https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91489

            Bug ID: 91489
           Summary: misplaced stack pointer when __ms_hook_prologue__
                    attribute is used
           Product: gcc
           Version: 9.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gofmanp at gmail dot com
  Target Milestone: ---

Created attachment 46729
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=46729&action=edit
Preprocessed test program (gcc -v -save-temps -m32 -O2 ./file.c)

gcc -v:
Using built-in specs.
COLLECT_GCC=/usr/bin/gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-redhat-linux/9/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-redhat-linux
Configured with: ../configure --enable-bootstrap
--enable-languages=c,c++,fortran,objc,obj-c++,ada,go,d,lto --prefix=/usr
--mandir=/usr/share/man --infodir=/usr/share/info
--with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-shared
--enable-threads=posix --enable-checking=release --enable-multilib
--with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions
--enable-gnu-unique-object --enable-linker-build-id
--with-gcc-major-version-only --with-linker-hash-style=gnu --enable-plugin
--enable-initfini-array --with-isl --enable-offload-targets=nvptx-none
--without-cuda-driver --enable-gnu-indirect-function --enable-cet
--with-tune=generic --with-arch_32=i686 --build=x86_64-redhat-linux
Thread model: posix
gcc version 9.1.1 20190503 (Red Hat 9.1.1-1) (GCC)

OS: Linux, Fedora 30 (x86_64)

The following test program crashes with SEGFAULT (on return from second call to
test_func()) when compiled as 'gcc -m32 -O2':
-----
#include <stdio.h>

unsigned int __attribute__ ((noinline)) __attribute__((__stdcall__))
__attribute__((__ms_hook_prologue__)) test_func( unsigned long *size )
{
    static int once;

    if (once++ == 0)
        printf("(%p): stub\n", size);
    return 1;
}

int main(int argc, char **argv)
{
    printf("%#x.\n", test_func(NULL));
    printf("%#x.\n", test_func(NULL));
}
----

The stack pointer is wrong in one of the code paths in test_func(). Here is the
snippet from 'objdump -d a.out':
----
 80491e0:       8b ff                   mov    %edi,%edi

 80491e2:       55                      push   %ebp
 80491e3:       8b ec                   mov    %esp,%ebp

 80491e5:       a1 1c c0 04 08          mov    0x804c01c,%eax
 80491ea:       8d 50 01                lea    0x1(%eax),%edx
 80491ed:       89 15 1c c0 04 08       mov    %edx,0x804c01c
 80491f3:       85 c0                   test   %eax,%eax
 80491f5:       74 09                   je     8049200 <test_func+0x20>
 80491f7:       b8 01 00 00 00          mov    $0x1,%eax

; the stack pointer is wrong here, need 'leave' or equivalent

 80491fc:       c2 04 00                ret    $0x4
 80491ff:       90                      nop
 8049200:       5d                      pop    %ebp
 8049201:       83 ec 14                sub    $0x14,%esp
 8049204:       ff 74 24 18             pushl  0x18(%esp)
 8049208:       68 0c a0 04 08          push   $0x804a00c
 804920d:       e8 2e fe ff ff          call   8049040 <printf@plt>
 8049212:       b8 01 00 00 00          mov    $0x1,%eax
 8049217:       83 c4 1c                add    $0x1c,%esp
 804921a:       c2 04 00                ret    $0x4

----
The problem is not there without __attribute__((__ms_hook_prologue__)) (no
stack frame is generated in this case), or without -O2 compiler flag.

The problem originates from here: https://bugs.winehq.org/show_bug.cgi?id=47633

Reply via email to