[Bug target/16900] New: word fetched from released stack frame on ppc-abi_v4 ?

["hainque at gcc dot gnu dot org" <gcc-bugzilla at gcc dot gnu dot org>]

Hello,                                                                          
                                                                                
AFAICS, regarding the scheduling of stack accesses vs stack pointer updates on  
ppc for SVR4, the back-end only considers issues with register save/restore     
accesses when there is no dedicated frame pointer.                              
                                                                                
IIUC, the idea is to ensure that register saves/restores addressing the frame   
via sp are not scheduled across the stack pointer updates, which would indeed   
clearly be wrong.                                                               
                                                                                
As the testcase below shows, this appears not to be restrictive enough.         
                                                                                
The current scheme, using stack_tie and sr_alias_set, lets user stack accesses  
with non-conflicting alias-sets be scheduled at least across the epilogue sp    
update. This causes troubles on targets where interrupts may clobber up to the  
first unallocated stack words, which we've observed happening on VxWorks.       
                                                                                
To illustrate, consider a mainline powerpc-wrs-vxworks compiler configured      
with:                                                                           
                                                                                
  --prefix=[...] --target=powerpc-wrs-vxworks --enable-languages=c              
                                                                                
and the "foo" function in:                                                      
                                                                                
   typedef struct {                                                             
     int * ptr_to_int;                                                          
   } int_indirect;                                                              
                                                                                
   void init_int_indirect (int_indirect *pii)                                   
   {                                                                            
     * pii->ptr_to_int = 12;                                                    
   }                                                                            
                                                                                
   int foo (void)                                                               
   {                                                                            
     int local;                                                                 
     int_indirect ii = { &local };                                              
                                                                                
     init_int_indirect (&ii);                                                   
     return * ii.ptr_to_int;                                                    
   }                                                                            
                                                                                
cc1 -fverbose-asm -mregnames -O2 foo.c yields:                                  
                                                                                
foo:                                                                            
        mflr %r0         #,                                                     
        stwu %r1,-16(%r1)        #,,                                            
        addi %r3,%r1,12  #,,                                                    
        stw %r0,20(%r1)  #,                                                     
        addi %r0,%r1,8   # tmp123,,                                             
        stw %r0,12(%r1)  # ii.ptr_to_int, tmp123                                
        bl init_int_indirect     #                                              
        lwz %r9,12(%r1)  # ii.ptr_to_int, ii.ptr_to_int                         
        lwz %r0,20(%r1)  #,                                                     
==>     addi %r1,%r1,16  #,,                                                    
==>     lwz %r3,0(%r9)   #* ii.ptr_to_int, <result>                             
        mtlr %r0         #,                                                     
        blr      #                                                              
                                                                                
where we see a stack word fetched after the frame is released.                  
                                                                                
A possible approach is to have rs6000_emit_stack_tie assign alias-set 0 to the  
mem it creates, and call it even when frame_reg_rtx == sp_reg_rtx.              
                                                                                
I'd be happy to submit a patch doing so, or to adjust according to directions   
if there are better ways to address this.                                       
                                                                                
How does that sound ?                                                           
                                                                                
Thanks in advance for your help,

-- 
           Summary: word fetched from released stack frame on ppc-abi_v4 ?
           Product: gcc
           Version: 3.5.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P2
         Component: target
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: hainque at gcc dot gnu dot org
                CC: gcc-bugs at gcc dot gnu dot org
  GCC host triplet: sparc-sun-solaris2.8
GCC target triplet: powerpc-wrs-vxworks


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=16900