F# Hello World crash issue

[Amit-Sirohi]

Description

Assertion Failed at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-ppc.c:3801, condition `cfg->frame_reg == ppc_sp' not met

Thread 1 (Thread 0x7dcc62685260 (LWP 859720)):
#0 0x00007dcc6202f318 in __GI___wait4 (pid=, stat_loc=0x7fffc4711810, options=, usage=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:27
#1 0x00007dcc6202f20c in __GI___waitpid (pid=, stat_loc=, options=) at waitpid.c:38
#2 0x00007dcc61cd245c in dump_native_stacktrace (signal=, mctx=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-posix.c:843
#3 mono_dump_native_crash_info (signal=, mctx=0x7fffc47122c0, info=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-posix.c:870
#4 0x00007dcc61c8231c in mono_handle_native_crash (signal=0x7dcc61db3c58 "SIGABRT", mctx=0x7fffc47122c0, info=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-exceptions.c:2997
#5 0x00007dcc61cd17a8 in sigabrt_signal_handler (_dummy=, _info=0x7fffc47132e8, context=0x7fffc4712570) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-posix.c:225
#6
#7 0x00007dcc61f7d168 in __libc_signal_restore_set (set=0x7fffc4713598) at ../sysdeps/unix/sysv/linux/internal-signals.h:86
#8 __GI_raise (sig=) at ../sysdeps/unix/sysv/linux/raise.c:48
#9 0x00007dcc61f54850 in __GI_abort () at abort.c:79
#10 0x00007dcc61d27168 in monoeg_assert_abort () at /root/vikas/Native_Build/runtime/src/mono/mono/eglib/goutput.c:57
#11 0x00007dcc61b3cbd4 in mono_log_write_logfile (log_domain=, level=G_LOG_LEVEL_ERROR, hdr=, message=0xb0083aaf560 "* Assertion at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-ppc.c:3801, condition `cfg->frame_reg == ppc_sp' not met\n") at /root/vikas/Native_Build/runtime/src/mono/mono/utils/mono-log-common.c:146
#12 0x00007dcc61b395a4 in structured_log_adapter (log_domain=, log_level=, message=, user_data=) at /root/vikas/Native_Build/runtime/src/mono/mono/utils/mono-logger.c:461
#13 0x00007dcc61d2771c in monoeg_g_logstr (log_domain=0x0, log_level=-2085403336, msg=) at /root/vikas/Native_Build/runtime/src/mono/mono/eglib/goutput.c:151
#14 monoeg_g_logv_nofree (log_domain=0x0, log_level=-2085403336, format=, args=) at /root/vikas/Native_Build/runtime/src/mono/mono/eglib/goutput.c:166
#15 0x00007dcc61d2786c in monoeg_assertion_message (format=) at /root/vikas/Native_Build/runtime/src/mono/mono/eglib/goutput.c:207
#16 0x00007dcc61d278ec in mono_assertion_message (file=, line=, condition=) at /root/vikas/Native_Build/runtime/src/mono/mono/eglib/goutput.c:226
#17 0x00007dcc61cc7324 in mono_arch_output_basic_block (cfg=0xb0083abd590, bb=0xb0083b33d20) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-ppc.c:3801
#18 0x00007dcc61bbf888 in mono_codegen (cfg=0xb0083abd590) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini.c:2079
#19 0x00007dcc61bc2e98 in mini_method_compile (method=0xb0083ab7370, opts=, flags=, parts=, aot_method_index=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini.c:3915
#20 0x0000000000000000 in ?? ()
[Inferior 1 (process 859720) detached]
1>/home/ubuntu/vikas/preview7/output/.dotnet/sdk/7.0.100-preview.7.22377.5/FSharp/Microsoft.FSharp.Targets(317,9): error MSB6006: "dotnet" exited with code 134. [/home/ubuntu/vikas/FSharp_Program/FSharp_Program.fsproj]

After commented this Assertion at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-ppc.c:3801, condition `cfg->frame_reg == ppc_sp'
get new crash

