[LLVMbugs] [Bug 23964] New: __dfsw_memchr is miscompiled by llvm

[bugzilla-daemon at llvm.org]

https://llvm.org/bugs/show_bug.cgi?id=23964

            Bug ID: 23964
           Summary: __dfsw_memchr is miscompiled by llvm
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: hjl.tools at gmail.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

On Fedora/21 x86-64, llvm r240771 miscompiled __dfsw_memchr:

Command Output (stderr):
--
/export/gnu/import/git/llvm/projects/compiler-rt/test/dfsan/custom.cc:817:39:
warning: data argument not used by format string [-Wformat-extra-args]
  assert(sprintf(buf, "Hello world!", 42, "hello") == 12);
                      ~~~~~~~~~~~~~~  ^
/usr/include/assert.h:86:5: note: expanded from macro 'assert'
  ((expr)                                                               \
    ^
1 warning generated.
custom.cc.tmp:
/export/gnu/import/git/llvm/projects/compiler-rt/test/dfsan/custom.cc:698: void
test_memchr(): Assertion `crv == &str1[2]' failed.
/export/build/gnu/llvm-clang-bootstrap-cmake/stage2/build-x86_64-linux/projects/compiler-rt/test/dfsan/Output/custom.cc.script:
line 4: 14618 Aborted                
DFSAN_OPTIONS="strict_data_dependencies=0"
/export/build/gnu/llvm-clang-bootstrap-cmake/stage2/build-x86_64-linux/projects/compiler-rt/test/dfsan/Output/custom.cc.tmp

Dump of assembler code for function __dfsw_memchr:
   0x0000555555559630 <+0>:    push   %rbp
   0x0000555555559631 <+1>:    push   %r15
   0x0000555555559633 <+3>:    push   %r14
   0x0000555555559635 <+5>:    push   %rbx
   0x0000555555559636 <+6>:    push   %rax
   0x0000555555559637 <+7>:    mov    %r8d,%ebx
   0x000055555555963a <+10>:    mov    %ecx,%ebp
   0x000055555555963c <+12>:    mov    0x30(%rsp),%r15
=> 0x0000555555559641 <+17>:    lea    0x3b91d0(%rip),%rax        #
0x555555912818 <_ZN7__dfsan10flags_dataE>
   0x0000555555559648 <+24>:    cmpb   $0x0,0x2(%rax)
   0x000055555555964c <+28>:    je     0x555555559652 <__dfsw_memchr+34>
   0x000055555555964e <+30>:    xor    %eax,%eax
   0x0000555555559650 <+32>:    jmp    0x555555559675 <__dfsw_memchr+69>
   0x0000555555559652 <+34>:    mov    %rdx,%rsi
   0x0000555555559655 <+37>:    callq  0x555555557e60 <dfsan_read_label()>
   0x000055555555965a <+42>:    mov    %ax,%r14w
   0x000055555555965e <+46>:    movzwl %bp,%edi
   0x0000555555559661 <+49>:    movzwl %bx,%esi
   0x0000555555559664 <+52>:    callq  0x555555557c50 <dfsan_union>
   0x0000555555559669 <+57>:    movzwl %r14w,%edi
   0x000055555555966d <+61>:    movzwl %ax,%esi

__dfsw_memchr compiled with g++:

Dump of assembler code for function __dfsw_memchr(void*, int, size_t,
dfsan_label, dfsan_label, dfsan_label, dfsan_label*):
   0x0000000000006b30 <+0>:    push   %r14
   0x0000000000006b32 <+2>:    push   %r13
   0x0000000000006b34 <+4>:    mov    %r8d,%r14d
   0x0000000000006b37 <+7>:    push   %r12
   0x0000000000006b39 <+9>:    push   %rbp
   0x0000000000006b3a <+10>:    mov    %rdi,%r13
   0x0000000000006b3d <+13>:    push   %rbx
   0x0000000000006b3e <+14>:    mov    %ecx,%r12d
   0x0000000000006b41 <+17>:    mov    %rdx,%rbx
   0x0000000000006b44 <+20>:    callq  0x37e0 <memchr at plt>
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It is missing from llvm.

   0x0000000000006b49 <+25>:    mov    %rax,%rbp
   0x0000000000006b4c <+28>:    lea    0x23e8fd(%rip),%rax        # 0x245450
<_ZN7__dfsan10flags_dataE>
   0x0000000000006b53 <+35>:    cmpb   $0x0,0x2(%rax)
   0x0000000000006b57 <+39>:    je     0x6b80 <__dfsw_memchr(void*, int,
size_t, dfsan_label, dfsan_label, dfsan_label, dfsan_label*)+80>
   0x0000000000006b59 <+41>:    mov    0x30(%rsp),%rax
   0x0000000000006b5e <+46>:    test   %rbp,%rbp
   0x0000000000006b61 <+49>:    mov    $0x0,%ecx
   0x0000000000006b66 <+54>:    cmove  %ecx,%r12d
   0x0000000000006b6a <+58>:    mov    %r12w,(%rax)

It happens on Fedora/21, not on Fedora 20.  It worked on Fedora 21
on May 30, 2015.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20150626/b24c5789/attachment.html>