<html>
<head>
<base href="http://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED --- - [AArch64] A57LoadBalancing rewrites registers and introduces miscompile"
href="http://llvm.org/bugs/show_bug.cgi?id=21637">21637</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[AArch64] A57LoadBalancing rewrites registers and introduces miscompile
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>ASSIGNED
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Backend: AArch64
</td>
</tr>
<tr>
<th>Assignee</th>
<td>james.molloy@arm.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>mcrosier@codeaurora.org
</td>
</tr>
<tr>
<th>CC</th>
<td>apazos@codeaurora.org, llvmbugs@cs.uiuc.edu, t.p.northover@gmail.com, zhaoshiz@codeaurora.org
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Unfortunately, I can't reproduce this on top of trunk, but I'll describe the
issue as best I can.
I have some IR that look like the following:
------------------------------------------------------------------------------------
%call8.i = tail call double @floor(double %div7.i)
%mul9.i = fmul double %call8.i, 6.000000e+00
%sub10.i = fsub double %div3.i, %mul9.i
------------------------------------------------------------------------------------
Lowering of the floor instruction results in two instructions being emitted:
1.) FRINTMSr to compute the floor value and
2.) FRINTXDr to check for an exception if the result was rounded (base on Tim's
comments on IRC)
See AArch64ISelDAGToDAG::SelectLIMB() for the implementation details.
Also from AArch64InstrInfo.td:
// FRINTX is inserted to set the flags as required by FENV_ACCESS ON behavior
// in the C spec. Setting hasSideEffects ensures it is not DCE'd.
// <rdar://problem/13715968>
// TODO: We should really model the FPSR flags correctly. This is really ugly.
let hasSideEffects = 1 in {
defm FRINTX : SingleOperandFPData<0b1110, "frintx", frint>;
}
The FRINTXDr instruction defines a D register, but it has not use and is marked
dead.
%D0<def,dead> = FRINTXDr %D28<kill>;
Thus, the RegisterScavenger is free to scavenge this register.
----
Coming into the LoadBalancing pass we have MachineInstrs like the below.
The A57LoadBalancing pass then rewrites D11 to D0 introducing the correctness
issue:
%D11<def> = FMULDrr %D30<kill>, %D26<kill>;
%D5<def> = FSUBDrr %D10<kill>, %D31<kill>;
%D0<def,dead> = FRINTXDr %D28<kill>;
%D6<def> = FSUBDrr %D14<kill>, %D11<kill>;
becomes:
%D0<def> = FMULDrr %D30<kill>, %D26<kill>;
%D5<def> = FSUBDrr %D10<kill>, %D31<kill>;
%D0<def,dead> = FRINTXDr %D28<kill>;
%D6<def> = FSUBDrr %D14<kill>, %D0<kill>;
FSUBDrr is now using the incorrect value from the FRINTXDr instruction.
Tim suggest the pass is not correctly checking liveness, which seems
reasonable, but I'm not familiar with the pass.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>