https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98161
Bug ID: 98161
Summary: [11 Regression] Incorrect stack realignment on
__force_align_arg_pointer__+-mavx
Product: gcc
Version: 11.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c
Assignee: unassigned at gcc dot gnu.org
Reporter: slyfox at gcc dot gnu.org
Target Milestone: ---
The bug was initially observed as a miscompilation of wine-5.22 built with
gcc-11 -march=sandybridge. gcc-10 seems to generate something that works.
Here is the extracted executable reproducer. It should return 12, but returns
56:
// $ cat bug.c.c
typedef unsigned short u16;
typedef unsigned int u32;
typedef unsigned char u8;
u32
__attribute__((__force_align_arg_pointer__))
unreach(
const u16 * pu16,
u16 *dst, u32 dstlen,
const u8 *src, u32 srclen
)
{
for (u32 i = dstlen; srclen && i; i--, srclen--, src++, dst++)
{
u16 off = pu16[*src];
if (off)
{
src++; srclen--;
*dst = pu16[off + *src];
}
}
return 56;
}
u32
__attribute__((__force_align_arg_pointer__))
__attribute__((noipa))
bug(
const u16 * pu16,
u16 *dst, u32 dstlen,
const u8 *src, u32 srclen
)
{
if (pu16)
/* Branch should not execute, but stack realignment
* reads wrong 'pu16' value from stack. */
return unreach(pu16, dst, dstlen, src, srclen);
return (srclen < dstlen) ? srclen : dstlen;
}
int main() {
/* Should return 12 */
return bug(0, 0, 12, 0, 34);
}
Running the example:
$ x86_64-pc-linux-gnu-gcc -m32 -fno-PIC -fno-builtin -pipe -fcf-protection=none
-fno-stack-protector -fno-omit-frame-pointer -O1 -mavx -o bug bug.c.c; ./bug ;
echo $?
12
$ x86_64-pc-linux-gnu-gcc -m32 -fno-PIC -fno-builtin -pipe -fcf-protection=none
-fno-stack-protector -fno-omit-frame-pointer -O2 -mavx -o bug bug.c.c; ./bug ;
echo $?
56
Looking at generated code %ebp and %ecx are confused as a pointer to arguments
on stack:
bug:
leal 4(%esp), %ecx ; argument pointer
andl $-16, %esp ; %esp is realigned
pushl -4(%ecx)
pushl %ebp
movl %esp, %ebp ; %ebp points to realigned location
pushl %ebx
vmovd 16(%ebp), %xmm1 ; arg3(pu16) BUG: arguments are read
; related to %ebp, not %ecx
vmovd 24(%ebp), %xmm2 ; arg5(dstlen)
movl 8(%ebp), %edx ; arg1(srclen)
pushl %ecx
vpminud %xmm2, %xmm1, %xmm0
movl 12(%ebp), %ecx
movl 20(%ebp), %ebx
vmovd %xmm0, %eax
testl %edx, %edx
je .L21
subl $4, %esp
vmovd %xmm2, (%esp)
pushl %ebx
subl $4, %esp
vmovd %xmm1, (%esp)
pushl %ecx
pushl %edx
call unreach
addl $20, %esp
.L21:
leal -8(%ebp), %esp
popl %ecx
popl %ebx
popl %ebp
leal -4(%ecx), %esp
ret
