re PR tree-optimization/60183 (phiprop creates invalid code)

2014-02-15  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/60183
	* tree-ssa-phiprop.c (propagate_with_phi): Avoid speculating
	loads.
	(tree_ssa_phiprop): Calculate and free post-dominators.

	* gcc.dg/torture/pr60183.c: New testcase.

From-SVN: r207797

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 59d1671f5ee6642b7002c4a59ffc6c75be192971..6d2331baa2ac1db038e06e7d12c10bf59ee3f576 100644 (file)
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,10 @@
+2014-02-15  Richard Biener  <rguenther@suse.de>
+
+       PR tree-optimization/60183
+       * tree-ssa-phiprop.c (propagate_with_phi): Avoid speculating
+       loads.
+       (tree_ssa_phiprop): Calculate and free post-dominators.
+
 2014-02-14  Jeff Law  <law@redhat.com>
 
        PR rtl-optimization/60131

diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 0415b74e08e74d4cd7254ee099cacabbe922a1b2..0891251b590f2b5f546236f98c7a2e6f550d69d5 100644 (file)
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2014-02-15  Richard Biener  <rguenther@suse.de>
+
+       PR tree-optimization/60183
+       * gcc.dg/torture/pr60183.c: New testcase.
+
 2014-02-14  Jeff Law  <law@redhat.com>
 
        PR rtl-optimization/60131

diff --git a/gcc/testsuite/gcc.dg/torture/pr60183.c b/gcc/testsuite/gcc.dg/torture/pr60183.c
new file mode 100644 (file)
index 0000000..d37b4b8
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr60183.c
@@ -0,0 +1,38 @@
+/* { dg-do run } */
+
+/* Large so an out-of-bound read will crash.  */
+unsigned char c[0x30001] = { 1 };
+int j = 2;
+
+static void
+foo (unsigned long *x, unsigned char *y)
+{
+  int i;
+  unsigned long w = x[0];
+  for (i = 0; i < j; i++)
+    {
+      w += *y;
+      y += 0x10000;
+      w += *y;
+      y += 0x10000;
+    }
+  x[1] = w;
+}
+
+__attribute__ ((noinline, noclone)) void
+bar (unsigned long *x)
+{
+  foo (x, c);
+}
+
+int
+main ()
+{
+  unsigned long a[2] = { 0, -1UL };
+  asm volatile (""::"r" (c):"memory");
+  c[0] = 0;
+  bar (a);
+  if (a[1] != 0)
+    __builtin_abort ();
+  return 0;
+}

diff --git a/gcc/tree-ssa-phiprop.c b/gcc/tree-ssa-phiprop.c
index bf2dcdb4dd1b96b92bf817bd148ce475f3b7b56b..4d66c12a6062f13ec1fa9b7100774d7193d7f16b 100644 (file)
--- a/gcc/tree-ssa-phiprop.c
+++ b/gcc/tree-ssa-phiprop.c
@@ -309,6 +309,12 @@ propagate_with_phi (basic_block bb, gimple phi, struct phiprop_d *phivn,
       gimple def_stmt;
       tree vuse;
 
+      /* Only replace loads in blocks that post-dominate the PHI node.  That
+         makes sure we don't end up speculating loads.  */
+      if (!dominated_by_p (CDI_POST_DOMINATORS,
+                          bb, gimple_bb (use_stmt)))
+       continue;
+         
       /* Check whether this is a load of *ptr.  */
       if (!(is_gimple_assign (use_stmt)
            && TREE_CODE (gimple_assign_lhs (use_stmt)) == SSA_NAME
@@ -380,6 +386,7 @@ tree_ssa_phiprop (void)
   size_t n;
 
   calculate_dominance_info (CDI_DOMINATORS);
+  calculate_dominance_info (CDI_POST_DOMINATORS);
 
   n = num_ssa_names;
   phivn = XCNEWVEC (struct phiprop_d, n);
@@ -397,6 +404,8 @@ tree_ssa_phiprop (void)
   bbs.release ();
   free (phivn);
 
+  free_dominance_info (CDI_POST_DOMINATORS);
+
   return 0;
 }