>Number:         4855
>Category:       target
>Synopsis:       arm (thumb) backend generates illegal strb instruction
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          wrong-code
>Submitter-Id:   net
>Arrival-Date:   Mon Nov 12 01:46:00 PST 2001
>Closed-Date:
>Last-Modified:
>Originator:     Adrian von Bidder
>Release:        3.0.2
>Organization:
Acter AG, Zürich, Switzerland
>Environment:
System: Linux atlas 2.4.14 #2 Wed Nov 7 14:03:16 CET 2001 i686 unknown
Architecture: i686
host: i686-pc-linux-gnu
build: i686-pc-linux-gnu
target: arm-linux-elf
configured with: ../gcc-3.0.2.orig/configure --prefix=/home/avbidder/gcc-3 --target=arm-linux-elf --with-cpu=arm7tdmi --enable-checking
>Description:
gcc produces a 'strb rX, [sp, #offs]' instruction, which is not possible on the
ARM with thumb code (only low registers are allowed in str/ldr, since there are
only 3 bits of register address in the opcode.)

Of course, the assembler does complain.

Although the bug does not show up with the sample code and without optimizations
it's not an optimizer bug - the backend should not be able to generate this 
instruction at all.

>How-To-Repeat:
The bug is quite robust. It occurs with
arm-linux-elf-gcc -mthumb -fpic -mpic-register=r6 -O2
optionally, -O3, -msingle-pic-base, -mthumb-interwork and/or -g do not make the 
bug go away. 

$ arm-linux-elf-gcc -O2 -mthumb -fpic -mpic-register=r6 01.c
/tmp/ccd0bSpI.s: Assembler messages:
/tmp/ccd0bSpI.s:27: Error: byte or halfword not valid for base register

With
===
    strb    r3, [sp, #1]        !!!!!!
===
as the generated instruction . It should probably do something like
    mov rX, sp
    strb r3, [rX, #1]
where X is in [0..7]. Or use a low register to address the stack at all?


Boiled down as far as I could (it's an excerpt from regex.c in uclibc):
[cut down preprocessor output from the original file.]
===
typedef enum
{
  REG_NOERROR = 0,
  REG_NOMATCH,
  REG_BADPAT,
  REG_ECOLLATE,
  REG_ECTYPE,
  REG_EESCAPE,
  REG_ESUBREG,
  REG_EBRACK,
  REG_EPAREN,
  REG_EBRACE,
  REG_BADBR,
  REG_ERANGE,
  REG_ESPACE,
  REG_BADRPT,
  REG_EEND,
  REG_ESIZE,
  REG_ERPAREN
}
reg_errcode_t;

typedef unsigned long int reg_syntax_t;

extern int strcoll (const char *__s1, const char *__s2);

static reg_errcode_t
compile_range (p_ptr, pend, translate, syntax, b)
     const char **p_ptr, *pend;
     char *translate;
     reg_syntax_t syntax;
     unsigned char *b;
{
  unsigned this_char;

  const char *p = *p_ptr;
  reg_errcode_t ret;
  char range_start[2];
  char range_end[2];
  char ch[2];

//  if (p == pend)
//    return REG_ERANGE;

//  range_start[0] = p[-2];
//  range_start[1] = '\0';
//  range_end[0] = p[0];
//  range_end[1] = '\0';

//  (*p_ptr)++;


  ret = syntax & ((((((((((((((((((unsigned long int) 1) << 1) << 1) << 1) <<
			      1) << 1) << 1) << 1) << 1) << 1) << 1) << 1) <<
		      1) << 1) << 1) << 1) << 1) ? REG_ERANGE : REG_NOERROR;
  ch[1] = '\0';
  for (this_char = 0; this_char <= (unsigned char) -1; ++this_char)
    {
      ch[0] = this_char;
      if (strcoll (range_start, ch) <= 0 && strcoll (ch, range_end) <= 0)
	{
	  (b
	   [((unsigned
	      char) ((translate ? (char)
		      translate[(unsigned char) (this_char)] : (this_char))))
	    / 8] |=
	   1 <<
	   (((unsigned char) (translate ? (char)
			      translate[(unsigned char) (this_char)]
			      : (this_char))) % 8));
//	  ret = REG_NOERROR;
	}
    }

  return ret;
}
===

>Fix:
Don't use -On, n>1.

Probably the fix will be a modification in arm.md.

>Release-Note:
>Audit-Trail:
>Unformatted: