<html>
    <head>
      <base href="https://llvm.org/bugs/" />
    </head>
    <body><span class="vcard"><a class="email" href="mailto:hans@chromium.org" title="Hans Wennborg <hans@chromium.org>"> <span class="fn">Hans Wennborg</span></a>
</span> changed
              <a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED FIXED - possible bad code generation"
   href="https://llvm.org/bugs/show_bug.cgi?id=31614">bug 31614</a>
        <br>
             <table border="1" cellspacing="0" cellpadding="8">
          <tr>
            <th>What</th>
            <th>Removed</th>
            <th>Added</th>
          </tr>

         <tr>
           <td style="text-align:right;">Status</td>
           <td>NEW
           </td>
           <td>RESOLVED
           </td>
         </tr>

         <tr>
           <td style="text-align:right;">CC</td>
           <td>
                
           </td>
           <td>ahmed.bougacha@gmail.com
           </td>
         </tr>

         <tr>
           <td style="text-align:right;">Resolution</td>
           <td>---
           </td>
           <td>FIXED
           </td>
         </tr></table>
      <p>
        <div>
            <b><a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED FIXED - possible bad code generation"
   href="https://llvm.org/bugs/show_bug.cgi?id=31614#c2">Comment # 2</a>
              on <a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED FIXED - possible bad code generation"
   href="https://llvm.org/bugs/show_bug.cgi?id=31614">bug 31614</a>
              from <span class="vcard"><a class="email" href="mailto:hans@chromium.org" title="Hans Wennborg <hans@chromium.org>"> <span class="fn">Hans Wennborg</span></a>
</span></b>
        <pre>(In reply to <a href="show_bug.cgi?id=31614#c1">comment #1</a>)
<span class="quote">> Hans, this looks like PR31367
> (<a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED FIXED - X86: Generate smaller code for atomic refcount decrement"
   href="show_bug.cgi?id=31367#c8">https://llvm.org/bugs/show_bug.cgi?id=31367#c8</a>). What do you think?</span >

Yes, that's exactly it. The bug was introduced in r265636, i.e. llvm 3.9.

My best idea for working around it would be doing the fetch_add operation in a
noinline function :-/

My fix in r291630, which will be in llvm 4, affects the repro like this:

@@ -19,12 +19,13 @@
 _Z13test_functionv:                     # @_Z13test_functionv
        .cfi_startproc
 # BB#0:                                 # %entry
+       movl    $1, %eax
+       lock            xaddq   %rax, foo(%rip)
        testq   %rax, %rax
        setns   %al
-       lock            incq    foo(%rip)
        movl    $value_a, %ecx
        movl    $value_b, %edx
-       cmovgq  %rcx, %rdx
+       cmovnsq %rcx, %rdx
        cmpl    $100, (%rdx)
        je      .LBB1_3
 # BB#1:
@@ -37,11 +38,12 @@
        movl    $foo+16, %eax
        cmovneq %rcx, %rax
        lock            incq    (%rax)
+       movl    $1, %eax
+       lock            xaddq   %rax, foo(%rip)
        testq   %rax, %rax
        setns   %al
-       lock            incq    foo(%rip)
        movl    $value_b, %esi
-       cmovgq  %rdx, %rsi
+       cmovnsq %rdx, %rsi
        cmpl    $100, (%rsi)
        jne     .LBB1_2
 .LBB1_3:                                # %if.end.thread</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>