Thread 1 (Thread 0x7ed8adf65260 (LWP 862645)):
#0 0x00007ed8ad90f318 in __GI___wait4 (pid=, stat_loc=0x7ffff00c13c0, options=, usage=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:27
#1 0x00007ed8ad90f20c in __GI___waitpid (pid=, stat_loc=, options=) at waitpid.c:38
#2 0x00007ed8ad5b243c in dump_native_stacktrace (signal=, mctx=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-posix.c:843
#3 mono_dump_native_crash_info (signal=, mctx=0x7ffff00c1ed8, info=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-posix.c:870
#4 0x00007ed8ad56231c in mono_handle_native_crash (signal=0x7ed8ad693c57 "SIGSEGV", mctx=0x7ffff00c1ed8, info=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-exceptions.c:2997
#5 0x00007ed8ad4ac368 in mono_sigsegv_signal_handler_debug (_dummy=11, _info=0x7ffff00c2f18, context=0x7ffff00c21a0, debug_fault_addr=0x3842ee903c4c0031) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-runtime.c:3773
#6
#7 mono_class_get_method_generic (klass=0x3842ee903c4c0016, method=, error=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-generic-sharing.c:489
#8 0x00007ed8ad565494 in common_call_trampoline (regs=0x7ffff00c33f0, code=0x7ed8ac947464 "\260", m=0xf78d51366c0, vt=0x0, vtable_slot=0x0, error=0x7ffff00c3338) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-trampolines.c:597
#9 0x00007ed8ad565078 in mono_magic_trampoline (regs=0x7ffff00c33f0, code=0x7ed8ac947464 "\260", arg=, tramp=) at /root/vikas/Native_Build/runtime/src/mono/mono/mini/mini-trampolines.c:759
#10 0x00007ed8acc401c4 in ?? ()
#11 0x00007ed8ac947464 in ?? ()
[Inferior 1 (process 862645) detached]

=================================================================
Basic Fault Address Reporting

Memory around native instruction pointer (0x7ed8ad56ae7c):0x7ed8ad56ae6c 78 23 9c 7c 10 00 63 70 08 00 82 41 40 00 9d eb x#.|..cp...A@...
0x7ed8ad56ae7c 1b 00 7a 88 03 00 03 28 34 00 82 40 78 d3 43 7f ..z....(4..@x.C.
0x7ed8ad56ae8c 78 e3 84 7f 78 f3 c5 7f c5 68 d9 4b 00 00 00 60 x...x....h.K... 0x7ed8ad56ae9c 78 1b 79 7c 00 00 7e a0 00 00 60 3b 00 00 03 28 x.y|..~...;...(

=================================================================
Managed Stacktrace:

      at <unknown> <0xffffffff>							
      at UtilsStrings.SR:createMessageString <0x0015c>
      at System.Object:runtime_invoke_void <0x0010c>
      at <unknown> <0xffffffff>
      at System.Object:__icall_wrapper_mono_generic_class_init <0x000f0>
      at TcConfigBuilder:CreateNew <0x00dbc>
      at FSharp.Compiler.Driver:main1 <0x006a4>
      at FSharp.Compiler.Driver:CompileFromCommandLineArguments <0x001e8>
      at FSharp.Compiler.CommandLineMain:main <0x00700>
      at <Module>:runtime_invoke_int_object <0x00114>

=================================================================

Reproduction Steps

Steps to Reproduce:

dotnet new console -lang F# -o HelloWorld -f net7.0
dotnet run --verbosity n

Expected behavior

F# HelloWorld should work without any crash

Actual behavior

F# HelloWorld program is crashing

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

[vikasgupta8]

The function common_call_trampoline() has below condition to set klass varibale in file mini-trampolines.c

if (m->is_inflated && (mono_method_get_context (m)->method_inst || mini_method_is_default_method (m))) {
	MonoMethodRuntimeGenericContext *mrgctx = (MonoMethodRuntimeGenericContext*)mono_arch_find_static_call_vtable (regs, code);

	klass = mrgctx->class_vtable->klass;
	method_inst = mrgctx->method_inst;
} else if ((m->flags & METHOD_ATTRIBUTE_STATIC) || m_class_is_valuetype (m->klass)) {
	MonoMethodRuntimeGenericContext *mrgctx = (MonoMethodRuntimeGenericContext*)mono_arch_find_static_call_vtable (regs, code);

