[Bug target/47619] ICE in printf() with -fsplit-stack enabled.

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47619

--- Comment #10 from H.J. Lu <hjl.tools at gmail dot com> 2011-02-08 21:07:09 UTC ---
[hjl@gnu-6 pr47619]$ cat x.c 
#include <stdio.h>
#include <string.h>

void foo( long i )
{
    register void* rsp asm( "rsp" );
    printf( "i = %ld, rsp = %p\n", i, rsp );
    char buf[ 256 ];
    memset( buf, 0, sizeof( buf ) );
    if ( i > 0 )
        foo( i - 1 );
}

int main()
{
    foo( 32*1024 );
    return 0;
}
[hjl@gnu-6 pr47619]$ make x
/usr/gcc-4.6/bin/gcc -O -g -fsplit-stack -B./   -c -o x.o x.c
/usr/gcc-4.6/bin/gcc -O -g -fsplit-stack -B./ -o x x.o
[hjl@gnu-6 pr47619]$ ulimit -a
core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 63592
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 63592
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited
[hjl@gnu-6 pr47619]$ free
             total       used       free     shared    buffers     cached
Mem:       8158716    7916268     242448          0    2117116    3197192
-/+ buffers/cache:    2601960    5556756
Swap:     16777212          0   16777212
i = 1952, rsp = 0x7fffff7ff830

Program received signal SIGSEGV, Segmentation fault.
0x0000003f7d244d8a in vfprintf () from /lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install glibc-2.13-1.0.f14.x86_64
libgcc-4.5.1-4.fc14.x86_64
(gdb) bt
#0  0x0000003f7d244d8a in vfprintf () from /lib64/libc.so.6
#1  0x0000003f7d24faea in printf () from /lib64/libc.so.6
#2  0x0000000000400be9 in foo (i=<value optimized out>) at x.c:7
#3  0x0000000000400c07 in foo (i=<value optimized out>) at x.c:11
#4  0x0000000000400c07 in foo (i=<value optimized out>) at x.c:11
#5  0x0000000000400c07 in foo (i=<value optimized out>) at x.c:11
#6  0x0000000000400c07 in foo (i=<value optimized out>) at x.c:11
...
(gdb) disass
Dump of assembler code for function vfprintf:
   0x0000003f7d244cf0 <+0>:    push   %rbp
   0x0000003f7d244cf1 <+1>:    mov    %rsp,%rbp
   0x0000003f7d244cf4 <+4>:    mov    %rbx,-0x28(%rbp)
   0x0000003f7d244cf8 <+8>:    mov    %r13,-0x18(%rbp)
   0x0000003f7d244cfc <+12>:    mov    %rdi,%rbx
   0x0000003f7d244cff <+15>:    mov    %r14,-0x10(%rbp)
   0x0000003f7d244d03 <+19>:    mov    %r15,-0x8(%rbp)
   0x0000003f7d244d07 <+23>:    mov    %rsi,%r14
   0x0000003f7d244d0a <+26>:    mov    %r12,-0x20(%rbp)
   0x0000003f7d244d0e <+30>:    sub    $0x650,%rsp
   0x0000003f7d244d15 <+37>:    mov    0x350284(%rip),%r15        #
0x3f7d594fa0
   0x0000003f7d244d1c <+44>:    mov    %rdx,%r13
   0x0000003f7d244d1f <+47>:    mov    %fs:(%r15),%eax
   0x0000003f7d244d23 <+51>:    mov    %eax,-0x504(%rbp)
   0x0000003f7d244d29 <+57>:    mov    0xc0(%rdi),%eax
   0x0000003f7d244d2f <+63>:    test   %eax,%eax
   0x0000003f7d244d31 <+65>:    jne    0x3f7d244ec0 <vfprintf+464>
   0x0000003f7d244d37 <+71>:    movl   $0xffffffff,0xc0(%rdi)
   0x0000003f7d244d41 <+81>:    mov    (%rbx),%r12d
   0x0000003f7d244d44 <+84>:    test   $0x8,%r12b
   0x0000003f7d244d48 <+88>:    jne    0x3f7d244f18 <vfprintf+552>
---Type <return> to continue, or q <return> to quit---
   0x0000003f7d244d4e <+94>:    test   %r14,%r14
   0x0000003f7d244d51 <+97>:    je     0x3f7d244ef0 <vfprintf+512>
   0x0000003f7d244d57 <+103>:    test   $0x2,%r12b
   0x0000003f7d244d5b <+107>:    jne    0x3f7d244f00 <vfprintf+528>
   0x0000003f7d244d61 <+113>:    mov    0x0(%r13),%rax
   0x0000003f7d244d65 <+117>:    mov    $0x25,%esi
   0x0000003f7d244d6a <+122>:    mov    %r14,%rdi
   0x0000003f7d244d6d <+125>:    mov    %rax,-0xf0(%rbp)
   0x0000003f7d244d74 <+132>:    mov    0x8(%r13),%rax
   0x0000003f7d244d78 <+136>:    mov    %rax,-0xe8(%rbp)
   0x0000003f7d244d7f <+143>:    mov    0x10(%r13),%rax
   0x0000003f7d244d83 <+147>:    mov    %rax,-0xe0(%rbp)
=> 0x0000003f7d244d8a <+154>:    callq  0x3f7d289750 <strchrnul>
   0x0000003f7d244d8f <+159>:    and    $0x8000,%r12d
   0x0000003f7d244d96 <+166>:    mov    %rax,-0x510(%rbp)
   0x0000003f7d244d9d <+173>:    movl   $0x0,-0x508(%rbp)
   0x0000003f7d244da7 <+183>:    jne    0x3f7d244e1c <vfprintf+300>