NetBSD Problem Report #2811

Received: (qmail-queue invoked from smtpd); 6 Oct 1996 23:50:24 -0000
Message-Id: <199610062349.TAA25164@Twig.Rodents.Montreal.QC.CA>
Date: Sun, 6 Oct 1996 19:49:16 -0400 (EDT)
From: der Mouse  <mouse@Rodents.Montreal.QC.CA>
Reply-To: mouse@Rodents.Montreal.QC.CA
To: gnats-bugs@gnats.netbsd.org
Subject: [dM] code-generation bug
X-Send-Pr-Version: 3.95

>Number:         2811
>Category:       port-m68k
>Synopsis:       [dM] code-generation bug
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    gnats-admin
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 06 17:05:00 +0000 1996
>Closed-Date:    Thu Oct 23 00:14:07 +0000 1997
>Last-Modified:  Thu Oct 23 00:17:15 +0000 1997
>Originator:     der Mouse
>Release:        1.2_BETA, sup of Jul 3
>Organization:
	Dis-
>Environment:
	Seen on Sun-3/260, likely exists on any sun3, possibly other
	68k ports suffer from it.
System: NetBSD Twig.Rodents.Montreal.QC.CA 1.2_BETA NetBSD 1.2_BETA (TWIG) #0: Tue Sep 3 00:45:26 EDT 1996 mouse@Twig.Rodents.Montreal.QC.CA:/mouse/sources/working-usr-src/sys/arch/sun3/compile/TWIG sun3
>Description:
	There's a bug somewhere in the compiler's code generation.

	I do not (yet) know whether this appears in the underlying gcc
	distribution or was introduced by the NetBSD adaptation.  (The
	former seems likelier to me.)

	A loop reading
		for (; i >= 0; i--)
		  {
		    n0 = num_ptr[i];
		    __asm__ ("divu%.l %4,%1:%0"
			: "=d" ((unsigned long int)( quot_ptr[i] )),
			  "=d" ((unsigned long int)(  n1 ))
			: "0" ((unsigned long int)(  n0 )),
			  "1" ((unsigned long int)(  n1 )),
			  "dmi" ((unsigned long int)(  d ))	);
		  }
	gets miscompiled; in particular, in the resulting assembly (no
	optimization), in the fragment
			movel a6@(-12),d3
		#APP
			divul a6@(-20),d3:d2
		#NO_APP
			movel d3,d0		<<< line A
			movel d2,a0@(d0:l)	<<< line B
			movel d0,d1
			movel d1,a6@(-12)
	the lines marked "line A" and "line B" should be interchanged.
	Before the __asm__-generated instruction, d0 is correctly
	loaded with the addressing offset for the subscript store, but
	the compiler spazz causes it to try to use the remainder from
	the division as the subscript offset.  This usually segfaults;
	if the remainder is small, it may simply store into a randomly
	wrong memory location.

