[Bug target/49437] New: interrupt return pop sometimes corrupts sp

["domen at cba dot si" <gcc-bugzilla at gcc dot gnu dot org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49437

           Summary: interrupt return pop sometimes corrupts sp
           Product: gcc
           Version: 4.5.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: domen@cba.si


Simple to reproduce, it seems >=5 arguments with any of printf* can cause this.
Some code around it was left, as it does not happen otherwise.

$ cat bug.c 
#include <stdio.h>

char *pending_messages_put_start(void);
void pending_messages_put_final(void);

void __attribute__((interrupt)) TIM7_IRQHandler(void)
{
        char *msg = pending_messages_put_start();
        snprintf(msg, 20, "%i %i", 1, 1);
        pending_messages_put_final();
}
$ arm-none-eabi-gcc -Wall -Os -S bug.c
$ cat bug.s 
        .syntax unified
        .arch armv7-m
        .fpu softvfp
        .eabi_attribute 20, 1
        .eabi_attribute 21, 1
        .eabi_attribute 23, 3
        .eabi_attribute 24, 1
        .eabi_attribute 25, 1
        .eabi_attribute 26, 1
        .eabi_attribute 30, 4
        .eabi_attribute 18, 4
        .thumb
        .file   "bug.c"
        .text
        .align  1
        .global TIM7_IRQHandler
        .thumb
        .thumb_func
        .type   TIM7_IRQHandler, %function
TIM7_IRQHandler:
        @ Stack Align: May be called with mis-aligned SP.
        @ args = 0, pretend = 0, frame = 0
        @ frame_needed = 0, uses_anonymous_args = 0
        mov     r0, sp
        bic     r1, r0, #7
        mov     sp, r1
        push    {r0, lr}
        sub     sp, sp, #8
        bl      pending_messages_put_start
        movs    r3, #1
        movs    r1, #20
        ldr     r2, .L2
        str     r3, [sp, #0]
        bl      snprintf
        bl      pending_messages_put_final
        pop     {r0, r2, r3, lr}    // <-- r3 is in place of r0; expected would
be add sp, sp, #8, pop {r0, lr}, I guess
        mov     sp, r0
        bx      lr
.L3:
        .align  2
.L2:
        .word   .LC0
        .size   TIM7_IRQHandler, .-TIM7_IRQHandler
        .section        .rodata.str1.1,"aMS",%progbits,1
.LC0:
        .ascii  "%i %i\000"
        .ident  "GCC: (GNU) 4.5.3"