🚀 go-pugleaf

The following code produces a core dump when executed. Reason: the
compiler takes the structure offset passed in y, TRIES TO ACCESS
that memory address as if it were a pointer, and uses the value
from there as the offset. Memory fault, core dumped.

struct V {
	int x;
} X;

typedef int V::* Vptr;

int test(Vptr y)
{
	return X.*y;
}

main() {
	X.x = 5;
	return test(&V::x);
}

This produces the following assembly code with the following g++:

Reading specs from /usr/local/lib/gcc-lib/i386-isc-isc/2.2.2/specs
gcc version 2.2.2
 /usr/local/lib/gcc-lib/i386-isc-isc/2.2.2/cpp -lang-c++ -v -undef -D__GNUC__=2 -D__GNUG__=2 -D__cplusplus -Dunix -Di386 -D__unix__ -D__i386__ -D__unix -D__i386 bug.cc /usr/tmp/cca01000.i
GNU CPP version 2.2.2 (80386, ATT syntax)
 /usr/local/lib/gcc-lib/i386-isc-isc/2.2.2/cc1plus /usr/tmp/cca01000.i -quiet -dumpbase bug.cc -version -o bug.s
GNU C++ version 2.2.2 (80386, ATT syntax) compiled by GNU C version 2.2.2.

	.file	"bug.cc"
gcc2_compiled.:
.text
	.align 4
.globl test__FPO1V_i
test__FPO1V_i:
	pushl %ebp
	movl %esp,%ebp
	movl 8(%ebp),%eax
---->	movl (%eax),%edx ; wrong, wrong, wrong!!!!!!
	addl $X,%edx
	movl (%edx),%eax
	jmp .L1
	.align 4
	jmp .L1
	.align 4
	jmp .L2
	.align 4
	jmp .L1
	.align 4
.L2:
.L1:
	leave
	ret
	.align 4
.globl main
main:
	pushl %ebp
	movl %esp,%ebp
	movl $5,X
	pushl $0
	call test__FPO1V_i
	addl $4,%esp
	movl %eax,%eax
	jmp .L3
	.align 4
	jmp .L3
	.align 4
	xorl %eax,%eax
	jmp .L3
	.align 4
	jmp .L3
	.align 4
.L3:
	leave
	ret
.comm X,4