http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45813
--- Comment #9 from Mikael Pettersson <mikpe at it dot uu.se> 2010-09-29 19:41:08 UTC --- I can reproduce it with crosses to arm-elf and arm-linux-gnueabi. The combination of -mthumb (1 not 2) and -fno-omit-frame-pointer is the trigger. GCC 4.3.5 works, 4.4 and 4.5 generate broken code, 4.6 works. gcc-4.3.5 -march=armv5te -mthumb -fno-omit-frame-pointer -Os generates: ReadLE16U: push {r7, lr} ldrb r3, [r0] sub sp, sp, #8 add r7, sp, #0 add r2, r7, #6 strb r3, [r2] ldrb r3, [r0, #1] mov sp, r7 add sp, sp, #8 strb r3, [r2, #1] ldrh r0, [r2] @ sp needed for prologue pop {r7, pc} The second byte is correctly stored before the short is read and returned. gcc-4.4-20100928 and gcc-4.5-20100923 generate: ReadLE16U: push {r7, lr} ldrb r2, [r0] sub sp, sp, #8 add r7, sp, #0 add r3, r7, #6 mov sp, r7 strb r2, [r3] add sp, sp, #8 ldrb r2, [r0, #1] @ sp needed for prologue ldrh r0, [r3] pop {r7, pc} The second byte is read but not written before the short is read. gcc-4.6-20100925 generates: ReadLE16U: push {r0, r1, r7, lr} ldrb r3, [r0] add r7, sp, #0 mov sp, r7 strb r3, [r7, #6] ldrb r3, [r0, #1] @ sp needed for prologue strb r3, [r7, #7] ldrh r0, [r7, #6] pop {r1, r2, r7, pc} This is correct.