[Bug middle-end/46488] [4.5 regression] server/core_filters.c from apache httpd 2.2.17 miscompiled at -O3

["ebotcazou at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46488

--- Comment #31 from Eric Botcazou <ebotcazou at gcc dot gnu.org> 2010-11-30 12:57:29 UTC ---
> From a quick look I can see that with -fstrict-aliasing we will never consider
> ptr->link.next to alias ptr->list.next (so if they are made to alias via
> casting the testcase is invalid).

Yes, that's it.  The miscompilation happens very late (equiv memory location
handling during register allocation) but ultimately indirect_refs_may_alias_p
decides that:

(gdb) p debug_generic_expr(ref1)
D.2012_2->list.prev

(gdb) p debug_generic_expr(ref2)
D.2136_50->link.prev

don't alias by virtue of TBAA:

  /* Do type-based disambiguation.  */
  if (base1_alias_set != base2_alias_set
      && !alias_sets_conflict_p (base1_alias_set, base2_alias_set))
    return false;

PTR1 points to apr_bucket_brigade and PTR2 points to apr_bucket.

The aliasing violation is the dereference of APR_RING_SENTINEL which happens in
APR_RING_SPLICE_HEAD and accesses an apr_bucket_brigade as an apr_bucket.

The violation is "sophisticated": the memory location have the same alias set

(gdb) p debug_rtx(mem)
(mem/s/v/f:SI (plus:SI (reg/f:SI 84 [ D.2136 ])
        (const_int 4 [0x4])) [2 D.2136_50->link.prev+0 S4 A32])

(gdb) p debug_rtx(x)
(mem/s/f:SI (plus:SI (reg/f:SI 97)
        (const_int 4 [0x4])) [2 D.2012_2->list.prev+0 S4 A32])

This may explain why the compiler doesn't warn with -Wstrict-aliasing.  It does
warn with the more natural:

#define APR_RING_SENTINEL(hp, elem, link)                \
    (struct elem *)((char *)(hp) - APR_OFFSETOF(struct elem, link))

pr46488.c: In function 'brigade_move':
pr46488.c:107:2: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c:107:2: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c:107:2: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c: In function 'test':
pr46488.c:158:5: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c:158:5: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c:158:5: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c:159:5: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c:159:5: warning: dereferencing type-punned pointer will break
strict-aliasing rules
pr46488.c:159:5: warning: dereferencing type-punned pointer will break
strict-aliasing rules