| Summary: | x86: Handle F32 Iex_ITE expression | ||
|---|---|---|---|
| Product: | [Developer tools] valgrind | Reporter: | Mark Harris <mark.hsj> |
| Component: | vex | Assignee: | Paul Floyd <pjfloyd> |
| Status: | REPORTED --- | ||
| Severity: | normal | CC: | pjfloyd |
| Priority: | NOR | ||
| Version First Reported In: | 3.27 GIT | ||
| Target Milestone: | --- | ||
| Platform: | unspecified | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed/Implemented In: | ||
| Sentry Crash Report: | |||
| Attachments: |
Patch to correct the issue
Source file to reproduce the issue main on FreeBSD Linux objdump |
||
|
Description
Mark Harris
2026-01-20 19:49:22 UTC
Created attachment 188723 [details]
Patch to correct the issue
Created attachment 188724 [details]
Source file to reproduce the issue
Created attachment 188741 [details]
main on FreeBSD
I don't see the problem on FreeBSD with clang-devel (22.0.0git). Here is the output of objdump --disassemble-symbols=main
Created attachment 188742 [details]
Linux objdump
On Linux clang is defaulting to some form of SSE rather than x87.
I can reproduce on Fedora 43, clang 21.1.8. On FreeBSD clang -m32 -msse2 -mfpmath=sse ./bug514876.c -o ./bug514876 -lm generates SSE but still does not reproduce the error. Need to diff the asm and check if it is really SSE2. (In reply to Paul Floyd from comment #6) > On FreeBSD clang -m32 -msse2 -mfpmath=sse ./bug514876.c -o ./bug514876 -lm > generates SSE but still does not reproduce the error. I don't have a FreeBSD machine to try, but at least on Linux it requires -O or -O2; it does not reproduce without optimization. Sorry , yes, I can only reproduce with -O, I'll try that again.
I have no problem with --vex-guest-chase=no
On Linux the problem is in this section of code
a = sin(sqrt(i));
804839a: 0f 57 d2 xorps %xmm2,%xmm2
804839d: f2 0f 2a d6 cvtsi2sd %esi,%xmm2
80483a1: 0f 57 c9 xorps %xmm1,%xmm1
80483a4: f2 0f 51 ca sqrtsd %xmm2,%xmm1
80483a8: 66 0f 57 c0 xorpd %xmm0,%xmm0
80483ac: f2 0f 11 54 24 20 movsd %xmm2,0x20(%esp)
80483b2: 66 0f 2e d0 ucomisd %xmm0,%xmm2
80483b6: f2 0f 11 4c 24 30 movsd %xmm1,0x30(%esp)
80483bc: 66 0f 28 c1 movapd %xmm1,%xmm0
80483c0: 73 1a jae 80483dc <main+0x5c>
80483c2: f2 0f 10 44 24 20 movsd 0x20(%esp),%xmm0
80483c8: f2 0f 11 04 24 movsd %xmm0,(%esp)
80483cd: e8 3e fe ff ff call 8048210 <sqrt@plt>
80483d2: dd 5c 24 40 fstpl 0x40(%esp)
80483d6: f2 0f 10 44 24 40 movsd 0x40(%esp),%xmm0
80483dc: f2 0f 11 04 24 movsd %xmm0,(%esp)
80483e1: e8 5a fe ff ff call 8048240 <sin@plt>
80483e6: d9 5c 24 2c fstps 0x2c(%esp)
80483ea: f3 0f 10 54 24 2c movss 0x2c(%esp),%xmm2
where the jae causes the problem. As I understand that it does
1. speculative sqrt op-code (onlu valid for
2. checks the arg is >= 0
3. if it is, jump around next block
4. if it is < 0 call libm sqrt
I can reproduce with clang 19 and -O on FreeBSD, but not with clang22. I need to write a reproducer in assembler since triggering this from C seems complicated. |