	klass = mrgctx->class_vtable->klass;
	method_inst = mrgctx->method_inst;
	/*
	MonoVTable *vtable = mono_arch_find_static_call_vtable (regs, code);

	klass = vtable->klass;
	*/
} else {
	MonoObject *this_argument = (MonoObject *)mono_arch_get_this_arg_from_call (regs, code);

	actual_vt  = this_argument->vtable;
	vtable_slot = orig_vtable_slot;

	g_assert (m_class_is_inited (this_argument->vtable->klass));

	if (!vtable_slot) {
		mono_class_setup_supertypes (this_argument->vtable->klass);
		klass = m_class_get_supertypes (this_argument->vtable->klass) [m_class_get_idepth (m->klass) - 1];
	}
}

The failure case goes into the first if block and gets the currupted "mrgctx" from mono_arch_find_static_call_vtable() function which returns the value at register r11.

The first if block gets control because the value of "m->is_inflated" is true and "mono_method_get_context (m)->method_inst" gets some value.

We need to identify where and why the value for register r11 is getting updated.

CC: @uweigand @janani66

[janani66]

@nealef --thanks for your feedback

...
In s390x IMT_REG and RGCTX_REG are the same. In gloal reg alloc routine we have:       
   top = 12;       
for (i = 8; i < top; ++i) {               
if ((cfg->frame_reg != i) &&                    //!((cfg->uses_rgctx_reg) && (i == MONO_ARCH_IMT_REG)))                   
(i != MONO_ARCH_IMT_REG))                       
regs = g_list_prepend (regs, GUINT_TO_POINTER (i));       
}

ppc doesn't appear to do so. What this means is s390x never allocates r9.
...

@uweigand appreciate your thoughts on whether we should be using a diff register than r11 for ppc64le

[uweigand]

@nealef , @janani66 having looked at this, I now think this isn't a problem - on s390x, we use a call-saved register (r9) as IMT reg, and therefore we need to take care to not use it for the global allocator. But ppc uses a call-clobbered register (r11), which is never used for the global allocator anyway. So this isn't the problem (unfortunately).

[Amit-Sirohi]

Backtrace at the time of crash in gdb
bt
#0 mono_class_get_method_generic (klass=0x3842ed903c4c0016, method=, error=)
at /root/amit-devel/dotnet-ppc64le-preview7/runtime/src/mono/mono/mini/mini-generic-sharing.c:489
#1 0x00007ffff75f558c in common_call_trampoline (regs=0x7fffffff5c80, code=0x7ffff4bf5c2c "\260", m=0x1004a52c0, vt=0x0, vtable_slot=0x0, error=0x7fffffff5bc8) at/root/amitdevel/dotnetppc64lepreview7/runtime/src/mono/mono/mini/mini-trampolines.c:599
#2 0x00007ffff75f5118 in mono_magic_trampoline (regs=0x7fffffff5c80, code=0x7ffff4bf5c2c "\260", arg=, tramp=)
at /root/amit-devel/dotnet-ppc64le-preview7/runtime/src/mono/mono/mini/mini-trampolines.c:761
#3 0x00007ffff6f401c4 in ?? () -------> UnboxGeneric
#4 0x00007ffff4bf5c2c in ?? () --------> createmessagestring

we have figure out from disassembly of createmessagestring that it is updating r11 register
0x00007ffff4bf5bc8: mr r6,r3
0x00007ffff4bf5bcc: ld r3,96(r1)
0x00007ffff4bf5bd0: ld r7,40(r3)
0x00007ffff4bf5bd4: mr r3,r29
0x00007ffff4bf5bd8: mr r4,r30
0x00007ffff4bf5bdc: ld r5,104(r1)
0x00007ffff4bf5be0: li r8,0
0x00007ffff4bf5be4: lis r12,0
0x00007ffff4bf5be8: ori r12,r12,0
0x00007ffff4bf5bec: rldicr r12,r12,32,31
0x00007ffff4bf5bf0: oris r12,r12,0
0x00007ffff4bf5bf4: ori r12,r12,0
0x00007ffff4bf5bf8: ld r12,0(r12)
0x00007ffff4bf5bfc: mtlr r12
0x00007ffff4bf5c00: blrl
0x00007ffff4bf5c04: ld r4,96(r1)
0x00007ffff4bf5c08: ld r11,32(r4)

