https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69234
Bug ID: 69234 Summary: recent GCC trunk compilers miscompile the V8 JavaScript interpreter/JITC Product: gcc Version: unknown Status: UNCONFIRMED Severity: normal Priority: P3 Component: middle-end Assignee: unassigned at gcc dot gnu.org Reporter: abe_skolnik at yahoo dot com Target Milestone: --- Recent GCC trunk compilers miscompile the V8 JavaScript interpreter/JITC such that the compiled V8 [sans Chrome/Chromium] crashes when running the included-with-V8 benchmarks. Compiling the exact same V8 source code using GCC 5.2.0 or 5.3.0 results in correct execution. We have tested execution on both AMD64 [AKA "x86_64"] and AArch64 [AKA "ARM64"]. For the AMD64-targeting compilers, the compiler was bootstrapped. The AArch64-targeting compilers were cross-compilers. With lots of help from my teammate Kevin Hu, we have isolated that the first commit that breaks V8 seems to be trunk Subversion r226861; GCC from trunk r226860 compiles V8 such that it runs its own benchmarks OK. [Please note that the fork known as "Octane" of the V8 benchmarks was not used.] We have determined that the location of the crash -- "IncrementalMarking::ActivateIncrementalWriteBarrier(NewSpace*)" -- is not compiled any differently by the two different revisions of the compiler [at least when targeting AMD64]. However, we _have_ been able to determine that replacing only the object file containing that method -- "incremental-marking.o" -- and using that file while manually relinking the V8 build that was otherwise compiled with the earlier-revision compiler _does_ produce a crashing V8 "shell" program. Therefor, logically, at least one subroutine in this ".o" file was miscompiled. The same crash has been found on AMD64 in r232207 from today [January 11 2016]. We are still working on reducing the test case further; we will post a smaller test case later. Steps to reproduce ------------------ * build GCC trunk r226860 for either AMD64 or AArch64 * build GCC trunk r226861 for either AMD64 or AArch64 * check out V8 version 4.9.274 from <https://chromium.googlesource.com/v8/v8.git/+/refs/heads/4.9.274> * build V8 with GCC trunk r226860 using either "make x64.release" or "make arm64.release", "cd" into "benchmarks", execute "../out/<build_type>/shell run.js" * build V8 with GCC trunk r226861 using either "make x64.release" or "make arm64.release", "cd" into "benchmarks", execute "../out/<build_type>/shell run.js"