optimization/2844: Conditional branch movement violates dependency on IA64

[Hans_Boehm@hp.com]

>Number:         2844
>Category:       optimization
>Synopsis:       Conditional branch movement violates dependency on IA64
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 16 11:06:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     Hans_Boehm@hp.com
>Release:        gcc3.0 branch as of 5/15/01
>Organization:
>Environment:
Linux on IA64
>Description:
The program below is miscompiled at -O2 and -O3, on Itanium,
but not on X86.  The "bytes_to_get <= bytes" test is moved
above the increment to scratch_free_ptr.  Aside from being
a pessimization in this case, this is incorrect, since the
increment never happens if the test succeeds.

This was extracted from boehm-gc/headers.c in the gcc source
tree.  It prevents the default gcj build from working on
IA64.

The beginning of the resulting GC_scratch_alloc function is:

	.proc GC_scratch_alloc#
GC_scratch_alloc:
	.prologue 12, 36
	.mii
	// cycle 0
	.save ar.pfs, r37
	alloc r37 = ar.pfs, 1, 5, 1, 0
	// cycle 1
	.save rp, r36
	mov r36 = b0
	.body
.L34:
	.mii
	// cycle 0
	addl r15 = @ltoff(scratch_free_ptr#), gp
	addl r16 = @ltoff(GC_scratch_end_ptr#), gp
	addl r14 = 131072, r0
	.mmi
	mov r33 = r1
	;;
	// cycle 1
	cmp.ltu p8, p9 = r32, r14
	addl r38 = 131072, r0
	.mmb
	// cycle 2
	ld8 r34 = [r15]
	ld8 r35 = [r16]
	(p9) br.cond.dpnt .L35

Note that the add and store to scratch_free_ptr doesn't 
appear until after the branch.

I have not attempted to diagnose why or where this happens.
>How-To-Repeat:
With the attached bug.c file:

[hboehm@plasma ~/tests]$ gcc -O1 bug.c
[hboehm@plasma ~/tests]$ ./a.out
scratch_free_ptr = (nil)
[hboehm@plasma ~/tests]$ gcc -O2 bug.c
[hboehm@plasma ~/tests]$ ./a.out
scratch_free_ptr = 0xfffffffffffe0000
[hboehm@plasma ~/tests]$ gcc --version
3.0
[hboehm@plasma ~/tests]$ 
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted:
----gnatsweb-attachment----
Content-Type: application/octet-stream; name="bug.c"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="bug.c"

I2luY2x1ZGUgPHN0ZGxpYi5oPgojaW5jbHVkZSA8c3RkaW8uaD4KCnN0YXRpYyBjaGFyICogc2Ny
YXRjaF9mcmVlX3B0ciA9IDA7CgpzdGF0aWMgY2hhciAqIEdDX3NjcmF0Y2hfZW5kX3B0ciA9IDA7
CgpjaGFyICogR0Nfc2NyYXRjaF9hbGxvYyhieXRlcykKcmVnaXN0ZXIgdW5zaWduZWQgbG9uZyBi
eXRlczsKewogICAgcmVnaXN0ZXIgY2hhciAqIHJlc3VsdCA9IHNjcmF0Y2hfZnJlZV9wdHI7Cgog
ICAgc2NyYXRjaF9mcmVlX3B0ciArPSBieXRlczsKICAgIGlmIChzY3JhdGNoX2ZyZWVfcHRyIDw9
IEdDX3NjcmF0Y2hfZW5kX3B0cikgewogICAgICAgIHJldHVybihyZXN1bHQpOwogICAgfQogICAg
ewogICAgICAgIHVuc2lnbmVkIGxvbmcgYnl0ZXNfdG9fZ2V0ID0gMTI4KjEwMjQ7CiAgICAgICAg
IAogICAgICAgIGlmIChieXRlc190b19nZXQgPD0gYnl0ZXMpIHsKICAgICAgICAgIC8qIFVuZG8g
dGhlIGRhbWFnZSwgYW5kIGdldCBtZW1vcnkgZGlyZWN0bHkgKi8KCSAgICBieXRlc190b19nZXQg
PSBieXRlczsKICAgCSAgICByZXN1bHQgPSAoY2hhciAqKW1hbGxvYyhieXRlc190b19nZXQpOwog
ICAgICAgICAgICBzY3JhdGNoX2ZyZWVfcHRyIC09IGJ5dGVzOwogICAgICAgICAgICByZXR1cm4o
cmVzdWx0KTsKICAgICAgICB9CgkvKiBOb3QgZXhlcmNpc2VkICovCglhYm9ydCgpOwoJcmV0dXJu
IDA7CiAgICB9Cn0KCmludCBtYWluKCkKewogICAgR0Nfc2NyYXRjaF9hbGxvYygxMjgqMTAyNCk7
CiAgICBwcmludGYoInNjcmF0Y2hfZnJlZV9wdHIgPSAlcFxuIiwgc2NyYXRjaF9mcmVlX3B0cik7
CiAgICAvKiBTaG91bGQgcHJpbnQgMCArIDEyOEsgLSAxMjhLID0gMCAqLwogICAgcmV0dXJuIDA7
Cn0K