https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127584
Bug ID: 127584
Summary: RISC-V: -freorder-blocks-and-partition corrupts ra
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: target
Assignee: unassigned at gcc dot gnu.org
Reporter: anton at ozlabs dot org
Target Milestone: ---
Created attachment 65674
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=65674&action=edit
Testcase that corrupts ra
A large Verilator model built with -fprofile-generate, then -fprofile-use
-freorder-blocks-and-partition is hitting a SEGV. It looks like ra is corrupted
by a jump that crosses sections. It needs to be a leaf function, and it needs
to be far away enough that linker relaxation does not replace the long jump
with a shorter sequence.
I also suspect that we shouldn't be using ra (or the alternate link register
t0) because it hints to the hardware that this is a function call and not a
branch and that we should place the address on the return predictor stack.
I got AI to help come up with a test case (attached):
### 1. train (cold path never taken)
### 2. rebuild with -fprofile-use -freorder-blocks-and-partition
partitioned: leaf.cold present
### 3. link at increasing hot/cold separation, then call the cold path
padding gap_KiB result output
4000B 0 OK leaf(12345) = 1017950208
1600000B 0 SEGV qemu: uncaught target signal 11
(Segmentat
2800000B 0 SEGV qemu: uncaught target signal 11
(Segmentat
3600000B 0 SIGILL qemu: uncaught target signal 4 (Illegal
in
8000000B 0 SIGILL qemu: uncaught target signal 4 (Illegal
in
### the crossing jump as linked, in the last binary built above
7b1784: ff85f097 auipc ra,0xff85f
7b1788: c1e08067 jr -994(ra) # 103a2 <leaf.cold>