	Full input (and output, in case this is in some
	incomprehensible way the fault of something on this particular
	system) files are given below.  This is a stripped-down version
	of something seen while trying to install ssh 1.2.14 on
	NetBSD/sun3; it was crashing in mpn_div.  The .i file given
	here is a test case obtained by gutting cc -E output from
	mpn_div.c.
>How-To-Repeat:
	Inspect the generated assembly code in the following.
% cat bug.i
typedef	int 	ptrdiff_t;
typedef	unsigned int 	size_t;
typedef	int 	wchar_t;
typedef struct
{
  long int alloc;
  long int size;
  unsigned long int *d;
} __MP_INT;
typedef unsigned long int	mp_limb;
typedef long int		mp_limb_signed;
typedef mp_limb *		mp_ptr;
typedef const mp_limb *		mp_srcptr;
typedef long int		mp_size;
typedef struct
{
  __MP_INT  num;
  __MP_INT  den;
} MP_RAT;
void mp_set_memory_functions (void *(*) (size_t),
			      void *(*) (void *, size_t, size_t),
			      void (*) (void *, size_t));
void mpz_init (__MP_INT  *);
void mpz_set (__MP_INT  *, const __MP_INT  *);
void mpz_set_ui (__MP_INT  *, unsigned long int);
void mpz_set_si (__MP_INT  *, signed long int);
int mpz_set_str (__MP_INT  *, const char *, int);
void mpz_init_set (__MP_INT  *, const __MP_INT  *);
void mpz_init_set_ui (__MP_INT  *, unsigned long int);
void mpz_init_set_si (__MP_INT  *, signed long int);
int mpz_init_set_str (__MP_INT  *, const char *, int);
unsigned long int mpz_get_ui (const __MP_INT  *);
signed long int mpz_get_si (const __MP_INT  *);
char * mpz_get_str (char *, int, const __MP_INT  *);
void mpz_clear (__MP_INT  *);
void * _mpz_realloc (__MP_INT  *, mp_size);
void mpz_add (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_add_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_sub (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_sub_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_mul (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_mul_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_div (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_div_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_mod (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_mod_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_divmod (__MP_INT  *, __MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_divmod_ui (__MP_INT  *, __MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_mdiv (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_mdiv_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_mmod (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
unsigned long int mpz_mmod_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_mdivmod (__MP_INT  *, __MP_INT  *, const __MP_INT  *, const __MP_INT  *);
unsigned long int mpz_mdivmod_ui (__MP_INT  *, __MP_INT  *, const __MP_INT  *,
				  unsigned long int);
void mpz_sqrt (__MP_INT  *, const __MP_INT  *);
void mpz_sqrtrem (__MP_INT  *, __MP_INT  *, const __MP_INT  *);
int mpz_perfect_square_p (const __MP_INT  *);
int mpz_probab_prime_p (const __MP_INT  *, int);
void mpz_powm (__MP_INT  *, const __MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_powm_ui (__MP_INT  *, const __MP_INT  *, unsigned long int, const __MP_INT  *);
void mpz_pow_ui (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_fac_ui (__MP_INT  *, unsigned long int);
void mpz_gcd (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_gcdext (__MP_INT  *, __MP_INT  *, __MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_neg (__MP_INT  *, const __MP_INT  *);
void mpz_com (__MP_INT  *, const __MP_INT  *);
void mpz_abs (__MP_INT  *, const __MP_INT  *);
int mpz_cmp (const __MP_INT  *, const __MP_INT  *);
int mpz_cmp_ui (const __MP_INT  *, unsigned long int);
int mpz_cmp_si (const __MP_INT  *, signed long int);
void mpz_mul_2exp (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_div_2exp (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_mod_2exp (__MP_INT  *, const __MP_INT  *, unsigned long int);
void mpz_and (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_ior (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_xor (__MP_INT  *, const __MP_INT  *, const __MP_INT  *);
void mpz_array_init (__MP_INT  [], size_t, mp_size);
void mpz_random (__MP_INT  *, mp_size);
void mpz_random2 (__MP_INT  *, mp_size);
size_t mpz_size (const __MP_INT  *);
size_t mpz_sizeinbase (const __MP_INT  *, int);
void mpq_init (MP_RAT *);
void mpq_clear (MP_RAT *);
void mpq_set (MP_RAT *, const MP_RAT *);
void mpq_set_ui (MP_RAT *, unsigned long int, unsigned long int);
void mpq_set_si (MP_RAT *, signed long int, unsigned long int);
void mpq_add (MP_RAT *, const MP_RAT *, const MP_RAT *);
