[llvm-bugs] [Bug 34682] New: [SKX] Bus error after Loop Vectorization

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=34682

            Bug ID: 34682
           Summary: [SKX] Bus error after Loop Vectorization
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: ilia.taraban at intel.com
                CC: llvm-bugs at lists.llvm.org

This test fails at run with "Bus error (core dumped)" after Loop Vectorization
on O2, skx:

================= nice.c ==============
int main ()
{
    unsigned int j = 0, k = 0, i = 0;
    unsigned int x [17] [17] = {0}, a [17] = {0};
    for (j = 1; j < 10; ++j) 
      for (k = j; k < 17; ++k) 
        for (i = 1; i < j; ++i) 
          x[k][0] = a[i - 1];
    printf("res = %u\n", x[0][0]);
    return 0;
}

============================================

>>> clang -v
clang version 6.0.0 (trunk 313612)
Target: x86_64-unknown-linux-gnu
Thread model: posix
...

>>> clang -march=skylake-avx512 -O0 -o nice.exe nice.c
>>> sde -skx -- ./nice.exe
res = 0

>>> clang -march=skylake-avx512 -O2 -o nice.exe nice.c
>>> sde -skx -- ./nice.exe
Bus error (core dumped)

>>> clang -march=skylake-avx512 -O2 -o nice.exe nice.c -mllvm -opt-bisect-limit=83
...
BISECT: running pass (82) Rotate Loops on loop
BISECT: running pass (83) Loop Distribution on function (main)
BISECT: NOT running pass (84) Loop Vectorization on function (main)
BISECT: NOT running pass (85) Loop Load Elimination on function (main)
...
>>> sde -skx -- ./nice.exe
res = 0

>>> clang -march=skylake-avx512 -O2 -o nice.exe nice.c -mllvm -opt-bisect-limit=84
...
BISECT: running pass (83) Loop Distribution on function (main)
BISECT: running pass (84) Loop Vectorization on function (main)
BISECT: NOT running pass (85) Loop Load Elimination on function (main)
BISECT: NOT running pass (86) Combine redundant instructions on function (main)
...
>>> sde -skx -- ./nice.exe
Segmentation fault (core dumped)


If we look at generated asm, we'll see that we put -1 into esi, but then use
rsi for pointer operations:
================= nice.s ================== 
...
        movl    $16, %r10d
        subq    %r11, %r10
        leal    -1(%r11), %esi       # put -1 into $esi
        movq    %rax, %rbx
        cmpq    $16, %r10
...
        vpaddq  %zmm12, %zmm3, %zmm12
        vpbroadcastd    (%rsp,%rsi,4), %ymm13                # SIGBUS   rsi =
0x00000000FFFFFFFF
        kmovq   %k1, %k2
        vpscatterqd     %ymm13, (,%zmm12) {%k2}
...
===========================================

So if we change "leal   -1(%r11), %esi" to "leaq        -1(%r11), %rsi" , our
program will finish correctly with "res = 0"

>>> clang nice-fixed.s -o nice-fixed.exe
>>> sde -skx -- ./nice-fixed.exe
res = 0

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170920/70b8e471/attachment.html>