[RFC] ARM skip_prologue algorithm

[Jerome Guitton <guitton at act-europe dot fr>]

I fail to understand the semantics of skip_prologue, when prologue
code and 'real' code are mixed. In particular, if a function foo looks
like:

foo:
	first chunk of the prologue
.L1:
	some real code
.L2:
	second chunk of the prologue
.L3:
	some real code

skip_prologue should return .L1 or .L3? What if .L1 = foo, i.e if
there is no first prologue chunk?

For ARM, with the current implementation, the answers are:
Q : skip_prologue should return .L1 or .L3?
A : .L1
Q : What if .L1 = foo?
A : foo (i.e. the address of the function)

The reason of these questions is that I have to debug some ARM code linked to
a system library, and in this library some optimized function looks like:

msr     CPSR_fc, r3		@ Some 'real' code, I presume ...
stmdb   sp!, {r0, r1, lr}	@ Prologue
add     r0, r0, #8		@ Some 'real code'
[...]

I have also encountered this kind of code (generated by GCC for an Ada
program, I have no C reproducer...)

system__assertions__raise_assert_failure
    a03f3858  e1a02001                 mov      r2,r1
    a03f385c  e1a01000                 mov      r1,r0
    a03f3860  e92d4070                 stmdb    sp!,{r4-r6,r14}
[...]

In the current implementation, in both cases, if there is no debug
information (*), arm_skip_prologue will return the address of the first
instruction... Meaning that there is no prologue. These functions will
then be considered as frameless functions, which is clearly a bug.

(*) (With debug information, that is better but still false IMHO,
arm_skip_prologue will use the line info and return the address of the
beginning of prologue (0xa03f3860 in my example). But it is another
problem, it would be nice to verify that there is at least one prologue
instruction before the candidate address for the prologue
end... That's another story.)

To fix it, I would propose the following algorithm (I have attached a possible
implementation):

best_address := start_address
for address in start_addres .. start_address + 64
   inst := instruction at the current code address

   if inst is a prologue instruction
      best_address := current address + 4

   break if we encounter a procedure call, no need to analyse further

end loop
return best_address

With this algorithm, the answer to my questions would be:
Q : skip_prologue should return .L1 or .L3?
A : .L3
Q : What if .L1 = foo?
A : .L3 too.

Do I misunderstand something?

(Incidentally, I have run the testsuite on the arm-elf simulator, no
regression and no fix.)

-- 
Jerome

Attachment: arm.dif
Description: Text document