https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55212
--- Comment #187 from Kazumoto Kojima <kkojima at gcc dot gnu.org> --- Created attachment 58989 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58989&action=edit a testcase for wrong code which is pre-processed gcc/gimple-fold.cc One other segfault is seen when compiling libgcc/libgcov-driver.c. It seems that gcc/gimple-fold.cc: fold_const_aggregate_ref_1(tree_node*, tree_node* (*)(tree_node*)) is miscompiled with -O2 -mlra. The asm code sequences in question are [-O2 -mno-lra] ... mov.l .L13907,r1 ! 2387 [c=10 l=2] movsi_ie/0 mov #0,r6 ! 2383 [c=4 l=2] movsi_ie/2 mov.l r3,@(4,r0) ! 542 [c=4 l=2] movsi_ie/8 mov.l r5,@(8,r0) ! 546 [c=4 l=2] movsi_ie/8 mov #96,r0 ! 2385 [c=4 l=2] movsi_ie/2 mov.l r3,@(8,r15) ! 556 [c=4 l=2] movsi_ie/8 mov.l r5,@(4,r15) ! 558 [c=4 l=2] movsi_ie/8 mov.l r3,@r15 ! 560 [c=4 l=2] movsi_ie/8 mov.l r6,@(16,r15) ! 552 [c=4 l=2] movsi_ie/8 mov.l r6,@(12,r15) ! 554 [c=4 l=2] movsi_ie/8 mov.l @(r0,r15),r6 ! 563 [c=3 l=2] movsi_ie/5 mov.l @(56,r15),r5 ! 564 [c=1 l=2] movsi_ie/5 jsr @r1 ! 566 [c=5 l=2] call_valuei mov.l @(60,r15),r4 ! 565 [c=1 l=2] movsi_ie/5 mov.l @(60,r15),r10 ! 2388 [c=1 l=2] movsi_ie/5 mov r0,r7 ! 1828 [c=4 l=2] movsi_ie/1 mov.l @(56,r15),r4 ! 576 [c=1 l=2] movsi_ie/5 mov.l r0,@(16,r10) ! 570 [c=4 l=2] movsi_ie/8 mov r10,r5 ! 577 [c=4 l=2] movsi_ie/1 mov.l .L13908,r10 ! 2389 [c=10 l=2] movsi_ie/0 jsr @r10 ! 579 [c=1 l=2] block_lump_real_i4/0 mov #1,r6 ! 578 [c=4 l=2] movsi_ie/2 [-O2 -mlra] ... mov.l .L13994,r14 ! 2172 [c=10 l=2] movsi_ie/0 mov.l r0,@(16,r10) ! 524 [c=4 l=2] movsi_ie/8 mov #1,r6 ! 532 [c=4 l=2] movsi_ie/2 mov.l r0,@(56,r15) ! 2562 [c=4 l=2] movsi_ie/8 jsr @r14 ! 533 [c=1 l=2] block_lump_real_i4/0 mov r10,r5 ! 531 [c=4 l=2] movsi_ie/1 mov.l @(40,r15),r7 ! 2173 [c=1 l=2] movsi_ie/5 mov #0,r3 ! 2694 [c=4 l=2] movsi_ie/2 mov #8,r2 ! 2693 [c=4 l=2] movsi_ie/2 mov.w .L13995,r1 ! 2561 [c=10 l=2] *movhi/0 mov.l r2,@(44,r7) ! 2695 [c=4 l=2] movsi_ie/8 mov r4,r5 ! 567 [c=4 l=2] movsi_ie/1 mov.l r3,@(48,r7) ! 2696 [c=4 l=2] movsi_ie/8 mov r10,r4 ! 568 [c=4 l=2] movsi_ie/1 mov.l @(60,r15),r7 ! 2419 [c=1 l=2] movsi_ie/5 mov.l .L13996,r2 ! 2566 [c=10 l=2] movsi_ie/0 mov.l r7,@r13 ! 541 [c=4 l=2] movsi_ie/8 mov.l r1,@(8,r13) ! 549 [c=4 l=2] movsi_ie/8 mov.l r12,@(4,r13) ! 2176 [c=4 l=2] movsi_ie/8 mov.l @(56,r15),r6 ! 566 [c=1 l=2] movsi_ie/5 mov.l r1,@(4,r15) ! 561 [c=4 l=2] movsi_ie/8 mov.l r11,@(16,r15) ! 2179 [c=4 l=2] movsi_ie/8 mov.l r11,@(12,r15) ! 2180 [c=4 l=2] movsi_ie/8 mov.l r12,@(8,r15) ! 2181 [c=4 l=2] movsi_ie/8 jsr @r2 ! 569 [c=5 l=2] call_valuei mov.l r12,@r15 ! 2183 [c=4 l=2] movsi_ie/8 mov #1,r6 ! 581 [c=4 l=2] movsi_ie/2 mov.l r0,@(16,r10) ! 573 [c=4 l=2] movsi_ie/8 mov r0,r7 ! 1839 [c=4 l=2] movsi_ie/1 jsr @r14 ! 582 [c=1 l=2] block_lump_real_i4/0 mov r10,r5 ! 580 [c=4 l=2] movsi_ie/1 In the latter case, the last jsr @r14 that is calling __movstr_i4_odd libgcc asm function of which arguments are r4, r5, r6. We can't see any explicit insn to set r4 after jsr@r2 that is calling wi::mul_internal c++ function which may clobber r4. We can find mov.l @(56,r15),r4 before jsr @r10 which is __movstr_i4_odd call in the former -mno-lra case. In the -mlra case, r4 is 0x1 when __movstr_i4_odd is called. Looks a wrong code.
