Objective-C forward/performv or __builtin_apply() bug

[dave@thor.sbay.org]

(Example code follows)

I think the bug is either in libobjc, __builtin_apply(), or
__builtin_apply_args().

My personal, uneducated guess is __builtin_apply(). Here's why:

(gdb) disassemble _i_Foo__print
Dump of assembler code for function _i_Foo__print:
0x8048de8 <_i_Foo__print>:	pushl  %ebp
0x8048de9 <_i_Foo__print+1>:	movl   %esp,%ebp
0x8048deb <_i_Foo__print+3>:	subl   $0x18,%esp
0x8048dee <_i_Foo__print+6>:	leal   0x8(%ebp),%eax
0x8048df1 <_i_Foo__print+9>:	pushl  %eax
0x8048df2 <_i_Foo__print+10>:	movl   0x8(%ebp),%eax
0x8048df5 <_i_Foo__print+13>:	pushl  %eax
0x8048df6 <_i_Foo__print+14>:	pushl  $0x8052ac8
0x8048dfb <_i_Foo__print+19>:	pushl  $0x8052ace
0x8048e00 <_i_Foo__print+24>:	call   0x8048bb0 <printf>

The two arguments of _i_Foo__print, self and _cmd, look fine until the
following instruction is executed: "movl %esp,%ebp". But I'm guessing that
what I observed is not correct behavior when compared to when "[f print]"
is executed.

Any ideas?

Thanks in advance,

Dave Zarzycki

/*
 * gcc -Wall -o test test.m -lobjc [-lpthread]
 */

#include <stdio.h>
#include <objc/Object.h>

@interface Foo : Object
{	int x;
}
- init;
- print;
@end

@implementation Foo : Object
- init
{	self = [super init];
	x = 0xdeadbeef;
	return self;
}
- print
{	printf("%5s%12p @%12p\n", "self:", self, &self);
	printf("%5s%12p @%12p\n", "_cmd:", _cmd, &_cmd);
	printf("%5s%12p @%12p\n", "x:", (void*)x, &x);
	if (x != 0xdeadbeef)
		printf("Oops: x != 0xdeadbeef\n");
	return self;
}
@end

@interface Proxy : Object
{	id obj;
}
- initWithObject:(id)thing;
- (retval_t)forward:(SEL)aSel :(arglist_t)argFrame;
@end

@implementation Proxy : Object
- initWithObject:(id)thing
{	self = [super init];
	obj = thing;
	return self;
}
- (retval_t)forward:(SEL)aSel :(arglist_t)argFrame
{	if ([obj respondsTo:aSel])
		return [obj performv:aSel:argFrame];
	return NULL;
}
@end

int main(void)
{	id f = [[Foo alloc] init];
	id p = [[Proxy alloc] initWithObject:f];
	[f print];
	[p print];
	return 0;
}