void mpq_sub (MP_RAT *, const MP_RAT *, const MP_RAT *);
void mpq_mul (MP_RAT *, const MP_RAT *, const MP_RAT *);
void mpq_div (MP_RAT *, const MP_RAT *, const MP_RAT *);
void mpq_neg (MP_RAT *, const MP_RAT *);
int mpq_cmp (const MP_RAT *, const MP_RAT *);
void mpq_inv (MP_RAT *, const MP_RAT *);
void mpq_set_num (MP_RAT *, const __MP_INT  *);
void mpq_set_den (MP_RAT *, const __MP_INT  *);
void mpq_get_num (__MP_INT  *, const MP_RAT *);
void mpq_get_den (__MP_INT  *, const MP_RAT *);
mp_limb mpn_add (mp_ptr, mp_srcptr, mp_size, mp_srcptr, mp_size);
mp_size mpn_sub (mp_ptr, mp_srcptr, mp_size, mp_srcptr, mp_size);
mp_size mpn_mul (mp_ptr, mp_srcptr, mp_size, mp_srcptr, mp_size);
mp_size mpn_div (mp_ptr, mp_ptr, mp_size, mp_srcptr, mp_size);
mp_limb mpn_divmod_1 (mp_ptr, mp_srcptr, mp_size, mp_limb);
mp_limb mpn_mod_1 (mp_srcptr, mp_size, mp_limb);
mp_limb mpn_lshift (mp_ptr, mp_srcptr, mp_size, unsigned int);
mp_size mpn_rshift (mp_ptr, mp_srcptr, mp_size, unsigned int);
mp_size mpn_rshiftci (mp_ptr, mp_srcptr, mp_size, unsigned int, mp_limb);
mp_size mpn_sqrt (mp_ptr, mp_ptr, mp_srcptr, mp_size);
int mpn_cmp (mp_srcptr, mp_srcptr, mp_size);
volatile void abort (void);
void *malloc (size_t);
void *realloc (void *, size_t);
void free (void *);
extern void *	(*_mp_allocate_func) (size_t);
extern void *	(*_mp_reallocate_func) (void *, size_t, size_t);
extern void	(*_mp_free_func) (void *, size_t);
void *_mp_default_allocate (size_t);
void *_mp_default_reallocate (void *, size_t, size_t);
void _mp_default_free (void *, size_t);
char *_mpz_get_str (char *, int, const __MP_INT  *);
int _mpz_set_str (__MP_INT  *, const char *, int);
void _mpz_impl_sqrt (__MP_INT  *, __MP_INT  *, const __MP_INT  *);
struct bases
{
  int chars_per_limb;
  mp_limb big_base;
  mp_limb big_base_inverted;
  float chars_per_bit_exactly;
};
extern const struct bases __mp_bases[37];
mp_size
mpn_div (mp_ptr quot_ptr,
	 mp_ptr num_ptr, mp_size num_size,
	 mp_srcptr den_ptr, mp_size den_size)
{
  mp_size q_is_long = 0;
  switch (den_size)
    {
    case 0:
      num_size = 1 / den_size;
    case 1:
      {
	mp_size i;
	mp_limb n1, n0;
	mp_limb d;
	d = den_ptr[0];
	i = num_size - 1;
	n1 = num_ptr[i];
	i--;
	if (n1 >= d)
	  {
	    q_is_long = 1;
	    n1 = 0;
	    i++;
	  }
	for (; i >= 0; i--)
	  {
	    n0 = num_ptr[i];
	    __asm__ ("divu%.l %4,%1:%0"
		: "=d" ((unsigned long int)( quot_ptr[i] )),
		  "=d" ((unsigned long int)(  n1 ))
		: "0" ((unsigned long int)(  n0 )),
		  "1" ((unsigned long int)(  n1 )),
		  "dmi" ((unsigned long int)(  d ))	);
	  }
	num_ptr[0] = n1;
      }
      break;
    }
  return q_is_long;
}
% gcc -S bug.i
% cat bug.s
#NO_APP
gcc2_compiled.:
___gnu_compiled_c:
.text
	.even
.globl _mpn_div
	.type	 _mpn_div,@function
_mpn_div:
	link a6,#-20
	movel d3,sp@-
	movel d2,sp@-
	clrl a6@(-4)
	movel a6@(24),d0
	tstl d0
	jeq L3
	moveq #1,d2
	cmpl d0,d2
	jeq L4
	jra L11
L3:
	moveq #1,d1
	divsll a6@(24),d0:d1
	movel d1,a6@(16)
L4:
	movel a6@(20),a0
	movel a0@,a6@(-20)
	movel a6@(16),d3
	subql #1,d3
	movel d3,a6@(-8)
	movel a6@(-8),d0
	movel d0,d1
	movel d1,d0
	asll #2,d0
	movel a6@(12),a0
	movel a0@(d0:l),a6@(-12)
	subql #1,a6@(-8)
	movel a6@(-12),d2
	cmpl a6@(-20),d2
	jcs L5
	moveq #1,d3
	movel d3,a6@(-4)
	clrl a6@(-12)
	addql #1,a6@(-8)
L5:
	nop
L6:
	tstl a6@(-8)
	jge L9
	jra L7
L9:
	movel a6@(-8),d0
	movel d0,d1
	movel d1,d0
	asll #2,d0
	movel a6@(12),a0
	movel a0@(d0:l),a6@(-16)
	movel a6@(-8),d0
	movel d0,d1
	movel d1,d0
	asll #2,d0
	movel a6@(8),a0
	movel a6@(-16),d2
	movel a6@(-12),d3
#APP
	divul a6@(-20),d3:d2
#NO_APP
	movel d3,d0
	movel d2,a0@(d0:l)
	movel d0,d1
	movel d1,a6@(-12)
L8:
	subql #1,a6@(-8)
	jra L6
L7:
	movel a6@(12),a0
	movel a6@(-12),a0@
	jra L2
L11:
L2:
	movel a6@(-4),d0
	jra L1
L1:
	movel a6@(-28),d2
	movel a6@(-24),d3
	unlk a6
	rts
Lfe1:
	.size	 _mpn_div,Lfe1-_mpn_div
% 
>Fix:
	Maybe someone can test whether this is the FSF's fault or ours,
	and, accordingly, either push it off to them or fix it....but
	not me.  gcc is too deep magic for me. :-)

					der Mouse

			       mouse@rodents.montreal.qc.ca
		     01 EE 31 F6 BB 0C 34 36  00 F3 7C 5A C1 A0 67 1D
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: gwr 
State-Changed-When: Wed Oct 22 17:14:07 PDT 1997 
State-Changed-Why:  
No longer reproducible. 
>Unformatted:
 	This appears to be OK now with the latest compiler.
 	Here is what I see now:  (cc -S)

        movel a6@(-16),d0
    #APP
        divul a6@(-4),d0:d1
    #NO_APP
        movel a6@(-8),d2
        movel d2,d3
        movel d3,d2
        asll #2,d2
        lea _quot_ptr,a0
        movel d1,a0@(d2:l)
        movel d0,a6@(-16)

Home	PR Database Search