[Bug rtl-optimization/70526] [5/6 Regression] GCC 6 miscompiles Firefox JIT compiler

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70526

--- Comment #16 from Richard Biener <rguenth at gcc dot gnu.org> ---
In ToConstantOrRegister:

-(insn 66 64 88 7 (set (mem:SI (reg/f:DI 0 ax [orig:90 _12 ] [90]) [2
MEM[(struct Register *)_12]+0 S4 A32])
+(insn:TI 89 64 66 7 (set (reg:DI 1 dx [orig:125 D.3219+8 ] [125])
+        (mem/c:DI (plus:DI (reg/f:DI 7 sp)
+                (const_int 8 [0x8])) [4 D.3125+8 S8 A64])) t.C:76 85
{*movdi_internal}
+     (nil))
+(insn 66 89 151 7 (set (mem:SI (reg/f:DI 0 ax [orig:90 _12 ] [90]) [2
MEM[(struct Register *)_12]+0 S4 A32])
         (reg:SI 6 bp [orig:94 D.3225 ] [94])) t.C:39 86 {*movsi_internal}
      (expr_list:REG_DEAD (reg:SI 6 bp [orig:94 D.3225 ] [94])
         (expr_list:REG_DEAD (reg/f:DI 0 ax [orig:90 _12 ] [90])
             (nil))))
-(insn 88 66 89 7 (set (reg:DI 0 ax [orig:124 D.3219 ] [124])
-        (mem/c:DI (reg/f:DI 7 sp) [4 D.3125+0 S8 A128])) t.C:76 85
{*movdi_internal}
+(insn 151 66 88 7 (use (reg:DI 1 dx)) t.C:77 -1
      (nil))
-(insn 89 88 150 7 (set (reg:DI 1 dx [orig:125 D.3219+8 ] [125])
-        (mem/c:DI (plus:DI (reg/f:DI 7 sp)
-                (const_int 8 [0x8])) [4 D.3125+8 S8 A64])) t.C:76 85
{*movdi_internal}
-     (nil))
-(insn 150 89 151 7 (use (reg:SI 0 ax)) t.C:77 -1
-     (nil))
-(insn 151 150 152 7 (use (reg:DI 1 dx)) t.C:77 -1
+(insn:TI 88 151 163 7 (set (reg:DI 0 ax [orig:124 D.3219 ] [124])
+        (mem/c:DI (reg/f:DI 7 sp) [4 D.3125+0 S8 A128])) t.C:76 85
{*movdi_internal}
      (nil))

but

  # PT = nonlocal { D.3125 }
  _12 = TypedOrValueRegister::dataTyped (&D.3125);
  MEM[(struct Register *)_12] = reg$reg__34;
  reg = D.3125;

so _12 may point to D.3125.

_BUT_ here we access D.3125 both as Register (the store) and as its declared
type TypedOrValueRegister (the load).  Thus this is an invalid testcase.

Quoting a larger part:

  struct TypedOrValueRegister D.3125;
...
  MEM[(struct  &)&D.3125] ={v} {CLOBBER};
  D.3125.type_ = type_2(D);
  # PT = nonlocal { D.3125 }
  _12 = TypedOrValueRegister::dataTyped (&D.3125);
  MEM[(struct Register *)_12] = reg$reg__34;
  reg = D.3125;
  MEM[(struct  &)&D.3126] ={v} {CLOBBER};
  D.3126.reg_ = reg;
  D.3219 = D.3126;
  D.3126 ={v} {CLOBBER};
  D.3125 ={v} {CLOBBER};

  <bb 10>:
  return D.3219;

    TypedOrValueRegister(MIRType type, Register reg)
      : type_(type)
    {
      dataTyped() = reg;
    }

this dataTyped() use to store to TypedOrValueRegister is bogus.  You can't
refer to that part of the storage by copying *this.

Hmm.

Basically once you start the lifetime of an object inside the AlignedStorage
area you can no longer access it using the enclosing object as a whole.
Obviously doing sth like

struct C { C(); ~C{}; };

struct S
{
  AlignedStorage<...> typed;
};

S s;
new C (S.typed) ();
S s2 = s;

doesn't properly transfer 'C' and thus this is expected behavior.  It
might have worked with POD 'C' (not sure if by design).  You have to
invoke a proper way of moving the instantiated sub-object.

So I think it's invalid even if somewhat unfortunate.

Maybe worth a DR ;)