[Bug regression/16088] New: Generates invalid code

["lucier at math dot purdue dot edu" <gcc-bugzilla at gcc dot gnu dot org>]

This one's a mystery.  Here are the versions of gcc and of gdb.  First, can I
trust what this gdb reports for this code?

[xsun21:~/programs/gambc40b4-devel] lucier% /pkgs/gcc-mainline/bin/gcc -v
Reading specs from /pkgs/gcc-mainline/lib/gcc/powerpc-apple-darwin7.4.0/3.5.0/specs
Configured with: ../configure --prefix=/pkgs/gcc-mainline
Thread model: posix
gcc version 3.5.0 20040617 (experimental)
[xsun21:~/programs/gambc40b4-devel] lucier% gdb -v
GNU gdb 5.3-20030128 (Apple version gdb-309) (Thu Dec  4 15:41:30 GMT 2003)
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "powerpc-apple-darwin".

The input files are

http://www.math.purdue.edu/~lucier/GNATS/GNATS-10

The command line is

gcc -I../include -I. -no-cpp-precomp -Wall -W -Wno-unused -O1 -fno-math-errno
-fschedule-insns2 -fno-trapping-math -fno-strict-aliasing -fomit-frame-pointer
-fPIC -fno-common -g -save-temps -DHAVE_CONFIG_H -D___PRIMAL -D___LIBRARY
-D___GAMBCDIR=\"/usr/local/\" -c _nonstd.c

Here are the steps up to the invalid memory access, displaying ___fp at each step:

15546      ___SET_R4(___STRINGLENGTH(___R2))
1: ___fp = (<invalid type code 7> *) 0x60106d
(gdb) s
15547      ___IF(___NOT(___FIXLT(___FIX(0L),___R4)))
1: ___fp = (<invalid type code 7> *) 0x60106d
(gdb) s
15550      ___SET_STK(1,___FIXSUB(___R4,___FIX(1L)))
1: ___fp = (<invalid type code 7> *) 0x60106d
(gdb) s
15552      ___SET_STK(1,___BOOLEAN(___CHAREQP(___STK(-1),___STK(1))))
1: ___fp = (<invalid type code 7> *) 0x60106d
(gdb) s
15551      ___SET_STK(1,___STRINGREF(___R2,___STK(1)))
1: ___fp = (<invalid type code 7> *) 0x60106d
(gdb) s
15550      ___SET_STK(1,___FIXSUB(___R4,___FIX(1L)))
1: ___fp = (<invalid type code 7> *) 0x60106d
(gdb) s
15551      ___SET_STK(1,___STRINGREF(___R2,___STK(1)))
1: ___fp = (<invalid type code 7> *) 0x60106d
(gdb) s
15552      ___SET_STK(1,___BOOLEAN(___CHAREQP(___STK(-1),___STK(1))))
1: ___fp = (<invalid type code 7> *) 0x2f
(gdb) s
15551      ___SET_STK(1,___STRINGREF(___R2,___STK(1)))
1: ___fp = (<invalid type code 7> *) 0x2f
(gdb) s
15552      ___SET_STK(1,___BOOLEAN(___CHAREQP(___STK(-1),___STK(1))))
1: ___fp = (<invalid type code 7> *) 0xbe
(gdb) s
15557      ___IF(___FALSEP(___R1))
1: ___fp = (<invalid type code 7> *) 0xfffffffa
(gdb) s
15552      ___SET_STK(1,___BOOLEAN(___CHAREQP(___STK(-1),___STK(1))))
1: ___fp = (<invalid type code 7> *) 0xfffffffa
(gdb) 
15553      ___SET_STK(2,___R1)
1: ___fp = (<invalid type code 7> *) 0xfffffffa
(gdb) s
15555      ___SET_STK(1,___STK(2))
1: ___fp = (<invalid type code 7> *) 0xfffffffa
(gdb) 
15557      ___IF(___FALSEP(___R1))
1: ___fp = (<invalid type code 7> *) 0xfffffffa
(gdb) 
15572      ___SET_R4(___FIXSUB(___R4,___R3))
1: ___fp = (<invalid type code 7> *) 0xfffffffa
(gdb) 

Program received signal EXC_BAD_ACCESS, Could not access memory.
0x0009cc2c in ___H__20___nonstd (___ps=0x1e31f8) at _nonstd.c:15572
15572      ___SET_R4(___FIXSUB(___R4,___R3))
1: ___fp = (<invalid type code 7> *) 0x28

The assembly is

	.stabd	68,0,15546
	lwz r0,-1(r25)
	.stabd	68,0,15547
	rlwinm. r10,r0,25,7,29
	ble- cr0,L4572
	.stabd	68,0,15550
	addi r11,r10,-4
	.stabd	68,0,15552
	lwz r0,4(r30)
	.stabd	68,0,15551
	srawi r9,r11,1
	.stabd	68,0,15550
	stw r11,-4(r30)
	.stabd	68,0,15551
	add r9,r9,r25
	lhz r2,3(r9)
	.stabd	68,0,15552
	mr r9,r30
	.stabd	68,0,15551
	slwi r2,r2,2
	addi r2,r2,2
	stw r2,-4(r30)
	.stabd	68,0,15552
	xor r2,r2,r0
	addic r2,r2,-1
	subfe r2,r2,r2
	rlwinm r2,r2,0,0,29
	addi r2,r2,-2
	.stabd	68,0,15557
	cmpwi cr7,r2,-2
	.stabd	68,0,15552
	stwu r2,-4(r9)
	.stabd	68,0,15553
	stw r11,-8(r30)
	.stabd	68,0,15555
	stw r11,0(r9)
	.stabd	68,0,15557
	bne+ cr7,L4578
	b L4577
L4572:
	.stabd	68,0,15562
	stwu r28,-4(r30)
	.stabd	68,0,15564
	mr r11,r10
	mr r9,r30
	b L4578
L4577:
	.stabd	68,0,15568
	mr r11,r10
L4578:
	.stabd	68,0,15572
	lwz r2,0(r9)

The invalid access is occuring at the source line

   ___r4=((((int)(((((unsigned int)((*((int*)((___fp[-(0)])-(1))))))>>(3
+5))>>1)))<<2));

which is why I traced the value of ___fp.

It seems that ___fp has a rational value until line 15552, then all hell breaks
loose (if I can believe gdb).

And I haven't been able to find a smaller example, sorry.

This works with all previous versions of gcc.

Brad

-- 
           Summary: Generates invalid code
           Product: gcc
           Version: 3.5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: regression
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: lucier at math dot purdue dot edu
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: powerpc-apple-darwin7.4.0
  GCC host triplet: powerpc-apple-darwin7.4.0
GCC target triplet: powerpc-apple-darwin7.4.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=16088