(gdb) info register r1
r1 0x7fffffff5f40 140737488314176
(gdb) p/x 0x7fffffff5f40+96
$28 = 0x7fffffff5fa0

(gdb) x/xg 0x7fffffff5fa0
0x7fffffff5fa0: 0x00007fffffff60a0

(gdb) p/x 0x00007fffffff60a0+32
$33 = 0x7fffffff60c0

(gdb) x/xg 0x7fffffff60c0
0x7fffffff60c0: 0x00007ffff7797a00

(gdb) p (MonoMethodRuntimeGenericContext)0x00007ffff7797a00)
$34 = {class_vtable = 0x7ffff7628c70 <mini_llvmonly_init_vtable_slot>, method = 0x0, method_inst = 0x0,
entries = 0x7ffff7780880 <mono_icall_signatures+1936>, infos = 0x7ffff7797a20 <mono_jit_icall_info+5192>}
(gdb) p ((MonoMethodRuntimeGenericContext*)0x00007ffff7797a00)->class_vtable
$35 = {klass = 0x3842ed903c4c0016, gc_descr = 0xfb61ffd87c0802a6, domain = 0xfba1ffe8fb81ffe0, type = 0xf8010010fbc1fff0,
interface_bitmap = 0x3b600000f821ff61 <error: Cannot access memory at address 0x3b600000f821ff61>, max_interface_id = 952172576, rank = 40 '(',
initialized = 0 '\000', flags = 1 '\001', init_failed = 1, has_static_fields = 0, gc_bits = 14, imt_collisions_bitmap = 950009856,
runtime_generic_context = 0x7c7e1b787c9d2378, ee_data = 0xfb61002093610028, vtable = 0x7ffff7628cb8 <mini_llvmonly_init_vtable_slot+72>}

(gdb) p ((MonoMethodRuntimeGenericContext*)0x00007ffff7797a00)->class_vtable->klass
Cannot access memory at address 0x3842ed903c4c0016

we could see the corrupt value is coming from r1 itself.

[vikasgupta8]

We could see two corrupted functions in "Managed Stacktrace". This seems to me suspicious if the function calls are incorrect as r1 (stack pointer) changes between function calls.
It does seens that function "__icall_wrapper_mono_generic_class_init" is calling to an incorrect function somewhere.

Do let me know if my understanding is incorrect.

=================================================================
        Managed Stacktrace:
=================================================================
          at <unknown> <0xffffffff>					-> Corrupted function 1 (UnboxGeneric)
          at UtilsStrings.SR:createMessageString <0x0015c>			
          at System.Object:runtime_invoke_void <0x0010c>
          at <unknown> <0xffffffff>					-> Corrupted function 2 (???????)
          at System.Object:__icall_wrapper_mono_generic_class_init <0x000f0>
          at TcConfigBuilder:CreateNew <0x00dbc>
          at FSharp.Compiler.Driver:main1 <0x006a4>
          at FSharp.Compiler.Driver:CompileFromCommandLineArguments <0x001e8>
          at FSharp.Compiler.CommandLineMain:main <0x00700>
          at <Module>:runtime_invoke_int_object <0x00114>
=================================================================

CC: @uweigand @janani66

[janani66]

@uweigand - moving your feedback here . The team will try to implement the OP_GENERIC_CLASS_INIT for ppc64le

(uweigand) "Maybe this is related to the fact that in the ppc backend there is no implementation of OP_GENERIC_CLASS_INIT, so it falls back to common code. Now in principle this should also work, but no other platform uses the common code fallback any more, so maybe it doesn't always work correctly?

It probably cannot hurt to try providing an implementation of OP_GENERIC_CLASS_INIT and setting MONO_ARCH_HAVE_OP_GENERIC_CLASS_INIT to 1"

[crummel]

@KevinRansom any advice on this one? Not sure if the core problem is in runtime or F#.

[janani66]

@KevinRansom -- Is it possible to pass some flag to msbuild so that we can build the SDK without F# ?

