[Bug middle-end/31309] [4.1/4.2/4.3 Regression] 6 byte assignment at end of structure reads/writes past end of structure causing SEGV when that memory is not accessable.

["rguenth at gcc dot gnu dot org" <gcc-bugzilla at gcc dot gnu dot org>]

------- Comment #7 from rguenth at gcc dot gnu dot org  2007-07-06 14:58 -------
We use store_field() to a bitpos of 80 with a bitsize of 48 to a mem:BLK target
which in turn calls store_expr on an adjusted mem which calls

      temp = expand_expr_real (exp, tmp_target, GET_MODE (target),
                               (call_param_p
                                ? EXPAND_STACK_PARM : EXPAND_NORMAL),
                               &alt_rtl);

that in turn creates this crapload of rtl via

      else if (TYPE_MODE (TREE_TYPE (exp)) == BLKmode)
        {
          target = copy_blkmode_from_reg (target, valreg, TREE_TYPE (exp));

and

  /* Copy the structure BITSIZE bites at a time.

     We could probably emit more efficient code for machines which do not use
     strict alignment, but it doesn't seem worth the effort at the current
     time.  */

not worth the effort!?  uh :/

And the problem seems to be that we do store_bit_field of 1 byte at a time
but are using word_mode for it.  At

(mem/s/j:DI (plus:DI (reg/f:DI 60)
        (const_int 10 [0xa])) [0 <variable>.dRID+0 S8 A16])

storing with word_mode will write beyond the structure bounds though.
(store_bit_field will in turn use extraction and write-back to store each
of the bytes, so we will be better off using it directly for quantities
less than word_mode).

To summarize: copy_blkmode_from_reg () doesn't deal with a target size
that is less than the size of word_mode (or even a size that is not
a multiple of the size of word_mode).

The fix is either to make copy_blkmode_from_reg () handle this case or not
use that, but store_bit_field in the caller.

Of course maybe the bug is also that the type of the call expression has
BLKmode but the return value is passed in (reg:DI ax).

And of course I'm lost here ;)


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu dot
                   |                            |org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31309