[Clang] Compiler Bugs (Emit Incorrect Intel Binaries)

[witbring]

I am reporting a Clang compiler bug discovered during my research.
The test was conducted using the latest version (Clang 19.1.0)
This issue occurs when using the -masm=intel --save-temps flag.

1. Summary

• Bug1: The bus occurs when a variable name matches register name, the compiled code accesses an incorrect memory address even in the PIE binaries.
• Bug2: The bug occurs when a function name matches register name, the compiled code converts the call instruction into an indirect call.

2. Example Code

Below is an example that reproduces the issues.
In the code, the variable RAX is assigned a value 4, and the function RBX is called.

#include <stdio.h>

int RAX;
void RBX() { printf("hello world\n"); }

int main()
{
    RAX = 4;
    RBX();
    return 0;
}

3. Compilation Command

clang -masm=intel --save-temps example.c -pie -fPIE

4. Compiled Binary Output

• Bug 1
  At address 0x1164, the mov instruction accesses the indirect meory instead the data RAX.
  For further details, refer to issue [Clang] Intel Assembly Bug (Mishandle RIP-relative Addressing) #122093
  Also, similar issues occur when I use vector registers like XMM0.
  For further details, refer to issue [Clang] Intel Assembly Bug (Mishandle Vector Register Names) #122092

• Bug 2
  At address 0x116f, the call instruction has been converted into an indirect call.
  For further details, refer to issue [Clang] Intel Assembly Bugs (Mishandle Labels) #122200

0000000000001140 <RBX>:
    ...

0000000000001160 <main>:
    1160:	55                   	push   rbp
    1161:	48 89 e5             	mov    rbp,rsp
    1164:	c7 04 05 00 00 00 00 	mov    DWORD PTR [rax*1+0x0],0x4
    116b:	04 00 00 00
    116f:	ff d3                	call   rbx
    1171:	31 c0                	xor    eax,eax
    1173:	5d                   	pop    rbp
    1174:	c3                   	ret

5. Reproduction

You can reproduce the result through Godbolt Compiler Explorer:
https://godbolt.org/z/7EefT3zW8

[lhmouse]

You should quote symbols that match MASM keywords:
(https://gcc.godbolt.org/z/1dTfsqsKf)

.intel_syntax noprefix
.data
RAX:
RbX:
Rcx:
    .long 0
.text
test:
	mov	edx, DWORD PTR ["RAX"]
	mov	edx, DWORD PTR ["RbX"]
	mov	edx, DWORD PTR ["Rcx"]
    call "rsP"

rsP:
    ret

test:
 mov    edx,DWORD PTR ds:0x0
 mov    edx,DWORD PTR ds:0x0
 mov    edx,DWORD PTR ds:0x0
 call   1a <rsP>
rsP:
 ret