[llvm-bugs] [Bug 37169] New: localrecover accessing incorrect stack offset

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=37169

            Bug ID: 37169
           Summary: localrecover accessing incorrect stack offset
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Backend: X86
          Assignee: unassignedbugs at nondot.org
          Reporter: smeenai at fb.com
                CC: compnerd at compnerd.org, david.majnemer at gmail.com,
                    llvm-bugs at lists.llvm.org, rnk at google.com

Created attachment 20199
  --> https://bugs.llvm.org/attachment.cgi?id=20199&action=edit
Reduced IR

The reduced IR attached has an @llvm.localrecover for an @llvm.localescape that
lives in the same stack frame. I'm fairly sure the IR itself is valid; the
@llvm.localrecover was originally from an outlined __finally which was then
inlined (which is why we end up with the localescape/localrecover in the first
place).

If I run llc on the reduced IR, the output is

_i:                                     # @i
Lfunc_begin0:
# %bb.0:
        pushl   %ebp
        movl    %esp, %ebp
        pushl   %ebx
        pushl   %edi
        pushl   %esi
        andl    $-8, %esp
        subl    $56, %esp
        movl    %esp, %esi
        movl    %ebp, 32(%esi)
Li$frame_escape_0 = 4
... (nothing in here changes ebp or esi)
        calll   _f
        movl    %eax, 4(%esi)
... (nothing in here changes ebp or esi)
        movl    Li$frame_escape_0(%ebp), %eax
        movl    $0, 48(%esi)
        pushl   %eax
        calll   _h
...

Note that %esp is moved to %ebp, then we perform more stack adjustments, then
%esp is moved to %esi, so %esi != %ebp. The localescape stores to 4(%esi), but
the localrecover loads from 4(%ebp), so it'll end up reading the wrong value
(most likely resulting in a crash).

I'm unable to reproduce this on x86-64; the localescape always goes through
%ebp on that architecture.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20180418/5a771ac4/attachment.html>