Apparent bug in "inlined" memcpy

Greetings,

Consider this test case:

#include <stdlib.h>

#include <string.h>

struct S { struct S *next; };

int main(int argc, char *argv[])

{

struct S s;

unsigned long expected;

s.next = (struct S*)malloc(sizeof(s));

memset(s.next,0xAE, sizeof(s));

memset(&expected, 0xAE, sizeof(expected));

if (argc < 2)

s = *(s.next); /* implicit memcpy */

else

memcpy(&s, s.next, sizeof(s));

return s.next == (void*)expected ? 0 : 1;

}

Expected result of this code is successful exit, which it does for gcc and CC.

With cc however, the code crashes:

$ cc -g junk.c

$ ./a.out 1 && echo ok

ok

$ ./a.out && echo ok

Segmentation Fault (core dumped)

This was observed with cc versions:

cc: Sun C 5.6 2004/07/15

cc: Sun C 5.7 2005/01/07

cc: Sun C 5.8 2005/10/13

It would appear that 'cc' inlines memcpy incorrectly.

[1018 byte] By [ppluzhnik] at [2007-11-26 9:34:54]
# 1

Yes, it looks like a compiler bug. I tried to trace compiler logic:

[code]

main+0x004a:movl0xfffffff8(%ebp),%eax# load s.next to %eax

main+0x004d:movl0x00000000(%eax),%eax # dereference s.next to %eax

main+0x0050:movl%eax,0xfffffff8(%ebp)# save %eax (*s.next) to s.next

main+0x0053:movl0xfffffff8(%ebp),%eax# load s.next to %eax

main+0x0056:movl0x00000000(%eax),%eax # load *s.next to %eax

main+0x0059:movl%eax,0xffffffec(%ebp) # save %eax to where?

[/code]

I fail to understand what the code starting from main+0x0053 is supposed to do.

You can file a bug against C compiler here: http://bugs.sun.com/bugdatabase/index.jsp

MaximKartashev at 2007-7-7 0:24:48 > top of Java-index,Development Tools,Solaris and Linux Development Tools...
# 2
I didn't realize this also happened on x86 (I only have SPARC systems).Anyway, thanks for pointing out the place where bug reports could be send.This is now Bug Id: 6463188 http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6463188
ppluzhnik at 2007-7-7 0:24:48 > top of Java-index,Development Tools,Solaris and Linux Development Tools...