Question

I’ve been chasing down a crash that seems to be due to memory corruption. The setting is C, building using llvm for iOS.

The memory corruption is absent in debug mode and with optimization level 0 (-O0). In order to be able to step through the code, I’ve rebuilt with debug symbols but optimization level 1 (-O1). This is enough to reproduce the crash and it allows me to step through the program.

I’ve narrowed the problem down to a particular function call. Before it, the value of a certain pointer is correct. After it, the value is corrupted (it ends up equalling 0x02, for whatever that is worth).

Lldb doesn’t seem to want to watch variables or memory locations. Switching to gdb, I find that if I try to print the address of the aforementioned variable I encounter the following message: “Address requested for identifier ‘x’ which is in register $r4”.

I understand that, as an optimization, the compiler may decide to keep the value of a variable in a register. True enough, if I print the value of $r4 before and after the function call, I see the correct value before and 0x02 after.

I’m in a bit over my head at this point and not sure how to split this into smaller problems. My questions are therefore these:

1. assuming that the compiler is storing the value of a variable in a register as an optimization, what is supposed to happen to that register when another function is invoked?

2. Is there some mechanism whereby the value is stored and restored once the new function returns?

3. Any recommendations on debugging techniques?

All help and suggestions appreciated. Links to reading material on the subject also quite welcome.

Thanks

---

EDIT: adding version information

iOS version: 5.1

llvm version: i686-apple-darwin10-llvm-gcc-4.2 (GCC) 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2377.00)

Xcode version: 4.3.1

Gdb version: GNU gdb 6.3.50-20050815 (Apple version gdb-1708)

Running on an iPhone 3Gs (crash does not appear in simulator)

Answer 1

Not a full answer, but

assuming that the compiler is storing the value of a variable in a
register as an optimization, what is supposed to happen to that
register when another function is invoked?

The register should probably be pushed to the stack by the callee.

Is there some mechanism whereby the value is stored and restored once
the new function returns?

Depends on the calling conventions, but in general – whoever pushed it to stack is responsible to pop it from the stack

Last thing:

If you meet such case, where “it works” on some optimisation level and doesn’t on other, you are very likely to have an undefined behavior. If you can’t find it in your code, you can ask it here, giving the actual code.