This simple test case crashed in sim when compiler by arm-eabi-gcc for thumb.
------- class B1 { public: virtual void foo1(void) {} int b1; }; class B2 { public: virtual void foo2 (void) {} }; class D : public B1, public B2 { void foo1(void) {} void foo2(void) {} }; void __attribute__((noinline)) test(B2* bp) { bp->foo2(); } int main() { D d; test (&d); return 0; } ------- $ arm-eabi-g++ -mthumb -mthumb-interwork bug.cc $ arm-eabi-gdb a.out GNU gdb 6.7.1 Copyright (C) 2007 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "--host=i686-unknown-linux-gnu --target=arm-eabi"... (gdb) target sim Connected to the simulator. (gdb) load a.out Loading section .init, size 0xc vma 0x8000 Loading section .text, size 0x32b8 vma 0x800c Loading section .fini, size 0xc vma 0xb2c4 Loading section .rodata, size 0x208 vma 0xb2d0 Loading section .ARM.extab, size 0x90 vma 0xb4d8 Loading section .ARM.exidx, size 0x248 vma 0xb568 Loading section .eh_frame, size 0x4 vma 0xb7b0 Loading section .init_array, size 0x4 vma 0x137b4 Loading section .fini_array, size 0x4 vma 0x137b8 Loading section .jcr, size 0x4 vma 0x137bc Loading section .data, size 0x930 vma 0x137c0 Start address 0x806c Transfer rate: 132992 bits in <1 sec. (gdb) run Starting program: /usr/local/google/data/dougkwan/arm-elf/test/a.out Unhandled v6 thumb insn: e92d sim: exception: Unhandled Instruction '0xe92d4080' at 0x000081d0. Stopping. Program received signal 0, Signal 0. 0x00000b90 in ?? () (gdb) quit The program is running. Exit anyway? (y or n) y $ arm-eabi-g++ -v Using built-in specs. Target: arm-eabi Configured with: /data/dougkwan/arm-elf/src/gcc-trunk/configure --prefix=/data/dougkwan/arm-elf/install --target=arm-eabi --build=i686-unknown-linux-gnu --host=i686-unknown-linux-gnu --with-gmp=/home/dougkwan/gcc-lib/install --with-mpfr=/home/dougkwan/gcc-lib/install --with-arch=armv5te --enable-interwork --enable-multilib --with-newlib --with-gnu-as --with-gnu-ld --enable-languages=c,c++ Thread model: single gcc version 4.4.0 20090305 (experimental) (GCC) This works fine in 4.2.x. The problem is that crtl->is_thunk is set during thunk emission but is not not reset after. So target function of a thunk is also emitted with crtl->is_thunk set. That cause the function to be emitted in ARM mode. Below is part of the assembly output of the test above. .section .text._ZN1D4foo2Ev,"axG",%progbits,_ZN1D4foo2Ev,comdat .align 2 .weak _ZThn8_N1D4foo2Ev .code 32 .type _ZThn8_N1D4foo2Ev, %function _ZThn8_N1D4foo2Ev: .fnstart ldr r12, .LTHUMBFUNC0 sub r0, r0, #8 bx r12 .align 2 .LTHUMBFUNC0: .word .LTHUNK0 .fnend .size _ZThn8_N1D4foo2Ev, .-_ZThn8_N1D4foo2Ev .align 2 .weak _ZN1D4foo2Ev .code 32 .type _ZN1D4foo2Ev, %function _ZN1D4foo2Ev: .fnstart .LFB3: .save {r7, lr} push {r7, lr} .LCFI9: sub sp, sp, #8 .LCFI10: add r7, sp, #0 .LCFI11: str r0, [r7, #4] mov sp, r7 add sp, sp, #8 @ sp needed for prologue pop {r7, pc} .LFE3: .cantunwind .fnend .size _ZN1D4foo2Ev, .-_ZN1D4foo2Ev Note that the function _ZN1D4foo2Ev (unmangled as D::foo2()) is emitted in ARM mode. However, in the typeinfo for B1, the function is marked as a THUMB function. _ZTI2B1: .word _ZTVN10__cxxabiv117__class_type_infoE+8 .word _ZTS2B1 .thumb_set .LTHUNK0,_ZN1D4foo2Ev I believe this problem can be fixed by saving and restoring crtl->is_thunk around the call to the lang-hook callgraph.emit_associated_thunks in cgraphunit.c -- Summary: Multiple inheritence thunk not working with -mthumb Product: gcc Version: 4.4.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: middle-end AssignedTo: unassigned at gcc dot gnu dot org ReportedBy: dougkwan at google dot com GCC build triplet: i686-unknown-linux-gnu GCC host triplet: i686-unknown-linux-gnu GCC target triplet: arm-eabi http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39378