https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69535

            Bug ID: 69535
           Summary: [6 Regression] wrong code with -O -fno-tree-bit-ccp
                    -fno-tree-reassoc due to use of uninitialised value
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu*

Output:
$ gcc -v                                               
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest/bin/gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-232888-checking-yes-rtl-df-nographite/bin/../libexec/gcc/x86_64-pc-linux-gnu/6.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-checking=yes,rtl,df --without-cloog --without-ppl --without-isl
--disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-232888-checking-yes-rtl-df-nographite
Thread model: posix
gcc version 6.0.0 20160127 (experimental) (GCC) 

$ gcc -O -fno-tree-bit-ccp -fno-tree-reassoc testcase.c
$ ./a.out 
00000000000000006161616100000001
Aborted

The "61616161" bytes are used unitialiased in foo() ("aaaa" from
dirtify_stack()).

$ valgrind --track-origins=yes ./a.out
...
==21394== Conditional jump or move depends on uninitialised value(s)
==21394==    at 0x4E7E0B9: vfprintf (in /lib64/libc-2.21.so)
==21394==    by 0x4E85000: printf (in /lib64/libc-2.21.so)
==21394==    by 0x400645: main
==21394==  Uninitialised value was created by a stack allocation
==21394==    at 0x4005BF: foo
...

The assembly shows: (intel syntax)
...
foo:
...
        mov     eax, DWORD PTR [rsp+32] # u32_2, u32_2
        mov     DWORD PTR [rsp], eax    # %sfp, u32_2
...
        mov     rsi, QWORD PTR [rsp]    # u32_2, %sfp
        mov     edi, 0  # u32_2,
        add     rax, rsi        # tmp115, u32_2
        adc     rdx, rdi        #, u32_2
...
rsi is loaded by a 64bit value that was stored as a 32bit value.

Tested revisions:
trunk r232888 - FAIL
trunk r232819 - FAIL
5-branch r232808 - OK
4_[6789]-branch - OK

Reply via email to