Very nasty C bug in gcc 2.95.2

[Ken Settle <ken at gordian dot com>]

NOTE:  ccppc is a cross-compiler for power-pc running on a FreeBSD host.
The same results were obtained on a linux host.  This appears to be a
cross-platform multiple-cpu-target bug.

ccppc -v -c -O2 gccbug.c
Reading specs from
/usr/local/gordian/ppc-tools-000609/lib/gcc-lib/powerpc-eabi/2.95.2/specs
gcc version 2.95.2 19991024 (release)
 /usr/local/gordian/ppc-tools-000609/lib/gcc-lib/powerpc-eabi/2.95.2/cpp
-lang-c -v -D__GNUC__=2 -D__GNUC_MINOR__=95 -DPPC -D__embedded__
-D__PPC__ -D__embedded__ -D__PPC -Asystem(embedded) -Acpu(powerpc)
-Amachine(powerpc) -D__CHAR_UNSIGNED__ -D__OPTIMIZE__ -D_CALL_SYSV
-D_BIG_ENDIAN -D__BIG_ENDIAN__ -Amachine(bigendian) -D_ARCH_PPC gccbug.c
/var/tmp/ccn89667.i
GNU CPP version 2.95.2 19991024 (release) (PowerPC Embedded)
#include "..." search starts here:
#include <...> search starts here:

/usr/local/gordian/ppc-tools-000609/lib/gcc-lib/powerpc-eabi/2.95.2/include

/usr/local/gordian/ppc-tools-000609/lib/gcc-lib/powerpc-eabi/2.95.2/../../../../powerpc-eabi/include
End of search list.
The following default directories have been omitted from the search
path:

/usr/local/gordian/ppc-tools-000609/lib/gcc-lib/powerpc-eabi/2.95.2/../../../../include/g++-3

/usr/local/gordian/ppc-tools-000609/lib/gcc-lib/powerpc-eabi/2.95.2/../../../../powerpc-eabi/sys-include
End of omitted list.
 /usr/local/gordian/ppc-tools-000609/lib/gcc-lib/powerpc-eabi/2.95.2/cc1
/var/tmp/ccn89667.i -quiet -dumpbase gccbug.c -O2 -version -o
/var/tmp/ccP89667.s
GNU C version 2.95.2 19991024 (release) (powerpc-eabi) compiled by GNU C
version 2.95.2 19991024 (release).
 /usr/local/gordian/ppc-tools-000609/powerpc-eabi/bin/as -mppc -V -Qy -o
gccbug.o /var/tmp/ccP89667.s
GNU assembler version 2.9.1 (powerpc-eabi), using BFD version 2.9.1

----------------------------------------------------------
The source code (gccbug.c):

int foo(char *a) { /* could also be 3 different functions */
    return 1;
}

int main(void)
{
    char d[20];
    char *c=d;  /* could also be a structure */
    char b;

    if(foo(c)) { /* could also be foo(d) */
        foo(&b);
    } 
    else
        b = '\0';

    /* can be hundreds of lines of code between these */

    foo(c+2); /* any pointer dereference from c */
    return 0;
}

----------------------------------------------------------
What happens:

odppc --disassemble-all gccbug.o

gccbug.o:     file format elf32-powerpc

Disassembly of section .text:

00000000 <_foo>:
   0:   38 60 00 01     li      r3,1
   4:   4e 80 00 20     blr

00000008 <_main>:
   8:   94 21 ff d0     stwu    r1,-48(r1)
   c:   7c 08 02 a6     mflr    r0
  10:   93 e1 00 2c     stw     r31,44(r1)
  14:   90 01 00 34     stw     r0,52(r1)
  18:   48 00 00 01     bl      18 <_main+0x10>
  1c:   3b e1 00 08     addi    r31,r1,8
  20:   7f e3 fb 78     mr      r3,r31
  24:   48 00 00 01     bl      24 <_main+0x1c>
  28:   7c 63 1b 79     mr.     r3,r3
  2c:   41 82 00 10     beq     3c <_main+0x34>
  30:   38 61 00 20     addi    r3,r1,32
  34:   48 00 00 01     bl      34 <_main+0x2c>
  38:   48 00 00 08     b       40 <_main+0x38>
  3c:   98 61 00 20     stb     r3,32(r1)
  40:   63 e3 00 02     ori     r3,r31,2
  44:   48 00 00 01     bl      44 <_main+0x3c>
  48:   38 60 00 00     li      r3,0
  4c:   80 01 00 34     lwz     r0,52(r1)
  50:   7c 08 03 a6     mtlr    r0
  54:   83 e1 00 2c     lwz     r31,44(r1)
  58:   38 21 00 30     addi    r1,r1,48
  5c:   4e 80 00 20     blr
Disassembly of section .data:

The instruction at 40: is an ori!  it should be an addi.

NOTE: this also happens with arm and mips cross-compilers, if the -O2
option is thrown, but _NOT_ if the -O1 or -O0 options are thrown.  It's
probably also likely to happen with most CPU architecture that passes
paramaters in registers.

We consider this to be a critical bug.  We will be looking into a fix,
and will let you know what we find.

Please do not publish my email address.  I get enough spam already.

If you have any questions, please contact me.

Sincerely,

Ken Settle
ken@gordian.com