[llvm-bugs] [Bug 47027] New: Coverage option(--coverage) with -O3 introduces wrong loop unroll

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=47027

            Bug ID: 47027
           Summary: Coverage option(--coverage) with -O3 introduces wrong
                    loop unroll
           Product: clang
           Version: 10.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: -New Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: public.melg8 at gmail.com
                CC: htmldeveloper at gmail.com, llvm-bugs at lists.llvm.org,
                    neeilans at live.com, richard-llvm at metafoo.co.uk

Minimal reproducible contains two functions ConvertInt and ConvertShort with
identical bodies, except ConvertShort uses short type for loop counter, it
compiled with --coverage and -O3 flags.

Expected behavior: two functions should give identical results on identical
inputs.

Observed behavior: ConvertShort function doesn't xor/assign to result[2] value,
so results from functions doesn't match.

How to reproduce:
x86-64 architecture,
clang version 6-10 is affected.

Compile this code with flags --coverage -O3:
#include <cstdint>
#include <cstdio>
#include <cstdlib>

void ConvertInt(const uint16_t* const initial_state, uint16_t* result) {
  uint16_t state[36] = {};

  for (int j = 0; j < 4; ++j) {
    state[j] = initial_state[j];
  }

  for (int j = 0; j < 32; ++j) {
    static const uint8_t table[2] = {0xab, 0xcd};
    const int position = (state[j + 1] + state[j + 3]) % 2;
    state[j + 4] = table[position] + state[j + 2];

    if (j == 16) {
      for (int i = 0; i < 4; ++i) {
        result[i] ^= state[j + i];
      }
    }
  }
}

void ConvertShort(const uint16_t* const initial_state, uint16_t* result) {
  uint16_t state[36] = {};

  for (int j = 0; j < 4; ++j) {
    state[j] = initial_state[j];
  }

  for (int j = 0; j < 32; ++j) {
    static const uint8_t table[2] = {0xab, 0xcd};
    const int position = (state[j + 1] + state[j + 3]) % 2;
    state[j + 4] = table[position] + state[j + 2];

    if (j == 16) {
      for (short i = 0; i < 4; ++i) {
        result[i] ^= state[j + i]; // result[2] always == 0. Bug?
      }
    }
  }
}

int main() {
  uint16_t initial_state[4] = {};

  uint16_t result_int[8] = {};
  ConvertInt(initial_state, result_int);

  uint16_t result_short[8] = {};
  ConvertShort(initial_state, result_short);

  for (int i = 0; i < 8; ++i) {
    if (result_int[i] != result_short[i]) {
      printf("Is bugged");
      exit(-1);
    }
  }
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200807/3584fb19/attachment.html>