optimization/5344: gcc 3.0.3 optimizer generates incorrect code

[cosmos at vorlon dot zahadum dot world]

>Number:         5344
>Category:       optimization
>Synopsis:       gcc 3.0.3 optimizer generates incorrect code
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          wrong-code
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 09 22:46:00 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     Clay Harris
>Release:        3.0.3
>Organization:
>Environment:
System: Linux vorlon.zahadum.world 2.4.16 #2 SMP Wed Dec 12 02:10:51 CST 2001 i686 unknown
Architecture: i686

	
host: i686-pc-linux-gnu
build: i686-pc-linux-gnu
target: i686-pc-linux-gnu
configured with: ../configure 
>Description:
	Compiling the following program with 'gcc -O2 -S search_bug3.c'
	generates incorrect code.  Pay special attention to the 2nd
	if statement and the recalculation of i in the .s file.
>How-To-Repeat:

search_bug3.c:

/* #include <sys/poll.h> */
struct pollfd
  {
    int fd;
    short int events;
    short int revents;
  };

int search1 (
    unsigned int * __restrict__         i_p,
    int                                 fd,
    unsigned int                        num,
    struct pollfd * __restrict__        poll_p)
{
    int                                 diff;
    unsigned int                        i;
    unsigned int                        l;
    unsigned int                        u;
    unsigned int                        tmp1;

    /*
     * Find the fd (or the next highest fd to insert before)
     * in the poll_array using a binary search.
     */

    u = num;
    l = 0;
    i = num >> 1;

    while (l < u)
    {
        tmp1 = poll_p[i].fd - fd;

        if (tmp1 == 0)
            goto FOUND_IT;

        if (tmp1 > 0)
            u = i;
        else 
            l = i + 1;

        i = (l + u) >> 1;
    }

    if (tmp1 < 0)
        i++;

FOUND_IT: ;

    diff = tmp1;

    *i_p = i;
    return (diff);
}

search_bug3.s:

	.file	"search_bug3.c"
	.text
	.align 16
.globl search1
	.type	search1,@function
search1:
	pushl	%ebp
	movl	%esp, %ebp
	pushl	%edi
	movl	16(%ebp), %eax
	pushl	%esi
	movl	12(%ebp), %ecx
	pushl	%ebx
	xorl	%ebx, %ebx
	movl	%eax, %edx
	shrl	%edx
	cmpl	%eax, %ebx
	movl	20(%ebp), %edi
	jae	.L6
	.p2align 4
.L4:
	movl	(%edi,%edx,8), %eax
	movl	%eax, %esi
	subl	%ecx, %esi
	je	.L6
	movl	%edx, %eax
	shrl	%edx
	cmpl	%eax, %ebx
	jb	.L4
.L6:
	movl	8(%ebp), %eax
	movl	%edx, (%eax)
	movl	%esi, %eax
	popl	%ebx
	popl	%esi
	popl	%edi
	popl	%ebp
	ret
.Lfe1:
	.size	search1,.Lfe1-search1
	.ident	"GCC: (GNU) 3.0.3"

>Fix:
	No known fix.  The following are work-arounds:
	If optimization is turned off, it appears correct code is
	generated.
	If the variable tmp1 is removed from the program (replaced
	by variable diff), it appears that correct code is
	generated.
>Release-Note:
>Audit-Trail:
>Unformatted: