[LLVMbugs] [Bug 24347] New: LSR miscompiles code after r243348

[bugzilla-daemon at llvm.org]

https://llvm.org/bugs/show_bug.cgi?id=24347

            Bug ID: 24347
           Summary: LSR miscompiles code after r243348
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Transformation Utilities
          Assignee: sanjoy at playingwithpointers.com
          Reporter: vonosmas at gmail.com
                CC: llvmbugs at cs.uiuc.edu, peter at pcc.me.uk,
                    vonosmas at gmail.com
    Classification: Unclassified

To reproduce:

$ cat example.c 
#include <stdint.h>
#include <stdio.h>

struct S {
  int a;
  int b;
};

void foo(struct S* s, int last_index, uint8_t *arr)
{
    int x, i, j, prev;
    if (s->a && !s->b) {
      i = 1;
    } else {
      i = 0;
    }

    prev = i - 1;
    for (; i <= last_index; i++) {
        j = arr[i];
        fprintf(stderr, "### j = %d\n", j);
        x = i - prev - 1;
        prev = i;
        fprintf(stderr, "### %d %d\n", x, prev);
    }
}

int main() {
  struct S s = { 0, 0 };
  uint8_t arr[] = {0, 1, 2, 3};
  foo(&s, 3, arr);
  return 0;
}

$ ./bin/clang -O0 example.c && ./a.out
### j = 0
### 0 0
### j = 1
### 0 1
### j = 2
### 0 2
### j = 3
### 0 3

$ ./bin/clang -O1 example.c && ./a.out
Segmentation fault (core dumped)

Looks like the problem is that loop counter (which can be negative after the
transformation) is stored in 32-bit register, and is incorrectly zero-extended
instead of being sign-extended:

$ objdump -d a.out
0000000000400580 <foo>:
<...>
  400589:       83 3f 00                cmpl   $0x0,(%rdi)
  40058c:       74 0b                   je     400599 <foo+0x19>
  40058e:       bb 01 00 00 00          mov    $0x1,%ebx
  400593:       83 7f 04 00             cmpl   $0x0,0x4(%rdi)
  400597:       74 02                   je     40059b <foo+0x1b>
  400599:       31 db                   xor    %ebx,%ebx        <--- %ebx is a
counter, can become zero here.
<...>
  4005a4:       ff cb                   dec    %ebx                    <---
%ebx can be 0xffffffff
  4005a6:       66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
  4005ad:       00 00 00 
  4005b0:       89 d8                   mov    %ebx,%eax
  4005b2:       41 0f b6 54 06 01       movzbl 0x1(%r14,%rax,1),%edx  <----
here we add 0x100000000 instead of 0x0

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20150804/16d2dbf8/attachment.html>