https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94119
--- Comment #4 from d.dorau at avm dot de ---
(In reply to Eric Botcazou from comment #3)
> AFAICS there is only one "addiu s0,s0,0" executed after the "lui s0,0x0" in
> this basic block. Doesn't the problem occur for the call in the following
> basic block instead?
You are right. I truncated the disassembly too early.
Please let me correct myself.
if((subtype == 8) && !BUFFER_IS_FF(data->addr1))
30: 14c20016 bne a2,v0,8c <foo+0x8c>
34: a7a00018 sh zero,24(sp)
38: 90a20000 lbu v0,0(a1)
3c: 240300ff li v1,255
40: 14430010 bne v0,v1,84 <foo+0x84>
44: 3c100000 lui s0,0x0
44: R_MIPS_HI16 memcmp_
48: 90a30001 lbu v1,1(a1)
4c: 14620015 bne v1,v0,a4 <foo+0xa4>
50: 26100000 addiu s0,s0,0
50: R_MIPS_LO16 memcmp_
54: 90a20002 lbu v0,2(a1)
58: 14430012 bne v0,v1,a4 <foo+0xa4>
5c: 26100000 addiu s0,s0,0
5c: R_MIPS_LO16 memcmp_
60: 90a30003 lbu v1,3(a1)
64: 1462000f bne v1,v0,a4 <foo+0xa4>
68: 26100000 addiu s0,s0,0
68: R_MIPS_LO16 memcmp_
6c: 90a20004 lbu v0,4(a1)
70: 14430004 bne v0,v1,84 <foo+0x84>
74: 00000000 nop
78: 90a30005 lbu v1,5(a1)
7c: 10620003 beq v1,v0,8c <foo+0x8c>
80: 00000000 nop
84: 10000007 b a4 <foo+0xa4>
88: 26100000 addiu s0,s0,0
88: R_MIPS_LO16 memcmp_
if(!memcmp_(data->addr2, nullbuf, BUF_LEN))
8c: 3c100000 lui s0,0x0
8c: R_MIPS_HI16 memcmp_
90: 24060006 li a2,6
94: 27a50014 addiu a1,sp,20
98: 26100000 addiu s0,s0,0
98: R_MIPS_LO16 memcmp_
9c: 0200f809 jalr s0
a0: 24840006 addiu a0,a0,6
bar(dev, data, subtype);
if(!memcmp_(&dev->b, &dev->a, 1))
a4: 24060001 li a2,1
a8: 02202825 move a1,s1
ac: 0200f809 jalr s0
b0: 26240001 addiu a0,s1,1
The two flows:
1) Buffer is all-FF:
The flow reaches 7c, where it branches to 8c. Regarding s0 we get the
following
instructions:
44: 3c100000 lui s0,0x0
50: 26100000 addiu s0,s0,0
5c: 26100000 addiu s0,s0,0
68: 26100000 addiu s0,s0,0
8c: 3c100000 lui s0,0x0
98: 26100000 addiu s0,s0,0
9c: 0200f809 jalr s0
where each addui adds "R_MIPS_LO16 memcmp_" to s0. The lui instruction
at 8c resets s0 so that the call at 9c is successful.
2) Last byte of buffer is non-FF
The flow reaches 7c, but it does not branch here. Instead we branch to
a4 at 84. We get
44: 3c100000 lui s0,0x0
50: 26100000 addiu s0,s0,0
5c: 26100000 addiu s0,s0,0
68: 26100000 addiu s0,s0,0
88: 26100000 addiu s0,s0,0
ac: 0200f809 jalr s0
In this case we get 4 times "R_MIPS_LO16 memcmp_" to s0 which leads to
a crash at ac.
