possible volatile bug -- too many loads

[regehr]

Bugzilla Link	2776
Resolution	WORKSFORME
Resolved on	Oct 05, 2008 13:48
Version	unspecified
OS	Linux
CC	@lattner

Extended Description

This is for r55873 on Ubuntu Hardy on ia32. Looks to me like the right answer is loading g_45 just one time.

regehr@john-home:~/volatile/tmp26$ llvm-gcc -O1 -S --emit-llvm small.c -o foo.s ; llvm-as -f foo.s ; lli --force-interpreter --interpreter-print-volatile foo.s.bc
Volatile load %0 = volatile load i32* @​g_45, align 4 ; [#uses=0]
Volatile load %5 = volatile load i32* @​g_124, align 4 ; [#uses=1]
checksum = 0

regehr@john-home:~/volatile/tmp26$ llvm-gcc -O3 -S --emit-llvm small.c -o foo.s ; llvm-as -f foo.s ; lli --force-interpreter --interpreter-print-volatile foo.s.bc
Volatile load %0 = volatile load i32* @​g_45, align 4 ; [#uses=0]
Volatile load %1 = volatile load i32* @​g_45, align 4 ; [#uses=0]
Volatile load %2 = volatile load i32* @​g_124, align 4 ; [#uses=0]
Volatile load %1 = volatile load i32* @​g_45, align 4 ; [#uses=0]
checksum = 0

regehr@john-home:~/volatile/tmp26$ cat small.c

#include <stdio.h>

typedef signed char int8_t;
typedef short int int16_t;
typedef int int32_t;
typedef unsigned short int uint16_t;
typedef unsigned int uint32_t;

uint32_t g_20;
volatile uint32_t g_45 ;
int32_t g_83;
volatile uint32_t g_124;
volatile uint32_t g_208;

int32_t func_100 (uint32_t p_103);
int32_t func_100 (uint32_t p_103)
{
return 1;
}

int32_t func_119 (uint32_t p_120);
int32_t func_119 (uint32_t p_120)
{
return 1;
}

int32_t func_96 (int32_t p_97);
int32_t func_96 (int32_t p_97)
{
if ((g_45 > 1) > 1 > g_83)
{
func_100 (g_208);
return 1;
}
func_119 (g_124);
return 1;
}

void func_90 (int16_t p_92);
void func_90 (int16_t p_92)
{
for (g_83 = 0; g_83 <= 0; g_83++)
func_96 (1);
}

int main (void)
{
func_90 (1);
printf ("checksum = 0\n");
return 0;
}

[regehr]

assigned to @lattner

[efriedma-quic]

Testcase (IL)
To reproduce, run through "opt -licm -loop-index-split", and compare the output of "~/llvmgbuild/Release/bin/lli --force-interpreter --interpreter-print-volatile".

I'm not really sure what's going on here.

[regehr]

Ok perhaps this is a smoking gun.

regehr@john-home:$ llvm-gcc -Os --emit-llvm -S small.c ; llvm-as -f small.s ; valgrind llc small.s.bc
==6800== Memcheck, a memory error detector.
==6800== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==6800== Using LibVEX rev 1804, a library for dynamic binary translation.
==6800== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==6800== Using valgrind-3.3.0, a dynamic binary instrumentation framework.
==6800== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==6800== For more details, rerun with: -v
==6800==
==6800== Invalid read of size 1
==6800== at 0x853A8F4: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187b0 is 0 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646: llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in /home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 1
==6800== at 0x853A948: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187c4 is 20 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646: llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in /home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 4
==6800== at 0x853A951: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187cc is 28 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646: llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in /home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 1
==6800== at 0x853A95A: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187b0 is 0 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646: llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in /home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 4
==6800== at 0x853A963: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187b8 is 8 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646: llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in /home/regehr/bin/llc)
==6800==
==6800== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 21 from 1)
==6800== malloc/free: in use at exit: 2,711 bytes in 86 blocks.
==6800== malloc/free: 2,783 allocs, 2,697 frees, 370,965 bytes allocated.
==6800== For counts of detected errors, rerun with: -v
==6800== searching for pointers to 86 not-freed blocks.
==6800== checked 172,980 bytes.
==6800==
==6800== LEAK SUMMARY:
==6800== definitely lost: 904 bytes in 21 blocks.
==6800== possibly lost: 27 bytes in 1 blocks.
==6800== still reachable: 1,780 bytes in 64 blocks.
==6800== suppressed: 0 bytes in 0 blocks.
==6800== Rerun with --leak-check=full to see details of leaked memory.
regehr@john-home:$

[llvmbot]

John, can you attach the bitcode from "llvm-gcc -Os --emit-llvm -S small.c"?

