optimization/7630: ICE's compiling Mozilla 1.0 with -march=pentium4

[jbuhler@cs.wustl.edu]

>Number:         7630
>Category:       optimization
>Synopsis:       gcc 3.2 breaks on Mozilla 1.0's JS sources with -march=pentium4
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          ice-on-legal-code
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 19 00:26:06 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Jeremy Buhler
>Release:        3.2
>Organization:
Washington University in St. Louis
>Environment:
System: Linux guanyin 2.4.19 #2 Fri Aug 2 21:50:19 CDT 2002 i686 unknown
Architecture: i686 (Pentium 4)
host: i686-pc-linux-gnu
build: i686-pc-linux-gnu
target: i686-pc-linux-gnu
configured with: ../gcc-3.2/configure --prefix=/usr/local/gcc-3.2 --enable-languages=c,c++,f77 --enable-__cxa_atexit
>Description:
	I attempted to compile Mozilla 1.0 with gcc 3.2 using the options
        '-O -march=pentium4'.  The compile crashes with ICE's on multiple
        files in the js/src directory (the Javascript implementation).
        Compiling with -march=pentium3 does not exhibit the problem,
        nor does compiling without optimization.

        The ICE's are of the form "unable to find a register to spill in
        class GENERAL_REGS" and appear to be related to the use of the
        Pentium 4's SSE instructions.  See next section for a specific,
        cut-down example.

>How-To-Repeat:
        Build the following code "foo.cc" with options
        gcc -c -fPIC -O -march=pentium4 foo.c
        (both -O and -fPIC are required to trigger the ICE).

        This code is cut down from Mozilla 1.0's src/js/jsparse.c.  It's
        got an uninitialized variable, though I don't believe the
        original source had one (initializing 'd' removes the ICE).  
        Other ICE's happen in jsinterp.c and jsdtoa.c, but these files
        contain really huge functions that are much harder to trace.

typedef union {
    double value;
    struct {
        unsigned int lsw;
        unsigned int msw;
    } parts;
} js_ieee_double_shape_type;

#define JSDOUBLE_HI32(x)  ({js_ieee_double_shape_type sh_u;  \
                            sh_u.value = (x);                \
                            sh_u.parts.msw; })


enum JSOp {JSOP_URSH, JSOP_DIV};
struct JSParseNode {
    enum JSOp     pn_op;
    double        dval;
};

int js_FoldConstants(struct JSParseNode *pn)
{
    double d;
    
    switch (pn->pn_op) {
    case JSOP_URSH:
        d = 0;
        
    case JSOP_DIV:
        if (JSDOUBLE_HI32(d) ^ JSDOUBLE_HI32(d))
            d = 0;
        break;
        
    default:;
    }
    
    pn->dval = d;
    return 0;
}


>Fix:
	Compile without optimization, or with -march=pentium3 instead of
        -march=pentium4
>Release-Note:
>Audit-Trail:
>Unformatted: