[Bug c++/77448] New: Incorrect code generation for calling stack object's method

[nfitzgerald at mozilla dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77448

            Bug ID: 77448
           Summary: Incorrect code generation for calling stack object's
                    method
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nfitzgerald at mozilla dot com
                CC: jimb@red-bean.com
  Target Milestone: ---

Created attachment 39536
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=39536&action=edit
zipped testcase.ii

Here is the source of `JS::CallArgs::create` (full, pre-processed test case in
attachment):

> class MOZ_STACK_CLASS CallArgs : public detail::CallArgsBase<detail::IncludeUsedRval>
> {
>   private:
>     friend CallArgs CallArgsFromVp(unsigned argc, Value* vp);
>     friend CallArgs CallArgsFromSp(unsigned stackSlots, Value* sp, bool constructing);
> 
>     static CallArgs create(unsigned argc, Value* argv, bool constructing) {
>         CallArgs args;
>         args.clearUsedRval();
>         args.argv_ = argv;
>         args.argc_ = argc;
>         args.constructing_ = constructing;
>         return args;
>     }
> 
>   public:
>     /*
>      * Returns true if there are at least |required| arguments passed in. If
>      * false, it reports an error message on the context.
>      */
>     bool requireAtLeast(JSContext* cx, const char* fnname, unsigned required) const;
> 
> };

Here is the disassembly:

> Dump of assembler code for function JS::CallArgs::create(unsigned int, JS::Value*, bool):
>    0x000055df6e6f5c0a <+0>:	push   rbp
>    0x000055df6e6f5c0b <+1>:	mov    rbp,rsp
>    0x000055df6e6f5c0e <+4>:	sub    rsp,0x20
>    0x000055df6e6f5c12 <+8>:	mov    QWORD PTR [rbp-0x8],rdi
>    0x000055df6e6f5c16 <+12>:	mov    DWORD PTR [rbp-0xc],esi
>    0x000055df6e6f5c19 <+15>:	mov    QWORD PTR [rbp-0x18],rdx
>    0x000055df6e6f5c1d <+19>:	mov    eax,ecx
>    0x000055df6e6f5c1f <+21>:	mov    BYTE PTR [rbp-0x10],al
>    0x000055df6e6f5c22 <+24>:	mov    rax,QWORD PTR [rbp-0x8]
>    0x000055df6e6f5c26 <+28>:	mov    rdi,rax
>    0x000055df6e6f5c29 <+31>:	call   0x55df6e6f5bf8 <JS::detail::IncludeUsedRval::clearUsedRval() const>
>    0x000055df6e6f5c2e <+36>:	mov    rax,QWORD PTR [rbp-0x8]
>    0x000055df6e6f5c32 <+40>:	mov    rdx,QWORD PTR [rbp-0x18]
>    0x000055df6e6f5c36 <+44>:	mov    QWORD PTR [rax+0x8],rdx
>    0x000055df6e6f5c3a <+48>:	mov    rax,QWORD PTR [rbp-0x8]
>    0x000055df6e6f5c3e <+52>:	mov    edx,DWORD PTR [rbp-0xc]
>    0x000055df6e6f5c41 <+55>:	mov    DWORD PTR [rax+0x10],edx
>    0x000055df6e6f5c44 <+58>:	mov    rax,QWORD PTR [rbp-0x8]
>    0x000055df6e6f5c48 <+62>:	movzx  edx,BYTE PTR [rbp-0x10]
>    0x000055df6e6f5c4c <+66>:	mov    BYTE PTR [rax+0x14],dl
>    0x000055df6e6f5c4f <+69>:	nop
>    0x000055df6e6f5c50 <+70>:	mov    rax,QWORD PTR [rbp-0x8]
>    0x000055df6e6f5c54 <+74>:	leave  
>    0x000055df6e6f5c55 <+75>:	ret    
> End of assembler dump.

Notice how %rdi, the first parameter, is saved onto the stack, then the value
is read back from the stack into %rdi and passed as the `this` parameter to the
`clearUsedRval` method. This is incorrect.

-----------------------------------------

Invoked with these flags:

> $ /usr/lib64/ccache/g++ -std=gnu++11 -S  -I/home/fitzgen/src/rust-mozjs/target/debug/build/mozjs_sys-e6acb629d67eff9a/out/dist/system_wrappers -include /home/fitzgen/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/smup/mozjs/config/gcc_hidden.h -DDEBUG=1 -DTRACING=1 -DENABLE_BINARYDATA -DENABLE_SIMD -DENABLE_SHARED_ARRAY_BUFFER -DEXPORT_JS_API -I/home/fitzgen/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/smup/mozjs/js/src -I/home/fitzgen/src/rust-mozjs/target/debug/build/mozjs_sys-e6acb629d67eff9a/out/js/src  -I/home/fitzgen/src/rust-mozjs/target/debug/build/mozjs_sys-e6acb629d67eff9a/out/dist/include          -fPIC  -DMOZILLA_CLIENT -include /home/fitzgen/src/rust-mozjs/target/debug/build/mozjs_sys-e6acb629d67eff9a/out/js/src/js-confdefs.h -MD -MP -MF .deps/Unified_cpp_js_src4.o.pp  -Wall -Wc++11-compat -Wempty-body -Wignored-qualifiers -Woverloaded-virtual -Wpointer-arith -Wsign-compare -Wtype-limits -Wunreachable-code -Wwrite-strings -Wno-invalid-offsetof -Wc++14-compat -Wno-error=maybe-uninitialized -Wno-error=deprecated-declarations -Wno-error=array-bounds -fno-rtti -fno-exceptions -fno-math-errno -pthread -pipe  -g -fno-omit-frame-pointer   -Wno-shadow  ~/scratch/testcase.ii

-----------------------------------------

> $ gcc -v
> Using built-in specs.
> COLLECT_GCC=/usr/bin/gcc
> COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-redhat-linux/6.1.1/lto-wrapper
> Target: x86_64-redhat-linux
> Configured with: ../configure --enable-bootstrap --enable-languages=c,c++,objc,obj-c++,fortran,ada,go,lto --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-shared --enable-threads=posix --enable-checking=release --enable-multilib --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-gnu-unique-object --enable-linker-build-id --with-linker-hash-style=gnu --enable-plugin --enable-initfini-array --disable-libgcj --with-isl --enable-libmpx --enable-gnu-indirect-function --with-tune=generic --with-arch_32=i686 --build=x86_64-redhat-linux
> Thread model: posix
> gcc version 6.1.1 20160621 (Red Hat 6.1.1-3) (GCC)