re PR target/45843 (__builtin_va_arg overwrites into adjacent stack location)

	PR target/45843
	* config/i386/i386.c (ix86_gimplify_va_arg): Use
	INTVAL (XEXP (slot, 1)) as prev_size.

	* g++.dg/torture/pr45843.C: New test.

From-SVN: r164766

gcc/ChangeLog

+2010-09-30  Jakub Jelinek  <jakub@redhat.com>
+
+	PR target/45843
+	* config/i386/i386.c (ix86_gimplify_va_arg): Use
+	INTVAL (XEXP (slot, 1)) as prev_size.
+
 2010-09-30  Michael Meissner  <meissner@linux.vnet.ibm.com>
 
 	PR target/45837

gcc/config/i386/i386.c

@@ -7524,6 +7524,8 @@ ix86_gimplify_va_arg (tree valist, tree type, gimple_seq *pre_p,
 	      tree dest_addr, dest;
 	      int cur_size = GET_MODE_SIZE (mode);
 
+	      gcc_assert (prev_size <= INTVAL (XEXP (slot, 1)));
+	      prev_size = INTVAL (XEXP (slot, 1));
 	      if (prev_size + cur_size > size)
 		{
 		  cur_size = size - prev_size;
@@ -7556,7 +7558,7 @@ ix86_gimplify_va_arg (tree valist, tree type, gimple_seq *pre_p,
 
 	      dest_addr = fold_convert (daddr_type, addr);
 	      dest_addr = fold_build2 (POINTER_PLUS_EXPR, daddr_type, dest_addr,
-				       size_int (INTVAL (XEXP (slot, 1))));
+				       size_int (prev_size));
 	      if (cur_size == GET_MODE_SIZE (mode))
 		{
 		  src = build_va_arg_indirect_ref (src_addr);

gcc/testsuite/ChangeLog

+2010-09-30  Jakub Jelinek  <jakub@redhat.com>
+
+	PR target/45843
+	* g++.dg/torture/pr45843.C: New test.
+
 2010-09-30  Janus Weil  <janus@gcc.gnu.org>
 
 	PR fortran/45828

gcc/testsuite/g++.dg/torture/pr45843.C

+// PR target/45843
+// { dg-do run }
+
+#include <stdarg.h>
+
+extern "C" void abort ();
+struct S { struct T { } a[14]; char b; };
+struct S arg, s;
+
+void
+foo (int z, ...)
+{
+  char c;
+  va_list ap;
+  va_start (ap, z);
+  c = 'a';
+  arg = va_arg (ap, struct S);
+  if (c != 'a')
+    abort ();
+  va_end (ap);
+}
+
+int
+main ()
+{
+  foo (1, s);
+  return 0;
+}