The attached code (reduced version of modutils-2.4.27/obj/obj_reloc.c: obj_allocate_commons()) is miscompiled by gcc4.1-4.1.1-alt11 (both on x86_64 and i586): - the common_head = NULL initialization is lost, therefore the code uses uninitialized stack variables (this manifests in depmod crashes at runtime); - in the example the last block with calls to do_something() is optimized out completely. Compiled with: gcc -S -O2 -Wall -W -fverbose-asm -save-temps obj_reloc.c
Created attachment 1775 [details] obj_reloc.c - example code
Created attachment 1776 [details] obj_reloc.i - preprocessor output
Created attachment 1777 [details] obj_reloc.s - compiler output on x86_64 Notice these problems: 1) The first usage of common head: movq -16(%rbp), %rdx # common_head, temp.33 testq %rdx, %rdx # temp.33 je .L14 #, comes before its initialization (in fact, common_head initialization is not present in the generated code at all). 2) There are no calls to do_something() - the second loop was optimized out completely.
gcc4.1-4.1.1-alt4 on i586 also had the same bug - the result of compiling modutils-2.4.27-alt8 is: 000003c5 <obj32_allocate_commons>: 3c5: 55 push %ebp 3c6: 89 e5 mov %esp,%ebp 3c8: 57 push %edi 3c9: 56 push %esi 3ca: 53 push %ebx 3cb: 83 ec 2c sub $0x2c,%esp 3ce: 31 ff xor %edi,%edi 3d0: 8b 45 08 mov 0x8(%ebp),%eax 3d3: 8b 4c b8 5c mov 0x5c(%eax,%edi,4),%ecx 3d7: 85 c9 test %ecx,%ecx 3d9: 75 08 jne 3e3 <obj32_allocate_commons+0x1e> 3db: eb 53 jmp 430 <obj32_allocate_commons+0x6b> 3dd: 8b 09 mov (%ecx),%ecx 3df: 85 c9 test %ecx,%ecx 3e1: 74 4d je 430 <obj32_allocate_commons+0x6b> 3e3: 81 79 10 f2 ff 00 00 cmpl $0xfff2,0x10(%ecx) 3ea: 75 f1 jne 3dd <obj32_allocate_commons+0x18> 3ec: 8b 55 f0 mov 0xfffffff0(%ebp),%edx 3ef: 85 d2 test %edx,%edx 3f1: 0f 84 26 01 00 00 je 51d <obj32_allocate_commons+0x158> ... 0xfffffff0(%ebp) is used, but never initialized. ==30744== Conditional jump or move depends on uninitialised value(s) ==30744== at 0x8057511: obj32_allocate_commons (obj_reloc.c:146) ==30744== by 0x804A7B2: loadobj (depmod.c:977) ==30744== by 0x804C680: depmod_main_32 (depmod.c:1727) ==30744== by 0x804FC02: main (depmod.c:1750)
Created attachment 1779 [details] obj_reloc.c Even more reduced sample which still gets miscompiled: $ gcc -S -O2 -Wall -W -fno-stack-protector -fverbose-asm obj_reloc.c $ fgrep head obj_reloc.s movl -8(%ebp), %eax # head, temp.31 $ gcc -S -O1 -Wall -W -fno-stack-protector -fverbose-asm obj_reloc.c $ fgrep head obj_reloc.s movl $0, -8(%ebp) #, head movl -8(%ebp), %eax # head, temp.29
wontfix for gcc4.1 fixed upstream, available in gcc4.3-4.3.2-alt1
