[llvm-bugs] [Bug 26883] New: Using cmpxchg[8|16]b produces incorrect code with dynamically allocated stack

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=26883

            Bug ID: 26883
           Summary: Using cmpxchg[8|16]b produces incorrect code with
                    dynamically allocated stack
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Backend: X86
          Assignee: unassignedbugs at nondot.org
          Reporter: qcolombet at apple.com
                CC: llvm-bugs at lists.llvm.org
    Classification: Unclassified

Created attachment 16011
  --> https://llvm.org/bugs/attachment.cgi?id=16011&action=edit
Reproducer

cmpxchg[8|16]b uses RBX as one of its argument.
In other words, using this instruction clobbers RBX as it defined to hold one
the input.
When the backend uses dynamically allocated stack, RBX is used as a reserved
register for the base pointer.

Reserved registers have special semantic that only the target understands and
enforces, because of that, the register allocator don’t use them, but also,
don’t try to make sure they are used properly (remember it does not know how
they are supposed to be used).

Therefore, when RBX is used as a reserved register but defined by something
that is not compatible with that use, the register allocator will not fix the
surrounding code to make sure it gets saved and restored properly around the
broken code. This is the responsibility of the target to do the right thing
with its reserved register.

The attached bitcode file demonstrates such bad code generation.

To reproduce:
llc -mattr=+cx16 -x86-use-base-pointer=true -stackrealign -stack-alignment=32
-o - ../test/CodeGen/X86/base-pointer-and-cmpxchg.ll

Result:
    movq    %rdx, %rbx ; <— RBX gets defined for the instruction cmpxchg16b
    movq    %rsp, %rax
    movq    %rax, 32(%rbx) ; <— as a result we spill in random place.
        […]
    movq    40(%rbx), %rax ; <— and reload garbage
        [...]
    lock        cmpxchg16b    (%rsi)

I have tried to fix that in r262759 by falling back to the lib call 
__sync_val_compare_and_swap when we need RBX as base pointer. Turns out this
function is not available in compiler-rt unlike what I thought.

We may want to add it for x86.

Anyhow, filing this to keep track of the problem.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20160308/bfff591e/attachment.html>