[Speex-dev] Speex crashing on ARM with assembler optimization enabled.

[Alexander Chemeris]

Hi,

Ugh, crash course of ARM assembly and gdb debugging is over for me. :)

So, it was a memory corruption bug, caused by off by one error in
second part of assembler inline in normalize16():

   __asm__ __volatile__ (
         ".normalize16loop%=: \n"

         "\tldr %4, [%0], #4 \n"
         "\tldr %5, [%0], #4 \n"
         "\tmov %4, %4, asr %3 \n"
         "\tstrh %4, [%1], #2 \n"
         "\tldr %4, [%0], #4 \n"
         "\tmov %5, %5, asr %3 \n"
         "\tstrh %5, [%1], #2 \n"
         "\tldr %5, [%0], #4 \n"
         "\tmov %4, %4, asr %3 \n"
         "\tstrh %4, [%1], #2 \n"
         "\tsubs %2, %2, #1 \n"
         "\tmov %5, %5, asr %3 \n"
         "\tstrh %5, [%1], #2 \n"

         "\tbge .normalize16loop%=\n"
   : "=r" (dead1), "=r" (dead2), "=r" (dead3), "=r" (dead4),
   "=r" (dead5), "=r" (dead6)
   : "0" (x), "1" (y), "2" (len>>2), "3" (sig_shift)
   : "cc", "memory");

This loop is supposed to be ran (len>>2) times, but actually it is ran
((len>>2)+1) times, because %2 is initialized by (len>>2) and then
counted to 0 instead of 1. So, solution is to change last line to:

         "\tbgt .normalize16loop%=\n"

Interesting, the part of code, caused crash is here for a year already,
it was introduced in rev.12243 (calls to normalize16() were added
to open_loop_nbest_pitch() among other things). And normalize16()
arm optimization is in svn for almost three years (from rev.8855).
I'm wondering are we the only speex users on ARM?

-- 
Regards,
Alexander Chemeris.

SIPez LLC.
SIP VoIP, IM and Presence Consulting
http://www.SIPez.com
tel: +1 (617) 273-4000
-------------- next part --------------
A non-text attachment was scrubbed...
Name: filters_arm4.h.diff
Type: text/x-patch
Size: 502 bytes
Desc: not available
Url : http://lists.xiph.org/pipermail/speex-dev/attachments/20071215/3c975001/filters_arm4.h.bin