BUG: egcs-1.1.2 generates wrong code

[Manfred Spraul <manfreds at colorfullife dot com>]

egcs -O2 -S test.c generated the attached file.

[egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)]
The problem is the 

	movl $0, (%ebp)
	movl $0, 4(%ebp)

which means that egcs just overwrote the return address. 
The generated code is weird, especially the empty loop to L4 and the
fact that most initializations are missing:

2 long values are set to zero
1 long value is set to 198.

but it should

set 4 long values (2 long long) to zero
2 value to 198.

Am I dreaming, or is that a compiler bug?

Note that the code is originally from the creative joystick driver from
linux-2.3.41.

--
	Manfred

typedef unsigned long long __u64;

#define JS_CR_MAX_STROBE	99

void fill(void)
{
	__u64 buf[2];
	int p[2];
	int i;

	for (i = 0; i < 2; i++); {
		buf[i] = 0;
		p[i] = JS_CR_MAX_STROBE;
		p[i] += JS_CR_MAX_STROBE;
	}
	printf(buf,p);
}


	.file	"test.c"
	.version	"01.01"
gcc2_compiled.:
.text
	.align 4
.globl fill
	.type	 fill,@function
fill:
	pushl %ebp
	movl %esp,%ebp
	subl $24,%esp
	movl $1,%eax
	.p2align 4,,7
.L4:
	decl %eax
	jns .L4
	leal -16(%ebp),%edx
	movl $0,(%ebp)
	movl $0,4(%ebp)
	leal -24(%ebp),%eax
	movl $198,-16(%ebp)
	pushl %eax
	pushl %edx
	call printf
	leave
	ret
.Lfe1:
	.size	 fill,.Lfe1-fill
	.ident	"GCC: (GNU) egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)"