[Qemu-devel] Crash due to invalid env->current_tb

[Adam Lackorzynski <adam@os.inf.tu-dresden.de>]

Hi,

I've been experiencing crashes of latest svn Qemu, host ia32 and target
arm, host gcc is 'gcc version 3.4.6 (Debian 3.4.6-7)'.
The segfault happens because of an invalid env->current_tb which seems
to be caused by generated code. The following code in cpu_exec

   tc_ptr = tb->tc_ptr;
   env->current_tb = tb;
   gen_func = (void *)tc_ptr;
   T0 = gen_func();
   env->current_tb = NULL;

is being compiled to the following

   mov    0x14(%ecx),%eax
   mov    %ecx,0x56c(%ebp)
   xor    %edi,%edi
   call   *%eax
   mov    %edi,0x56c(%ebp)

After the call edi isn't 0 anymore and gets the bogus value. As edi is
callee saved the code itself seems ok.
When I add a barrier before "env->current_tb = NULL" the xor is placed
after the call and everything works fine. So might the problem be that
generated code isn't preserving edi/registers?



Adam
-- 
Adam                 adam@os.inf.tu-dresden.de
  Lackorzynski         http://os.inf.tu-dresden.de/~adam/