Bug 996643 - gcc -02 optmization regression in v4.8 causing malformed arg passing (32 bit arch only)
gcc -02 optmization regression in v4.8 causing malformed arg passing (32 bit ...
Status: CLOSED DUPLICATE of bug 997109
Product: Red Hat Developer Toolset
Classification: Red Hat
Component: gcc (Show other bugs)
DTS 1.1 RHEL 6
i386 Linux
high Severity urgent
: ---
: 2.0
Assigned To: Jakub Jelinek
Martin Cermak
:
Depends On: 995446
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-13 11:10 EDT by Marek Polacek
Modified: 2013-08-15 11:01 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 995446
Environment:
Last Closed: 2013-08-15 11:01:56 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
GNU Compiler Collection 57459 None None None Never

  None (edit)
Description Marek Polacek 2013-08-13 11:10:18 EDT
+++ This bug was initially created as a clone of Bug #995446 +++

We've just hit this. It seems that there's some regression in -O2 gcc optimization which causes the value to be malformed on function call (the value is incresed by one). We've hit this problem with lvm2 with recent gcc in F19 (gcc (GCC) 4.8.1 20130603 (Red Hat 4.8.1-1)).

Snippet from the log message for the workaround we use now in lvm2 to avoid this issue:

 gcc -O2 v4.8 on 32 bit architecture is causing a bug in parameter
    passing. It does not happen with -01 nor -O0.
    
    The problematic part of the code was strlen use in config.c in
    the config_def_check fn and the call for _config_def_check_tree in it:
    
    <snip>
      rplen = strlen(rp);
      if (!_config_def_check_tree(handle, vp, vp + strlen(vp), rp, rp + rplen, CFG_PATH_MAX_LEN - rplen, cn, cmd->cft_def_hash)) ...
    </snip>
    

   If compiled with -O0 (correct):
    
    Breakpoint 1, config_def_check (cmd=0x819b050, handle=0x81a04f8) at config/config.c:775
    (gdb) p	vp
    $1 = 0x8189ee0 <_cfg_path> "config"
    (gdb) p	strlen(vp)
    $2 = 6
    (gdb)
    _config_def_check_tree (handle=0x81a04f8, vp=0x8189ee0 <_cfg_path>
    "config", pvp=0x8189ee6 <_cfg_path+6> "", rp=0xbfffe1e8 "config",
    prp=0xbfffe1ee "", buf_size=58, root=0x81a2568, ht=0x81a65
    48) at config/config.c:680
    (gdb) p	vp
    $4 = 0x8189ee0 <_cfg_path> "config"
    (gdb) p	pvp
    $5 = 0x8189ee6 <_cfg_path+6> ""
    
    If compiled with -O2 (incorrect):
    
    Breakpoint 1, config_def_check (cmd=cmd@entry=0x8183050, handle=0x81884f8) at config/config.c:775
    (gdb) p	vp
    $1 = 0x8172fc0 <_cfg_path> "config"
    (gdb) p strlen(vp)
    $2 = 6
    (gdb) p	vp + strlen(vp)
    $3 = 0x8172fc6 <_cfg_path+6> ""
    (gdb)
    _config_def_check_tree (handle=handle@entry=0x81884f8, pvp=0x8172fc7
    <_cfg_path+7> "host_list", rp=rp@entry=0xbffff190 "config",
    prp=prp@entry=0xbffff196 "", buf_size=buf_size@entry=58, ht=0x
    818e548, root=0x818a568, vp=0x8172fc0 <_cfg_path> "config") at
    config/config.c:674
    (gdb) p	pvp
    $4 = 0x8172fc7 <_cfg_path+7> "host_list"
    
    The difference is in passing the "pvp" arg for _config_def_check_tree.
    While in the correct case, the value of _cfg_path+6 is passed
    (the result of vp + strlen(vp) - see the snippet of the code above),
    in the incorrect case, this value is increased by 1 to _cfg_path+7,
    hence totally malforming the string that is being processed.


See also https://git.fedorahosted.org/cgit/lvm2.git/commit/?id=2f61478436a7ebe058ffad3f92e1c4dada0805d0. The workaround we provide for now is that the _cfg_path variable is not define with "const" qualifier (so we assume that the optimizer is less aggressive then - it actually helps).

