Created attachment 15317 [details]
Testcase to reproduce the bug

Created attachment 15318 [details]
Preprocessed testcase

This is caused by extra precision on the 387 FPU.

*** This bug has been marked as a duplicate of 323 ***

I think I need some help here, I looked to bug 323 and I can't see how it is related to this issue.
The assertion at the end of the test case compares integers, and the iFloor function is only applied to 0 in the test. My problem is that the result in sp.bbox[0] seems total garbage.
I looked at the assembly code generated by gcc (-S flag), the portion corresponding to:

sp.bbox[0] = std::min(sp.bbox[0], iFloor(txcum) );

is:

.L201:
	fld	%st(1)
	fadd	%st(2), %st
	fsubs	.LC4
#APP
	fistpl -44(%ebp)
#NO_APP
	movl	-44(%ebp), %edi
	movl	-88(%ebp), %eax
	sarl	%edi
	cmpl	16(%ebx), %edi
	jge	.L204
	leal	-28(%ebp), %eax
.L204:
	fld	%st(0)
	movl	(%eax), %eax
	fadd	%st(1), %st
	fsubs	.LC4
	movl	%eax, 16(%ebx)

The result of iFloor is stored in %edi but whatever the result of cmpl, the value in %edi isn't used (instead the value at -28(%ebp), which appears to be uninitialized, is stored into sp.bbox[0]).

Sorry.  The tree optimizers produce

<L62>:;
  __asm__ __volatile__("fistl %0":"=m" r:"t" txcum * 2.0e+0 - 5.0e-1);
  D.16879 = r >> 1;
  if (D.16879 < sp->bbox[0]) goto <L105>; else goto <L17>;

<L105>:;
  __b = &D.12083;
  goto <bb 20> (<L18>);

<L17>:;
  __b = &sp->bbox[0];

<L18>:;
  sp->bbox[0] = *__b;

which looks suspicious as well, as D.12083 is not the correct result here
(but in fact is uninitialized).  And this is store-sinking which makes
a mess of it:

Sinking #   D.12083_947 = V_MUST_DEF <D.12083_380>;
D.12083 = D.16879_333 from bb 21 to bb 52

because of wrong alias information computed right before this pass:

<L62>:;
  D.16874_329 = txcum_285 * 2.0e+0;
  x_330 = D.16874_329 - 5.0e-1;
  #   r_946 = V_MAY_DEF <r_288>;
  __asm__ __volatile__("fistl %0":"=m" r:"t" x_330);
  #   VUSE <r_946>;
  r.41_332 = r;
  D.16879_333 = r.41_332 >> 1;
  #   D.12083_947 = V_MUST_DEF <D.12083_380>;
  D.12083 = D.16879_333;
  #   VUSE <SFT.738_136>;
  #   VUSE <SFT.739_451>;
  #   VUSE <SFT.740_367>;
  D.16880_340 = sp_119->bbox[0];
  if (D.16879_333 < D.16880_340) goto <L91>; else goto <L17>;

<L91>:;
  goto <bb 23> (<L18>);

<L17>:;
  __b_342 = &sp_119->bbox[0];

  # __b_5 = PHI <&D.12083(48), __b_342(22)>;
<L18>:;
  #   VUSE <r_946>;
  #   VUSE <r_284>;
  #   VUSE <r_6>;
  #   VUSE <r_43>;
  D.12120_344 = *__b_5;


Oh well, it's not that 4.2 does not have known aliasing related problems.

In fact it's completely wrong.

  # __b_5 = PHI <&D.12083(48), __b_342(22)>;
<L18>:;
  #   VUSE <r_946>;
  #   VUSE <r_284>;
  #   VUSE <r_6>;
  #   VUSE <r_43>;
  D.12120_344 = *__b_5;

should be

  # __b_5 = PHI <&D.12083(48), __b_342(22)>;
<L18>:;
  #   VUSE <SFT.738_136>;
  #   VUSE <SFT.739_451>;
  #   VUSE <SFT.740_367>;
  #   VUSE <D.12083_947>;
  D.12120_344 = *__b_5;

This looks like a const vs. non-const issue (which I vaguely remember).

points-to works well and ends up with __b_5 pointing to anything, so we fall
back to use SMTs which in this case is (for const int& __b):

SMT.761, UID 18425, const int, is addressable, is global, call clobbered, may aliases: { r r r r }

there you go.  It should also (at least) alias

D.12083, UID 12083, int, is aliased, is addressable, call clobbered, default def: D.12083_242

SMT.763, UID 18427, struct SceneProps, is addressable, is global, call clobbered, default def: SMT.763_469, may aliases: { SFT.738 SFT.739 SFT.740 r r r r D.12089 D.12083 D.12084 D.12088 }

so it is flow-insensitive alias analysis that gets it wrong.

4.2.4 is being released, changing milestones to 4.2.5.

Closing 4.2 branch, fixed for 4.3.