https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109665
Bug ID: 109665
Summary: Incorrect code generation for s390/s390x try-catch
(__cxa_begin_catch), causing SIGSEGV
Product: gcc
Version: 12.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c++
Assignee: unassigned at gcc dot gnu.org
Reporter: paul.groke at dynatrace dot com
Target Milestone: ---
In certain situations, GCC generates incorrect s390x code for calling
`__cxa_begin_catch`. The bogus code contains a `lghi %r2,0` right before
calling `__cxa_begin_catch`. r2 is the register for the first and only argument
of `__cxa_begin_catch`, which is a pointer to some struct related to the
exception. And when called with a nullptr, `__cxa_begin_catch` will crash
(SIGSEGV). s390 (`-m31`) is also affected.
To reproduce, compile the following on Linux/s390x with at least `-O1`:
```
void f2(int, int, int, int, int);
void f1() {
try {
f2(42, 42, 42, 42, 0); // SIGSEGV
} catch (...) {
}
}
```
The resulting code with GCC 12.2.0 is this:
```
f1():
stmg %r6,%r15,48(%r15)
lghi %r5,42
aghi %r15,-160
lghi %r6,0
lghi %r4,42
lghi %r3,42
lghi %r2,42
brasl %r14,_Z2f2iiiii@PLT
lg %r4,272(%r15)
lmg %r6,%r15,208(%r15)
br %r4
lghi %r2,0
brasl %r14,__cxa_begin_catch@PLT
lmg %r6,%r15,208(%r15)
jg __cxa_end_catch@PLT
```
See https://godbolt.org/z/TTYr63oM3
The correct code has an `lgr %r2,%r6` instead of the `lghi %r2,0`.
The bug seems to be dependent on several factors:
- The last thing in the try-catch is a function call with at least 5 parameters
(Note that I only tested with parameter types that each fit into a general
purpose register though)
- The 5th argument must be a zero constant (0, false, ...)
- The try-catch contains a "catch (...)" handler
- At least `-O1` is used
- The function call is not inlined/no constant propagation happens
I found the bug with GCC 9.5.0 but it also happens with at least 11.2.0, 12.1.0
and 12.2.0 (tested with godbolt.org). I don't have newer GCC versions for s390x
handy, so I didn't test with those.