The code itself: https://git.fedorahosted.org/cgit/lvm2.git/tree/lib/config/config.c. The breakpoint was set to the line just before the _config_def_check_tree_call in config_def_check function.

Please, let me know if you need any more info...

--- Additional comment from Peter Rajnoha on 2013-08-09 07:45:32 EDT ---

(In reply to Peter Rajnoha from comment #0)

> ?id=2f61478436a7ebe058ffad3f92e1c4dada0805d0. The workaround we provide for
> now is that the _cfg_path variable is not define with "const" qualifier (so
> we assume that the optimizer is less aggressive then - it actually helps).

(sorry, I meant "static" qualifier, not the "const").

Also, shuffling the arg list for the _config_def_check_tree fn helped (but the workaround with removing the "static" is shorter...

--- Additional comment from Peter Rajnoha on 2013-08-09 08:04:47 EDT ---

This is not reproducible with the older gcc v4.7.2 (the version that is currently in F18).

--- Additional comment from Jakub Jelinek on 2013-08-12 05:35:56 EDT ---

Please provide preprocessed source for the source file in question and gcc command line options used to compile it.

--- Additional comment from Peter Rajnoha on 2013-08-12 07:09:51 EDT ---

Preprocessed config.i attached, the complete option list used:

-Wall -Wundef -Wshadow -Wcast-align -Wwrite-strings -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -Winline -Wmissing-noreturn -Wformat-security -Wredundant-decls -Wpointer-arith -g -O2 -fPIC -save-temps

--- Additional comment from Jakub Jelinek on 2013-08-12 15:37:13 EDT ---

I think I'd prefer to see this under debugger, how can one reproduce this under gdb and does it require any special setup?

--- Additional comment from Mikulas Patocka on 2013-08-12 21:20:43 EDT ---

The expanded strlen of an aligned string should look like this:
s_l:
.LFB12:
        .cfi_startproc
        movl    $b, %eax
.L2:
        movl    (%eax), %ecx
        addl    $4, %eax
        leal    -16843009(%ecx), %edx
        notl    %ecx
        andl    %ecx, %edx
        andl    $-2139062144, %edx
        je      .L2
        movl    %edx, %ecx
        shrl    $16, %ecx
        testl   $32896, %edx
        cmove   %ecx, %edx
        leal    2(%eax), %ecx
        cmove   %ecx, %eax
        addb    %dl, %dl
        sbbl    $3, %eax
        subl    $b, %eax
        ret

In the assembler that results from compiling the submitted file with
"gcc -m32 -O2 -g -fPIC config.i -S" we can see:

.L706:
        movl    (%edx), %ecx
        addl    $4, %edx
        leal    -16843009(%ecx), %eax
        notl    %ecx
        movl    %eax, 44(%esp)
        andl    %ecx, 44(%esp)
        andl    $-2139062144, 44(%esp)
        je      .L706
        movl    44(%esp), %eax
        movl    52(%esp), %ecx
        movl    %ecx, 60(%esp)
        movl    %eax, %ecx
        shrl    $16, %ecx
        testl   $32896, %eax
        movl    %ecx, 52(%esp)
        movl    %eax, %ecx
        leal    2(%edx), %eax
        cmove   52(%esp), %ecx
        cmove   %eax, %edx
        addb    %cl, 44(%esp)
        .loc 1 775 0
        movl    160(%esp), %eax
        .loc 1 776 0
        sbbl    $3, %edx
        subl    48(%esp), %edx
        .loc 1 775 0
        addl    56(%esp), %edx
        movl    %edx, %ecx

--- that "addb    %cl, 44(%esp)" seems to be wrong, it should be "addb %cl, %cl"

--- Additional comment from Jakub Jelinek on 2013-08-13 05:31:10 EDT ---

Self-contained reduced executable testcase.

--- Additional comment from Jakub Jelinek on 2013-08-13 05:41:02 EDT ---

Seems to be PR57459.

Note You need to log in before you can comment on or make changes to this bug.