optimization/6398: faulty code when inlining in a var-arged function

[lucho@haemimont.bg]

>Number:         6398
>Category:       optimization
>Synopsis:       faulty code when inlining in a var-arged function
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          wrong-code
>Submitter-Id:   net
>Arrival-Date:   Sun Apr 21 13:16:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Luchezar Belev
>Release:        gcc-3.0
>Organization:
>Environment:
pentium III; linux-2.4.6; glibc-2.2 (does it matter?)
>Description:
This is some combination of:
 1) function inlining (-O3)
 2) no frame pointer (-fomit-frame-pointer)
 2) var-args
and it seems like this is somehow confusing GCC 3.0
so it generates incorrect code
(haven't tested other GCC versions)
>How-To-Repeat:
compile this source with -O3 and -fomit-frame-pointer
and see the comment

----begin----
#include <stdarg.h>
#include <stdio.h>

/*
	compile with these options: -O3 -fomit-frame-pointer
	to let the bug to appear
	
	The expected output of this code is "AAAAxyz\n" printed out on the console
	and it does so when compiled with -O2 (or lower) or without -fomit-frami-pointer

	One fact i've discovered that may be a hint:
	in the assembly output, near the beginning of f2() function
	one can notice that %ebp is used for addressing ("movl 4(%ebp), %ecx")
	before it is loaded with some meaningful value for this purpose
*/

static void f1(unsigned p, char *fmt, va_list args)
{
	char *h[2] = {"AAAA", "BBBB"};
	char buf[128];
	int l;
	
	if (p > 1) return;
	l = strlen(h[p]);
	memcpy(buf, h[p], l);
	vsnprintf(buf + l, 128 - l, fmt, args);
	puts(buf);
}

void f2(int p, char *fmt, ...)
{
	va_list args;
	va_start(args, fmt);
	f1(p, fmt, args);
	va_end(args);
}

int main()
{
	f2(0, "xyz\n");
	return 0;
}
----end----
>Fix:
don't know how to fix, but found a clue that may help: see the comment in the source
>Release-Note:
>Audit-Trail:
>Unformatted: