Message-ID: <fcc830d6-84e5-4c9b-9189-6a270234d213@gmail.com>
Date: Fri, 27 Sep 2024 20:30:10 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: djgpp AT delorie DOT com
From: "J.W. Jagersma (jwjagersma AT gmail DOT com) [via djgpp AT delorie DOT com]" <djgpp AT delorie DOT com>
Subject: mcount clobbers argument pointer
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Reply-To: djgpp AT delorie DOT com

User "pif17" on Github discovered the following problem.  Given a simple
test case:

    #include <stdio.h>
    int main (int, char **argv)
    {
      puts (argv[0]);
    }

When compiled with '-pg', the above code segfaults.  This happens
because gcc aligns the stack on entering 'main', *before* emitting the
call to 'mcount':

00001760 <_main>:
    1760:	8d 4c 24 04          	lea    ecx,[esp+0x4]
    1764:	83 e4 f0             	and    esp,0xfffffff0
    1767:	ff 71 fc             	push   DWORD PTR [ecx-0x4]
    176a:	55                   	push   ebp
    176b:	89 e5                	mov    ebp,esp
    176d:	51                   	push   ecx
    176e:	83 ec 04             	sub    esp,0x4
    1771:	ba e0 16 01 00       	mov    edx,0x116e0
    1776:	e8 c5 3b 00 00       	call   5340 <_mcount>
    177b:	89 c8                	mov    eax,ecx
    177d:	8b 40 04             	mov    eax,DWORD PTR [eax+0x4]
    1780:	8b 00                	mov    eax,DWORD PTR [eax]
    1782:	83 ec 0c             	sub    esp,0xc
    1785:	50                   	push   eax
    1786:	e8 25 29 00 00       	call   40b0 <_puts>
    178b:	83 c4 10             	add    esp,0x10
    178e:	b8 00 00 00 00       	mov    eax,0x0
    1793:	8b 4d fc             	mov    ecx,DWORD PTR [ebp-0x4]
    1796:	c9                   	leave
    1797:	8d 61 fc             	lea    esp,[ecx-0x4]
    179a:	c3                   	ret

Here the argument pointer is saved in ECX, which is then clobbered by
mcount.

GCC has performed this automatic stack alignment since version 4.1, and
it apparently hasn't caused problems for other targets.  So this leads
me to conclude that djgpp's mcount is at fault, and it should have saved
all registers.

I can think of three possible solutions (in increasing order of
difficulty):

* Mark 'mcount' with attribute 'no_caller_saved_registers'.  This should
  do the right thing.  But note, this attribute was only introduced in
  gcc 7.
* Rename 'mcount' -> 'mcount_internal', then write an asm wrapper around
  it that saves all registers.
* Convince the gcc people that their compiler emits code in the wrong
  order :)

The second option is probably best, since it also makes retrieving EDX
less fragile.