[janani66]

@uweigand -- After implementing OP_GENERIC_CLASS_INIT, still seeing a crash in F#

(gdb) bt
#0 0x00007fff8a7e9628 in raise () from /lib64/glibc-hwcaps/power9/libc-2.28.so
#1 0x00007fff8a7c3eb4 in abort () from /lib64/glibc-hwcaps/power9/libc-2.28.so
#2 0x00007fff8a544f90 in mono_post_native_crash_handler (signal=, mctx=, info=, crash_chaining=)
at /root/dotnet-ppc64le-rc2/runtime/src/mono/mono/mini/mini-posix.c:882
#3 0x00007fff8a4f4bfc in mono_handle_native_crash (signal=0x7fff8a622a5f "SIGSEGV", mctx=0x7ffffc4ef5b8, info=0x7fff7ae57240)
at /root/dotnet-ppc64le-rc2/runtime/src/mono/mono/mini/mini-exceptions.c:3019
#4 0x00007fff8a43e2e8 in mono_sigsegv_signal_handler_debug (_dummy=11, _info=0x7ffffc4f05f8, context=0x7ffffc4ef880, debug_fault_addr=0x4182013c28030000)
at /root/dotnet-ppc64le-rc2/runtime/src/mono/mono/mini/mini-runtime.c:3773
#5
#6 0x00007fff8a4f7c9c in common_call_trampoline (regs=0x7ffffc4f0a60, code=0x7fff7ae57240 "\260", m=0x10031714660, vt=0x0, vtable_slot=0x0, error=0x7ffffc4f09a8)
at /root/dotnet-ppc64le-rc2/runtime/src/mono/mono/mini/mini-trampolines.c:539
#7 0x00007fff8a4f78b8 in mono_magic_trampoline (regs=0x7ffffc4f0a60, code=0x7fff7ae57240 "\260", arg=, tramp=)
at /root/dotnet-ppc64le-rc2/runtime/src/mono/mono/mini/mini-trampolines.c:759
#8 0x00007fff7d1801c4 in ?? ()
#9 0x00007fff7ae57240 in ?? ()
(gdb)

