Comment #0 by safety0ff.bugz — 2016-12-26T10:24:16Z
Created attachment 1628
full details & code
For the following snippet from the attached code:
struct S
{
long _value;
void popFront()
{
_value >>>= 1;
if (!_value)
return;
_value >>>= 1; // arbitrary code here
}
}
Dmd emits the snippet (with -m32 -fPIC):
1: shrl 0x4(%edx)
2: rcrl (%edx)
3: mov 0x4(%edx),%edx
4: mov (%edx),%eax
5: or %eax,%edx
6: jne SomeAddress
On line 3 Dmd overwrites the address of _value in EDX with the top 4 bytes of _value.
Then on line 4, dmd loads the bottom 4 bytes of _value into EAX, but EDX no longer contains the address of _value, which leads to a segfault.
Comment #1 by safety0ff.bugz — 2016-12-26T23:22:16Z