[Bug c++/51759] New: miscompile writes past end of bitfield

[nobled at dreamwidth dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51759

             Bug #: 51759
           Summary: miscompile writes past end of bitfield
    Classification: Unclassified
           Product: gcc
           Version: 4.5.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: nobled@dreamwidth.org


Compiling the attached preprocessed file with this:
g++-4.5 -Os -fPIC -g -pedantic -Wno-long-long -fno-exceptions -o Type2.cpp.o -c
Type2.ii

Results in writing 32 bits to a 24-bit bitfield, overwriting the first byte of
the next member variable.

These two members of class Type are (on x86_64) at offset 0x8:
  TypeID   ID : 8;
  unsigned SubclassData : 24;

When setSubclassData() isn't inlined, it's called (from StructType::setBody()
and PointerType's constructor) with the address of 'SubclassData' in %rdi...:

   0x00007ffff76d684f <+71>:    lea 0x9(%rdi),%r12
   0x00007ffff76d6853 <+75>:    or $0x1,%esi
   0x00007ffff76d6856 <+78>:    mov %r12,%rdi
   0x00007ffff76d6859 <+81>:    callq 0x7ffff76d6774
<llvm::Type::setSubclassData(unsigned int)>

...but then, setSubclassData writes more than 24 bits to that address:

   0x00007ffff76d6774 <+0>:    mov %esi,%eax
   0x00007ffff76d6776 <+2>:    sub $0x8,%rsp
   0x00007ffff76d677a <+6>:    and $0xffffff,%eax
   0x00007ffff76d677f <+11>:    cmp %esi,%eax
   0x00007ffff76d6781 <+13>:    mov %eax,(%rdi) # corruption