From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 0634D3858C66; Wed,  7 Feb 2024 06:09:06 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 0634D3858C66
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1707286147;
	bh=0XS95GRI/xObw6rJD1adJLjlkD9B6SzzaME1RDT3cgg=;
	h=From:To:Subject:Date:From;
	b=b58VtzZ4/nXS88IXp0X/HfjLBJVfWOeEnGuGGt3+7RfzvLqr6GU/YFr3hXF3ImYpn
	 g14fOWs6Y9ItBk6rEC4sU9vuDPyeKjiYDGdW/LwPJA4VZEvnLAXSaShS4Fg41NWi6b
	 YBqr3w6QpuDnfBb9YMa6WVqfj9qc1Qeua1MEHNPk=
From: "keithp at keithp dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/113795] New: armv8.1m-m.main+pacbti
 -mbranch-protection=standard -O2 compile error
Date: Wed, 07 Feb 2024 06:09:06 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 13.2.1
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: keithp at keithp dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
 attachments.created
Message-ID: <bug-113795-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D113795

            Bug ID: 113795
           Summary: armv8.1m-m.main+pacbti -mbranch-protection=3Dstandard
                    -O2 compile error
           Product: gcc
           Version: 13.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: keithp at keithp dot com
  Target Milestone: ---

Created attachment 57348
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=3D57348&action=3Dedit
Reasonably short test case.

A tail-call indirect branch is miscompiled in the attached example.

Without -mbranch-protection=3Dstandard:
```
.L2:
        ldr     r4, .L25+4
        movs    r0, #0
        ldr     r4, [r4, #24]
        mov     ip, r4
        str     r4, [sp, #4]
        add     sp, sp, #28
        @ sp needed
        pop     {r4, r5, r6, r7, r8, r9, r10, fp, lr}
        bx      ip
```
With -mbranch-protection=3Dstandard:
```
.L2:
        movs    r0, #0
        ldr     r4, .L25+4
        ldr     r4, [r4, #24]
        str     r4, [sp, #4]
        add     sp, sp, #24
        @ sp needed
        pop     {r4, r5, r6, r7, r8, r9, r10, fp, ip, lr}
        aut     ip, lr, sp
        bx      ip
```
Note that in the latter example, the `ip` register doesn't get copied from
`r4`, presumably because `ip` gets clobbered by the PAC operation. That lea=
ves
the indirect branch at the end jumping to a random address.=