[llvm-bugs] [Bug 45858] New: Wrong jump destination with -O2 -fexperimental-new-pass-manager

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=45858

            Bug ID: 45858
           Summary: Wrong jump destination with -O2
                    -fexperimental-new-pass-manager
           Product: clang
           Version: trunk
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: normal
          Priority: P
         Component: -New Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: leamovret at gmail.com
                CC: htmldeveloper at gmail.com, llvm-bugs at lists.llvm.org,
                    neeilans at live.com, richard-llvm at metafoo.co.uk

Here's a reduced PoC on Compiler Explorer with clang (trunk):
https://gcc.godbolt.org/z/ZKn7Uq.
(This is a reduced version of Chromium's file
//sandbox/win/src/filesystem_interception.cc.)

You can see the problem in the middle column.  The right column (with -Os)
demonstrates an expected behavior.

The problem happens at the if statement at the line 132888.
(In Chromium, it's
https://source.chromium.org/chromium/chromium/src/+/master:sandbox/win/src/crosscall_params.h;l=251;drc=c8cff7f9663ce6d1ef35e5c717f43c867c3906eb.)

    if ((size > sizeof(*this)) ||
        (param_info_[index].offset_ > (sizeof(*this) - size))) {
      // It does not fit, abort copy.
      return false;
    }

In both the repro and the expected behavior, the second condition is compiled
into "cmp rdx, rcx; jae", where rdx = (sizeof(*this) - size) and rcx =
param_info_[index].offset_.  So the destination of the JAE must be the code
after the if statement.

In the repro case, however, the destination is .LBB2_9, which is the code
inside the if block.  I think the label .LBB2_9 must be placed at the "%bb.8".

This is not breaking Chromium because it's compiled with -Os, and
-fexperimental-new-pass-manage is not set.  I hit this when working on Firefox,
which imports some of Chromium code, and Mozilla recently enabled
-fexperimental-new-pass-manager.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200509/a705f325/attachment.html>