commit f7765f70e0e254fd9ce4469c7281c69cd06c9467
Author: law <law@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Wed Jan 24 21:57:16 2018 +0000

            PR target/83994
            * i386.c (get_probe_interval): Move to earlier point.
            (ix86_compute_frame_layout): If -fstack-clash-protection and
            the frame is larger than the probe interval, then use pushes
            to save registers rather than reg->mem moves.
            (ix86_expand_prologue): Remove conditional for int_registers_saved
            assertion.

            PR target/83994
            * gcc.target/i386/pr83994.c: New test.

diff --git a/gcc/config/i386/i386.c b/gcc/config/i386/i386.c
index 15cfe83..5230227 100644
--- a/gcc/config/i386/i386.c
+++ b/gcc/config/i386/i386.c
@@ -9371,6 +9371,18 @@ ix86_builtin_setjmp_frame_value (void)
   return stack_realign_fp ? hard_frame_pointer_rtx : virtual_stack_vars_rtx;
 }
 
+/* Return the probing interval for -fstack-clash-protection.  */
+
+static HOST_WIDE_INT
+get_probe_interval (void)
+{
+  if (flag_stack_clash_protection)
+    return (HOST_WIDE_INT_1U
+	    << PARAM_VALUE (PARAM_STACK_CLASH_PROTECTION_PROBE_INTERVAL));
+  else
+    return (HOST_WIDE_INT_1U << STACK_CHECK_PROBE_INTERVAL_EXP);
+}
+
 /* When using -fsplit-stack, the allocation routines set a field in
    the TCB to the bottom of the stack plus this much space, measured
    in bytes.  */
@@ -9545,7 +9557,15 @@ ix86_compute_frame_layout (struct ix86_frame *frame)
   to_allocate = offset - frame->sse_reg_save_offset;
 
   if ((!to_allocate && frame->nregs <= 1)
-      || (TARGET_64BIT && to_allocate >= (HOST_WIDE_INT) 0x80000000))
+      || (TARGET_64BIT && to_allocate >= (HOST_WIDE_INT) 0x80000000)
+      /* If stack clash probing needs a loop, then it needs a
+	 scratch register.  But the returned register is only guaranteed
+	 to be safe to use after register saves are complete.  So if
+	 stack clash protections are enabled and the allocated frame is
+	 larger than the probe interval, then use pushes to save
+	 callee saved registers.  */
+      || (flag_stack_clash_protection && to_allocate > get_probe_interval ()))
+
     frame->save_regs_using_mov = false;
 
   if (ix86_using_red_zone ()
@@ -10181,18 +10201,6 @@ release_scratch_register_on_entry (struct scratch_reg *sr)
     }
 }
 
-/* Return the probing interval for -fstack-clash-protection.  */
-
-static HOST_WIDE_INT
-get_probe_interval (void)
-{
-  if (flag_stack_clash_protection)
-    return (HOST_WIDE_INT_1U
-	    << PARAM_VALUE (PARAM_STACK_CLASH_PROTECTION_PROBE_INTERVAL));
-  else
-    return (HOST_WIDE_INT_1U << STACK_CHECK_PROBE_INTERVAL_EXP);
-}
-
 /* Emit code to adjust the stack pointer by SIZE bytes while probing it.
 
    This differs from the next routine in that it tries hard to prevent
@@ -11064,12 +11072,11 @@ ix86_expand_prologue (void)
       && (flag_stack_check == STATIC_BUILTIN_STACK_CHECK
 	  || flag_stack_clash_protection))
     {
-      /* This assert wants to verify that integer registers were saved
-	 prior to probing.  This is necessary when probing may be implemented
-	 as a function call (Windows).  It is not necessary for stack clash
-	 protection probing.  */
-      if (!flag_stack_clash_protection)
-	gcc_assert (int_registers_saved);
+      /* We expect the GP registers to be saved when probes are used
+	 as the probing sequences might need a scratch register and
+	 the routine to allocate one assumes the integer registers
+	 have already been saved.  */
+      gcc_assert (int_registers_saved);
 
       if (flag_stack_clash_protection)
 	{
diff --git a/gcc/testsuite/gcc.target/i386/pr83994.c b/gcc/testsuite/gcc.target/i386/pr83994.c
new file mode 100644
index 0000000..dc0b7cb
--- /dev/null
+++ b/gcc/testsuite/gcc.target/i386/pr83994.c
@@ -0,0 +1,16 @@
+/* { dg-do compile } */
+/* { dg-options "-O2 -march=i686 -fpic -fstack-clash-protection" } */
+/* { dg-require-effective-target ia32 } */
+
+void f1 (char *);
+
+__attribute__ ((regparm (3)))
+int
+f2 (int arg1, int arg2, int arg3)
+{
+  char buf[16384];
+  f1 (buf);
+  f1 (buf);
+  return 0;
+}
+