When SSE/MMX vector types are passed to functions taking a variable
number of arguments, they're passed in registers instead of on
the stack where the called function expects them.

Test case:

#include <stdio.h>
#include <stdarg.h>

typedef double __attribute__((vector_size(16))) V4DF;

V4DF foo(int n, ...) {
	va_list ap;
	int i;
	static V4DF ret ;
	va_start(ap, n);
	for(i = 0; i < n; i++) {
		ret = va_arg(ap, V4DF);
	}
	va_end(ap);
	return ret;
}

int
main() {
	union {
		V4DF v;
		double d[2];
	} u;
	u.d[0] = 2.0;
	u.d[1] = 2.0;
	u.v = foo(1, u.v, 10.0, 10.0, 10.0, 10.0);
	printf("(%f,%f)\n", u.d[0], u.d[1]);
	return 0;	  
}

Compile with "gcc -msse2 t.c" and run.  Output is:

(10.000000,10.000000)

Expected output is:

(2.000000,2.000000)

The output of "gcc -v":

Reading specs from E:/UTIL/GCCHEAD/MINGW/BIN/../lib/gcc/mingw32/3.5.0/specs
Configured with: ../gcc/configure --prefix=e:/util/gcchead/mingw --target=mingw3
2 --host=mingw32 --enable-languages=c,c++
Thread model: single
gcc version 3.5.0 20040406 (experimental)

The problem seems to be in file "i386.c", function "init_cumulative_args":

    if (cum->nregs || !TARGET_MMX || !TARGET_SSE)

should be:

    if (cum->nregs || TARGET_MMX || TARGET_SSE)