🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: gnu.gcc.bug
Article #6412

gcc 2.7.1 / x86 bug

#6412
From: Mikael Pettersson
Date: Mon, 27 Nov 1995 00:00
76 lines
2663 bytes
GCC 2.7.1, configured with "i486-hp-solaris2", grossly
miscompiles the following code:

/* yyy.c */
struct rml_state {
    void **SP, *FC, **SC, *TP, *ARGS[10];
};
extern void *Unify_2eunify(struct rml_state*);
extern void *sclam616(struct rml_state*);

void *sclam617(struct rml_state *rmlState) 
{
    void **tmp950 = rmlState->SC;
    void *tmp375 = tmp950[1];		/*1a*/
    void *tmp374 = tmp950[2];
    void *tmp602 = tmp950[3];
    void *tmp609 = rmlState->ARGS[0];
    void *tmp610 = rmlState->ARGS[1];	/*2a*/
    tmp950[3] = tmp375;			/*1b*/
    tmp950[2] = tmp602;
    tmp950[1] = tmp610;			/*2b*/
    tmp950[0] = (void*)sclam616;
    rmlState->ARGS[1] = tmp609;
    rmlState->ARGS[0] = tmp602;
    rmlState->FC = (void**)tmp374;
    rmlState->SP = tmp950;
    return (void*)Unify_2eunify;
}

The problem is that gcc performs the second load-store group
(2a and 2b) BEFORE it does the load at 1a, and in doing so
overwrites the original value of tmp950[1]. tmp375 will then
later be loaded with the wrong value.

This is the output of gcc -O1 -S yyy.c:
(the output of -O2 is identical.)

	.file	"yyy.c"
	.version	"01.01"
gcc2_compiled.:
.text
	.align 16
.globl sclam617
	.type	 sclam617,@function
sclam617:
	pushl %ebp
	movl %esp,%ebp
	pushl %edi
	pushl %esi
	pushl %ebx
	movl 8(%ebp),%edx	/	%edx = arg1 = rmlState
	movl 8(%edx),%eax	/	tmp950 = rmlState->SC
	movl 8(%eax),%ebx	/	tmp374 = tmp950[2]
	movl 12(%eax),%esi	/	tmp602 = tmp950[3]
	movl 16(%edx),%edi	/	tmp609 = rmlState->ARGS[0]
	movl 20(%edx),%ecx	/ 2a.	tmp610 = rmlState->ARGS[1]
	movl %ecx,4(%eax)	/ 2b.	tmp950[1] = tmp610
	movl 4(%eax),%ecx	/ 1a.	tmp375 = tmp950[1]  **WRONG VALUE**
	movl %ecx,12(%eax)	/ 1b.	tmp950[3] = tmp375  **WRONG VALUE**
	movl %esi,8(%eax)	/	tmp950[2] = tmp602
	movl $sclam616,(%eax)	/	tmp950[0] = sclam616
	movl %edi,20(%edx)	/	rmlState->ARGS[1] = tmp609
	movl %esi,16(%edx)	/	rmlState->ARGS[0] = tmp602
	movl %ebx,4(%edx)	/	rmlState->FC = tmp374
	movl %eax,(%edx)	/	rmlState->SP = tmp950
	movl $Unify_2eunify,%eax /	return Unify_2eunify
	leal -12(%ebp),%esp
	popl %ebx
	popl %esi
	popl %edi
	movl %ebp,%esp
	popl %ebp
	ret
.Lfe1:
	.size	 sclam617,.Lfe1-sclam617
	.ident	"GCC: (GNU) 2.7.1"
Technical Details
Message-ID: <9511280211.AA13709@sen14.ida.liu.se>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 113d02,7a665ac74fba9964,start
X-Google-Attributes: gid113d02,public
From: mpe@ida.liu.se (Mikael Pettersson)
Subject: gcc 2.7.1 / x86 bug
Date: 1995/11/27
Message-ID: <9511280211.AA13709@sen14.ida.liu.se>
X-Deja-AN: 120236561
distribution: gnu
sender: daemon@cis.ohio-state.edu
organization: GNUs Not Usenet
newsgroups: gnu.gcc.bug