% cat generic_class_init.patch 
diff -u -r a/runtime/src/mono/mono/mini/cpu-ppc.mdesc b/runtime/src/mono/mono/mini/cpu-ppc.mdesc
--- a/runtime/src/mono/mono/mini/cpu-ppc.mdesc	2022-10-14 14:32:29.439210918 +0000
+++ b/runtime/src/mono/mono/mini/cpu-ppc.mdesc	2022-10-14 14:36:32.502579772 +0000
@@ -349,3 +349,4 @@
liverange_start: len:0
liverange_end: len:0
gc_safe_point: clob:c src1:i len:44
+generic_class_init: src1:b len:44 clob:c
diff -u -r a/runtime/src/mono/mono/mini/cpu-ppc64.mdesc b/runtime/src/mono/mono/mini/cpu-ppc64.mdesc
--- a/runtime/src/mono/mono/mini/cpu-ppc64.mdesc	2022-10-14 14:32:29.439210918 +0000
+++ b/runtime/src/mono/mono/mini/cpu-ppc64.mdesc	2022-10-14 14:28:55.932245963 +0000
@@ -418,3 +418,4 @@
liverange_start: len:0
liverange_end: len:0
gc_safe_point: clob:c src1:i len:44
+generic_class_init: src1:b len:44 clob:c
diff -u -r a/runtime/src/mono/mono/mini/mini-ppc.c b/runtime/src/mono/mono/mini/mini-ppc.c
--- a/runtime/src/mono/mono/mini/mini-ppc.c	2022-10-14 14:32:56.563588276 +0000
+++ b/runtime/src/mono/mono/mini/mini-ppc.c	2022-10-14 14:30:43.065739144 +0000
@@ -3798,7 +3798,7 @@
			if (call->stack_usage) {
				code = emit_memcpy (code, call->stack_usage, ppc_r12, PPC_STACK_PARAM_OFFSET, ppc_sp, PPC_STACK_PARAM_OFFSET);
				/* r12 was clobbered */
-				g_assert (cfg->frame_reg == ppc_sp);
+				/* g_assert (cfg->frame_reg == ppc_sp); */
				if (ppc_is_imm16 (cfg->stack_usage)) {
					ppc_addi (code, ppc_r12, cfg->frame_reg, cfg->stack_usage);
				} else {
@@ -4043,6 +4043,37 @@
		case OP_LABEL:
			ins->inst_c0 = code - cfg->native_code;
			break;
+		case OP_GENERIC_CLASS_INIT: {
+			static int byte_offset = -1;
+			static guint8 bitmask;
+			guint8 *br;
+
+			if (byte_offset < 0)
+				mono_marshal_find_bitfield_offset (MonoVTable, initialized, &byte_offset, &bitmask);
+
+			ppc_lbz (code, ppc_r0, byte_offset, ins->sreg1);
+			ppc_andid (code, ppc_r0, ppc_r0, bitmask);
+			br = code;
+			ppc_bc (code, PPC_BR_FALSE, PPC_BR_EQ, 0);
+			mono_add_patch_info (cfg, code - cfg->native_code, MONO_PATCH_INFO_JIT_ICALL_ID,
+			     GUINT_TO_POINTER (MONO_JIT_ICALL_mono_generic_class_init));
+			if ((FORCE_INDIR_CALL || cfg->method->dynamic) && !cfg->compile_aot) {
+				ppc_load_func (code, PPC_CALL_REG, 0);
+#if defined(TARGET_POWERPC64) && !defined(PPC_USES_FUNCTION_DESCRIPTOR)
+				ppc_ldr (code, PPC_CALL_REG, 0, PPC_CALL_REG);
+				cfg->thunk_area += THUNK_SIZE;
+#endif
+				ppc_mtlr (code, PPC_CALL_REG);
+				ppc_blrl (code);
+			} else {
+				ppc_bl (code, 0);
+			}
+			ppc_patch (br, code);
+
+			ins->flags |= MONO_INST_GC_CALLSITE;
+			ins->backend.pc_offset = code - cfg->native_code;
+			break;
+		}
		case OP_BR:
			/*if (ins->inst_target_bb->native_offset) {
				ppc_b (code, 0);
diff -u -r a/runtime/src/mono/mono/mini/mini-ppc.h b/runtime/src/mono/mono/mini/mini-ppc.h
--- a/runtime/src/mono/mono/mini/mini-ppc.h	2022-10-14 18:40:27.259521479 +0000
+++ b/runtime/src/mono/mono/mini/mini-ppc.h	2022-10-14 18:34:21.194384879 +0000
@@ -118,6 +118,7 @@
#define MONO_ARCH_EMULATE_LCONV_TO_R8_UN 1
#define MONO_ARCH_EMULATE_FREM 1
#define MONO_ARCH_GC_MAPS_SUPPORTED 1
+#define MONO_ARCH_HAVE_OP_GENERIC_CLASS_INIT 1

/* Parameters used by the register allocator */
#define MONO_ARCH_CALLEE_REGS ((0xff << ppc_r3) | (1 << ppc_r12) | (1 << ppc_r11))

[nealef]

@nealef , @janani66 having looked at this, I now think this isn't a problem - on s390x, we use a call-saved register (r9) as IMT reg, and therefore we need to take care to not use it for the global allocator. But ppc uses a call-clobbered register (r11), which is never used for the global allocator anyway. So this isn't the problem (unfortunately).

But ppc_r11 appears to be used a temporary register in the JIT. For example:

               case OP_STOREI1_MEMBASE_REG:
                        if (ppc_is_imm16 (ins->inst_offset)) {
                                ppc_stb (code, ins->sreg1, ins->inst_offset, ins->inst_destbasereg);
                        } else {
                                if (ppc_is_imm32 (ins->inst_offset)) {
                                        ppc_addis (code, ppc_r11, ins->inst_destbasereg, ppc_ha(ins->inst_offset));  <----
                                        ppc_stb (code, ins->sreg1, ins->inst_offset, ppc_r11);
                                } else {
                                        ppc_load (code, ppc_r0, ins->inst_offset);
                                        ppc_stbx (code, ins->sreg1, ins->inst_destbasereg, ppc_r0);
                                }
                        }