[Bug tree-optimization/54906] New: write introduction incorrect wrt the C++11 memory model (case with atomic accesses)

[francesco.zappa.nardelli at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54906



             Bug #: 54906

           Summary: write introduction incorrect wrt the C++11 memory

                    model (case with atomic accesses)

    Classification: Unclassified

           Product: gcc

           Version: 4.8.0

            Status: UNCONFIRMED

          Severity: normal

          Priority: P3

         Component: tree-optimization

        AssignedTo: unassig...@gcc.gnu.org

        ReportedBy: francesco.zappa.narde...@gmail.com





The program below is miscompiled by g++ --param allow-store-data-races=0 -O2

(or -O3).



$ g++ -v

gcc version 4.8.0 20121011 (experimental) (GCC) 



#include <atomic>

using namespace std;

uint8_t g_5;

atomic_ushort a_9;

atomic_schar a_24;



void func_1 () {

  if (a_9.load ())

    for (g_5 = 0; 0; g_5++) {

    }

  a_24.store (0);

}



int main () {

  func_1 ();

  return 0;

}



The assembly code generated by -O3 for func_1 is:



_Z6func_1v:

        movzwl  a_9(%rip), %edx

        xorl    %eax, %eax

        testw   %dx, %dx

        movzbl  g_5(%rip), %edx

        cmove   %edx, %eax

        movb    %al, g_5(%rip)

        movb    $0, a_24(%rip)

        mfence

        ret



This code loads and restores the global variable g_5, while the reference

semantics for the source program does not perform a write to g_5.  It is easy

to write a non-racy context that observes this unexpected behaviour.



[Bug 54900 might be related or not; in the example here the write is introduced

only if a_24 is an atomic variable].