I get a crash running a powerpc64 TCG machine on x86.
It can be triggered by booting a custom vmlinux patched to use powerpc
prefix instructions and pcrel addressing, I don't know if that's related
or coincidence. I can give Linux patches or a vmlinux file to reproduce
if needed, or I can test patches quickly.
The first bad commit is 7058ff5231a0 ("target/ppc: Avoid tcg_const_* in
translate.c")
Some gdb stuff
0x00007ffff76d5395 in __assert_fail_base
(fmt=0x7ffff7849a70 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
assertion=assertion@entry=0x55555625a99c "!temp_readonly(ts)",
file=file@entry=0x555556256211 "../tcg/tcg.c", line=line@entry=4450,
function=function@entry=0x55555625b640 <__PRETTY_FUNCTION__.9>
"tcg_reg_alloc_op") at ./assert/assert.c:92
#5 0x00007ffff76e3df2 in __GI___assert_fail
(assertion=0x55555625a99c "!temp_readonly(ts)", file=0x555556256211
"../tcg/tcg.c", line=4450, function=0x55555625b640 <__PRETTY_FUNCTION__.9>
"tcg_reg_alloc_op") at ./assert/assert.c:101
#6 0x0000555555e078b9 in tcg_reg_alloc_op
(s=0x7ffd60000b70, op=0x7ffd600097f8) at ../tcg/tcg.c:4450
#7 0x0000555555e08e77 in tcg_gen_code
(s=0x7ffd60000b70, tb=0x7fffb07612c0, pc_start=13835058055286387916)
at ../tcg/tcg.c:5122
#8 0x0000555555e49a3f in setjmp_gen_code
(env=0x555556be9e30, tb=0x7fffb07612c0, pc=13835058055286387916,
host_pc=0x7ffd702074cc, max_insns=0x7ffff65076ac, ti=0x7ffff65076c8)
at ../accel/tcg/translate-all.c:297
#9 0x0000555555e49c67 in tb_gen_code
(cpu=0x555556be7a40, pc=13835058055286387916, cs_base=0, flags=3053453367,
cflags=-16777216) at ../accel/tcg/translate-all.c:365
#10 0x0000555555e40db4 in cpu_exec_loop (cpu=0x555556be7a40, sc=0x7ffff6507800)
at ../accel/tcg/cpu-exec.c:978
#11 0x0000555555e40f95 in cpu_exec_setjmp
(cpu=0x555556be7a40, sc=0x7ffff6507800) at ../accel/tcg/cpu-exec.c:1043
#12 0x0000555555e4101c in cpu_exec (cpu=0x555556be7a40)
at ../accel/tcg/cpu-exec.c:1069
(gdb) frame 6
#6 0x0000555555e078b9 in tcg_reg_alloc_op (s=0x7ffd60000b70,
op=0x7ffd600097f8) at ../tcg/tcg.c:4450
4450 tcg_debug_assert(!temp_readonly(ts));
(gdb) p *op
$1 = {opc = INDEX_op_divu2_i32, nargs = 5, param1 = 0, param2 = 0,
life = 464, link = {tqe_next = 0x7ffd60009840, tqe_circ = {
tql_next = 0x7ffd60009840, tql_prev = 0x7ffd60009770}}, output_pref = {
0, 4}, args = 0x7ffd60009818}
(gdb) print *def
$2 = {name = 0x55555625baf5 "divu2_i32", nb_oargs = 2 '\002',
nb_iargs = 3 '\003', nb_cargs = 0 '\000', nb_args = 5 '\005',
flags = 0 '\000', args_ct = 0x555556ba793c}
(gdb) p k
$3 = 1
(gdb) p *ts
$4 = {reg = TCG_REG_R12, val_type = TEMP_VAL_CONST, base_type = TCG_TYPE_I32,
type = TCG_TYPE_I32, kind = TEMP_CONST, indirect_reg = 0, indirect_base = 0,
mem_coherent = 0, mem_allocated = 0, temp_allocated = 1, temp_subindex = 0,
val = 0, mem_base = 0x0, mem_offset = 0, name = 0x0, state = 0,
state_ptr = 0x7ffd6000a9fc}
(gdb) p *arg_ct
$5 = {ct = 0, alias_index = 3, sort_index = 1, pair_index = 0, pair = 0,
oalias = true, ialias = false, newreg = false, regs = 4}
Thanks,
Nick
