duplicated) and then don't push
anything further into vec and the vec is already empty (this can happen
when the new pro is already in bb_with bitmask and either has no successors
(that is the case in the testcase where that bb ends with a trap) or
all the successors are already in bb_with, then the loop doesn't iterate
further and can_get_prologue will not be checked.

The following simple patch makes sure we call can_get_prologue even after
the last former iteration when vec is already empty and only break from
the loop afterwards (and only if the updating of pro done because of
!can_get_prologue didn't push anything into vec again).

2021-12-30  Jakub Jelinek  <jakub@redhat.com>

	PR rtl-optimization/103860
	* shrink-wrap.c (try_shrink_wrapping): Make sure can_get_prologue is
	called on pro even if nothing further is pushed into vec.

	* gcc.dg/pr103860.c: New test.
---
 gcc/shrink-wrap.c               |  5 ++++-
 gcc/testsuite/gcc.dg/pr103860.c | 31 +++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 gcc/testsuite/gcc.dg/pr103860.c

diff --git a/gcc/shrink-wrap.c b/gcc/shrink-wrap.c
index 5e60f34f7492..35149ecd84c6 100644
--- a/gcc/shrink-wrap.c
+++ b/gcc/shrink-wrap.c
@@ -781,7 +781,7 @@ try_shrink_wrapping (edge *entry_edge, rtx_insn *prologue_seq)
   unsigned max_grow_size = get_uncond_jump_length ();
   max_grow_size *= param_max_grow_copy_bb_insns;
 
-  while (!vec.is_empty () && pro != entry)
+  while (pro != entry)
     {
       while (pro != entry && !can_get_prologue (pro, prologue_clobbered))
 	{
@@ -791,6 +791,9 @@ try_shrink_wrapping (edge *entry_edge, rtx_insn *prologue_seq)
 	    vec.quick_push (pro);
 	}
 
+      if (vec.is_empty ())
+	break;
+
       basic_block bb = vec.pop ();
       if (!can_dup_for_shrink_wrapping (bb, pro, max_grow_size))
 	while (!dominated_by_p (CDI_DOMINATORS, bb, pro))
diff --git a/gcc/testsuite/gcc.dg/pr103860.c b/gcc/testsuite/gcc.dg/pr103860.c
new file mode 100644
index 000000000000..15eee558083d
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr103860.c
@@ -0,0 +1,31 @@
+/* PR rtl-optimization/103860 */
+/* { dg-do run } */
+/* { dg-options "-O3" } */
+/* { dg-additional-options "-fPIC" { target fpic } } */
+
+static int d, *e;
+int f;
+
+__attribute__((noinline)) signed char
+foo (signed char b, signed char c)
+{
+  return b + c;
+}
+
+int
+main ()
+{
+  signed char l;
+  for (l = -1; l; l = foo (l, 1))
+    {
+      while (d < 0)
+	;
+      if (d > 0)
+	{
+	  f = 0;
+	  *e = 0;
+	}
+    }
+  d = 0;
+  return 0;
+}