LLVM miscompiles Wine's dlls/msctf/categorymgr.c at -O0

[llvmbot]

Bugzilla Link	9705
Resolution	INVALID
Resolved on	Oct 26, 2011 12:22
Version	trunk
OS	All
Blocks	llvm/llvm-bugzilla-archive#10638
Reporter	LLVM Bugzilla Contributor

Extended Description

Part 3 of a long series filed on behalf of Austin English.

Clang also miscompiles dlls/msctf/categorymgr.c from Wine. This results in an AV during Wine's msctf regression test (see http://bugs.winehq.org/show_bug.cgi?id=25826). Preprocessed source will be attached. Not sure what -O levels trigger this; need to get more details from Austin. Shouldn't be related to the integrated assembler.

[llvmbot]

Occurs at -O0 and -O2. Recompiling just dlls/msctf/categorymgr.c with gcc avoids the crash. Preprocessed C file will be attached.

[llvmbot]

preprocessed c file, bzip2 -9'ed

[llvmbot]

wine backtrace

[llvmbot]

preprocessed clang file
clang -E -I. -I. -I../../include -I../../include -D__WINESRC__ -D_REENTRANT -fPIC -Wall -pipe -fno-strict-aliasing -Wdeclaration-after-statement -Wstrict-prototypes -Wtype-limits -Wwrite-strings -Wpointer-arith -std=gnu89 -g -O0 -no-integrated-as categorymgr.c &> ~/msctf_clang.i

[llvmbot]

preprocessed gcc file
gcc -E -I. -I. -I../../include -I../../include -D__WINESRC__ -D_REENTRANT -fPIC -Wall -pipe -fno-strict-aliasing -Wdeclaration-after-statement -Wstrict-prototypes -Wtype-limits -Wwrite-strings -Wpointer-arith -std=gnu89 -g -O0 categorymgr.c &> ~/msctf_gcc.i

gcc (Gentoo 4.4.5 p1.2, pie-0.4.5) 4.4.5

[llvmbot]

Occurs in trunk, r130886, at -O0 (with/without integrated assembler), but NOT at -O1/-O2 (with/without integrated assembler).

Also miscompiles in 2.9 at -O0, but not at -O2.

[llvmbot]

Fixed in Wine, by http://source.winehq.org/git/wine.git/commitdiff/d5090fd9757fbee2190eaa0f54ea39ebcfe657e3.

Valgrind also showed a problem. From Wine's bugzilla:

Valgrind found a write buffer overrun on a stack buffer,
though since it doesn't really know about stack buffer
ends, we got lucky and the overrun was caught by a sanity
check on memcpy:

Source and destination overlap in memcpy(0x7f22f8c8, 0x7f22f904, 76)
at memcpy (mc_replace_strmem.c:635)
by format_string (string.c:339)
by vsnprintfW (string.c:429)
by sprintfW (string.c:514)
by CategoryMgr_FindClosestCategory (categorymgr.c:219)
by next_LanguageProfile (inputprocessor.c:1030)
by EnumTfLanguageProfiles_Next (inputprocessor.c:1065)
by test_EnumLanguageProfiles (inputprocessor.c:935)
by func_inputprocessor (inputprocessor.c:2202)
by run_test (test.h:556)
by main (test.h:624)

so likely not an llvm bug.