[regehr]

Argh please ignore this valgrind output. It is for another PR, I slipped up and submitted it here too. llvm-gcc is valgrind-clean for this test.

John

Ok perhaps this is a smoking gun.

regehr@john-home:$ llvm-gcc -Os --emit-llvm -S small.c ; llvm-as -f small.s ;
valgrind llc small.s.bc
==6800== Memcheck, a memory error detector.
==6800== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==6800== Using LibVEX rev 1804, a library for dynamic binary translation.
==6800== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==6800== Using valgrind-3.3.0, a dynamic binary instrumentation framework.
==6800== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==6800== For more details, rerun with: -v
==6800==
==6800== Invalid read of size 1
==6800== at 0x853A8F4: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr
const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187b0 is 0 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646:
llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in
/home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 1
==6800== at 0x853A948: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr
const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187c4 is 20 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646:
llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in
/home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 4
==6800== at 0x853A951: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr
const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187cc is 28 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646:
llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in
/home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 1
==6800== at 0x853A95A: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr
const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187b0 is 0 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646:
llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in
/home/regehr/bin/llc)
==6800==
==6800== Invalid read of size 4
==6800== at 0x853A963: llvm::X86InstrInfo::isMoveInstr(llvm::MachineInstr
const&, unsigned&, unsigned&) const (in /home/regehr/bin/llc)
==6800== Address 0x43187b8 is 8 bytes inside a block of size 40 free'd
==6800== at 0x40222EC: operator delete(void*) (vg_replace_malloc.c:342)
==6800== by 0x8734646:
llvm::MachineFunction::DeleteMachineInstr(llvm::MachineInstr*) (in
/home/regehr/bin/llc)
==6800==
==6800== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 21 from 1)
==6800== malloc/free: in use at exit: 2,711 bytes in 86 blocks.
==6800== malloc/free: 2,783 allocs, 2,697 frees, 370,965 bytes allocated.
==6800== For counts of detected errors, rerun with: -v
==6800== searching for pointers to 86 not-freed blocks.
==6800== checked 172,980 bytes.
==6800==
==6800== LEAK SUMMARY:
==6800== definitely lost: 904 bytes in 21 blocks.
==6800== possibly lost: 27 bytes in 1 blocks.
==6800== still reachable: 1,780 bytes in 64 blocks.
==6800== suppressed: 0 bytes in 0 blocks.
==6800== Rerun with --leak-check=full to see details of leaked memory.
regehr@john-home:$

[regehr]

bitcode from "llvm-gcc -Os --emit-llvm -S small.c"

[llvmbot]

As for the volatile load issue, it's clearly an optimization deficiency:

define i32 @​main() nounwind notes(opt_size) {
entry:
store i32 0, i32* @​g_83
%0 = volatile load i32* @​g_45, align 4 ; [#uses=0]
br label %bb.clone

bb.clone: ; preds = %bb2.clone, %entry
%g_83.tmp.0.clone = phi i32 [ 0, %entry ], [ %indvar.next, %bb2.clone ]
; [#uses=2]
%1 = volatile load i32* @​g_45, align 4 ; [#uses=0]
%exitcond = icmp eq i32 %g_83.tmp.0.clone, 1 ;
[#uses=1]
br i1 %exitcond, label %bb6, label %bb2.clone

It's not clear where the first volatile load come from. Can someone track down
which optimization pass is at fault?

[lattner]

This doesn't reproduce for me on mainline anymore.

[lattner]

Yep, I'm pretty sure this is fixed. John, please reopen if it is still causing problems, thanks!