subreg regalloc miscompile

[regehr]

Bugzilla Link	9113
Resolution	DUPLICATE
Resolved on	Feb 13, 2011 14:56
Version	trunk
OS	Linux
CC	@atrick,@lattner,@tkremenek,@stoklund

Extended Description

[regehr@gamow tmp447]$ clang -O0 small.c -o small
[regehr@gamow tmp447]$ ./small
1
[regehr@gamow tmp447]$ clang -O1 small.c -o small
[regehr@gamow tmp447]$ ./small
169
[regehr@gamow tmp447]$ clang -v

clang version 2.9 (trunk 124573)
Target: x86_64-unknown-linux-gnu
Thread model: posix

[regehr@gamow tmp447]$ cat small.c

int printf(const char *format, ...);

char g_14 = 0;

int main(void) {
unsigned int l_1 = 0;
unsigned char l_2 = 0;
l_1 = (g_14 / 5) != (unsigned char)g_14;
l_2 = l_1 + ((1 + g_14) ^ g_14);
printf("%d\n", l_2);
return 0;
}

[tkremenek]

I can reproduce this.

[tkremenek]

cloned to rdar://problem/8939650

[llvmbot]

Seems to be a codegen problem.

[tkremenek]

Bisection shows this was introduced in r121696.

[llvmbot]

.ll test
It looks like OPT bug for me.

$ opt t.ll | lli
1
$ opt -O1 t.ll | lli
149

[llvmbot]

Sorry, my fault (I forgot to add -O0 in lli). It is codegen bug.

[llvmbot]

simplified test
ok, i have some progress.

$ lli to.ll
149
$ lli -disable-peephole to.ll
1

The problem here is that peephole moves some instructions, which causes that INC8r %vreg21 instruction uses undefined value.

BB#0: derived from LLVM BB %entry
%vreg0 = MOVZX32rm8 %RIP, 1, %noreg, ga:@g_14, %noreg; mem:LD1[@g_14] GR32:%vreg0
%vreg1 = COPY %vreg0:sub_8bit; GR8:%vreg1 GR32:%vreg0
%vreg2 = MOVSX32rr8 %vreg1; GR32:%vreg2 GR8:%vreg1
%vreg22 = COPY %vreg5:sub_32bit; GR32:%vreg22 GR64:%vreg5
%vreg21 = COPY %vreg22:sub_8bit; GR8:%vreg21 GR32:%vreg22
--> %vreg3 = INC8r %vreg21, %EFLAGS<imp-def,dead>; GR8:%vreg3,%vreg21
%vreg20 = COPY %vreg2:sub_8bit; GR8:%vreg20 GR32:%vreg2
%vreg4 = XOR8rr %vreg3, %vreg20, %EFLAGS<imp-def,dead>; GR8:%vreg4,%vreg3,%vreg20
%vreg5 = MOVSX64rr32 %vreg2; GR64:%vreg5 GR32:%vreg2
%vreg6 = IMUL64rri32 %vreg5, 1717986919, %EFLAGS<imp-def,dead>; GR64:%vreg6,%vreg5

[lattner]

I'm pretty sure that r121696 didn't introduce that, that added code that isn't being run at -O0 :-)

[lattner]

Actually, the bug is in the -O1 code, not the -O0 code.

[llvmbot]

Chris, you are right but but -O1 we create something like:

%DL = INC8r %DL, %EFLAGS<imp-def,dead> <-- no %DL (or %RDX etc.) def before

and with -O0 we create something like

%DL = MOV8rm %RIP, 1, %noreg, ga:@g_14, %noreg; mem:LD1[@g_14]
(...)
%DL = ADD8ri %DL, 1, %EFLAGS

[lattner]

This is a subreg-related regalloc miscompilation. Coming out of isel we have (note the inc8r):

BB#0: derived from LLVM BB %entry
%vreg0 = MOVZX32rm8 %RIP, 1, %noreg, ga:@g_14, %noreg; mem:LD1[@g_14] GR32:%vreg0
%vreg1 = COPY %vreg0:sub_8bit; GR8:%vreg1 GR32:%vreg0
%vreg2 = MOVSX32rr8 %vreg1; GR32:%vreg2 GR8:%vreg1
%vreg3 = INC8r %vreg1, %EFLAGS<imp-def,dead>; GR8:%vreg3,%vreg1
%vreg4 = XOR8rr %vreg3, %vreg1, %EFLAGS<imp-def,dead>; GR8:%vreg4,%vreg3,%vreg1

and the first register assignment we get is:

BB#0: derived from LLVM BB %entry
%EAX = MOVZX32rm8 %RIP, 1, %noreg, ga:@g_14, %noreg; mem:LD1[@g_14]
%ECX = MOVSX32rr8 %AL
%DL = INC8r %DL, %RDX, %EFLAGS<imp-def,dead>

Note that the INC is using DL instead of AL.

[stoklund]

The codegen peephole pass is breaking SSA form. Note %vreg5 is used before its definition:

After codegen peephole optimization pass:

Machine code for function main:

Function Live Outs: %EAX

BB#0: derived from LLVM BB %entry
%vreg0 = MOVZX32rm8 %RIP, 1, %noreg, ga:@g_14, %noreg; mem:LD1[@g_14] GR32:%vreg0
%vreg1 = COPY %vreg0:sub_8bit; GR8:%vreg1 GR32:%vreg0
%vreg2 = MOVSX32rr8 %vreg1; GR32:%vreg2 GR8:%vreg1
%vreg21 = COPY %vreg5:sub_32bit; GR32:%vreg21 GR64:%vreg5
%vreg20 = COPY %vreg21:sub_8bit; GR8:%vreg20 GR32:%vreg21
%vreg3 = INC8r %vreg20, %EFLAGS<imp-def,dead>; GR8:%vreg3,%vreg20
%vreg19 = COPY %vreg2:sub_8bit; GR8:%vreg19 GR32:%vreg2
%vreg4 = XOR8rr %vreg3, %vreg19, %EFLAGS<imp-def,dead>; GR8:%vreg4,%vreg3,%vreg19
%vreg5 = MOVSX64rr32 %vreg2; GR64:%vreg5 GR32:%vreg2

*** This bug has been marked as a duplicate of bug #9226 ***