bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[dsmich]

close 40737 v3.0.3

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[Ludovic Courtès]

Hi,

Ludovic Courtès  skribis:

> Andrew Gierth  skribis:
>
>> diff --git a/libguile/lightening/lightening/arm-cpu.c 
>> b/libguile/lightening/lightening/arm-cpu.c
>> index 4445266af..2b4eecc29 100644
>> --- a/libguile/lightening/lightening/arm-cpu.c
>> +++ b/libguile/lightening/lightening/arm-cpu.c
>> @@ -230,7 +230,7 @@ encode_thumb_immediate(unsigned int v)
>>  return ((v & 0xff) | (1 << 12));
>>/* abcdefgh  abcdefgh  */
>>if (((v & 0x) >> 16) == (v & 0x) && (v & 0xff) == 0)
>> -return ((v & 0x00ff) | (2 << 12));
>> +return (((v & 0xff00) >> 8) | (2 << 12));
>>/* abcdefgh abcdefgh abcdefgh abcdefgh */
>>if ( (v &0xff)== ((v & 0xff00) >>  8) &&
>> ((v &   0xff00) >> 8) == ((v &   0xff) >> 16) &&
>
> I pushed this fix to the lightening repo on your behalf:
>
>   
> https://gitlab.com/wingo/lightening/-/commit/1bb909a44d2303f88bb05125fc6742e97f80cd1d
>
> The CI jobs pass:
>
>   https://gitlab.com/wingo/lightening/-/pipelines/158337465
>
> I’ll try merging it into Guile, but do you have a test that reproduces
> the original bug, either at the Guile level or in C using the lightening
> API?  Perhaps the test that Dale posted yesterday at
> ?

Replying to myself after our discussion on IRC: I’ve merged the test you
provided, Dale (with the addition of enter/leave_jit_abi), and pushed.

  
https://gitlab.com/wingo/lightening/-/commit/24ef197b1269f8371b1f4a412caa6d2b99d66839

I’ll look into merging into Guile later today, and then I guess we can
close this bug.

Thank you!

Ludo’.

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[Ludovic Courtès]

Hi Andrew,

Andrew Gierth  skribis:

> diff --git a/libguile/lightening/lightening/arm-cpu.c 
> b/libguile/lightening/lightening/arm-cpu.c
> index 4445266af..2b4eecc29 100644
> --- a/libguile/lightening/lightening/arm-cpu.c
> +++ b/libguile/lightening/lightening/arm-cpu.c
> @@ -230,7 +230,7 @@ encode_thumb_immediate(unsigned int v)
>  return ((v & 0xff) | (1 << 12));
>/* abcdefgh  abcdefgh  */
>if (((v & 0x) >> 16) == (v & 0x) && (v & 0xff) == 0)
> -return ((v & 0x00ff) | (2 << 12));
> +return (((v & 0xff00) >> 8) | (2 << 12));
>/* abcdefgh abcdefgh abcdefgh abcdefgh */
>if ( (v &0xff)== ((v & 0xff00) >>  8) &&
> ((v &   0xff00) >> 8) == ((v &   0xff) >> 16) &&

I pushed this fix to the lightening repo on your behalf:

  
https://gitlab.com/wingo/lightening/-/commit/1bb909a44d2303f88bb05125fc6742e97f80cd1d

The CI jobs pass:

  https://gitlab.com/wingo/lightening/-/pipelines/158337465

I’ll try merging it into Guile, but do you have a test that reproduces
the original bug, either at the Guile level or in C using the lightening
API?  Perhaps the test that Dale posted yesterday at
?

--8<---cut here---start->8---
#include "test.h"   

static void 
run_test(jit_state_t *j, uint8_t *arena_base, size_t arena_size)
{   
  jit_begin(j, arena_base, arena_size); 

  jit_movi(j, JIT_R0, 0xa500a500);  
  jit_retr(j, JIT_R0);  

  jit_uword_t (*f)(void) = jit_end(j, NULL);

  ASSERT(f() == 0xa500a500);
}   

int 
main (int argc, char *argv[])   
{   
  return main_helper(argc, argv, run_test); 
}   
--8<---cut here---end--->8---

Thanks,
Ludo’.

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[dsmich]

Here is the start of a case to go in tests/movi.c:

#include "test.h"

// Should really test all of the cases seen in
// arm-cpu.c: encode_thumb_immediate()

/*    abcdefgh */
/*  abcdefgh  abcdefgh */
/* abcdefgh  abcdefgh  */
/* abcdefgh abcdefgh abcdefgh abcdefgh */
/* 1bcdefgh

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[Andrew Gierth]

Patch attached.

-- 
Andrew.

diff --git a/libguile/lightening/lightening/arm-cpu.c b/libguile/lightening/lightening/arm-cpu.c
index 4445266af..2b4eecc29 100644
--- a/libguile/lightening/lightening/arm-cpu.c
+++ b/libguile/lightening/lightening/arm-cpu.c
@@ -230,7 +230,7 @@ encode_thumb_immediate(unsigned int v)
 return ((v & 0xff) | (1 << 12));
   /* abcdefgh  abcdefgh  */
   if (((v & 0x) >> 16) == (v & 0x) && (v & 0xff) == 0)
-return ((v & 0x00ff) | (2 << 12));
+return (((v & 0xff00) >> 8) | (2 << 12));
   /* abcdefgh abcdefgh abcdefgh abcdefgh */
   if ( (v &0xff)== ((v & 0xff00) >>  8) &&
((v &   0xff00) >> 8) == ((v &   0xff) >> 16) &&

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[dsmich]

From: "Ludovic Courtès" 
> dsm...@roadrunner.com skribis:
 > > In the test-suite/standalone dir:
 > > while GUILE_JIT_THRESHOLD=0 make TESTS=test-language check-TESTS;
> 
> OK.
 > 
 > On IRC you mentioned that this does not happen with
GUILE_JIT_THRESHOLD=-1, right?
 >

That is correct.

-Dale

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[Ludovic Courtès]

Hi,

dsm...@roadrunner.com skribis:

> I'm still seeing segfaults on rasbian on an rpi3. Have not tried
> buildroot yet.
>
> That patch *did* fix a boatload of errors on arm, but this segfault is
> an unrelated problem I think. Only happens on arm though.
>
> Here is a way to reproduce:
>
> In the test-suite/standalone dir:
> while GUILE_JIT_THRESHOLD=0 make TESTS=test-language check-TESTS; do
> :;done
>
> And then:
> ../../meta/uninstalled-env ../../libtool --mode=execute gdb
> ../../libguile/guile core
>
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0 0x76f505cc in scm_is_string (x=0x0) at strings.h:293
> 293 return SCM_HAS_TYP7 (x, scm_tc7_string);
> [Current thread is 1 (Thread 0x76fe6010 (LWP 21616))]
> (gdb) bt
> #0 0x76f505cc in scm_is_string (x=0x0) at strings.h:293
> #1 scm_string_to_symbol (string=0x0) at symbols.c:361
> #2 0x722df4cc in ?? ()
> Backtrace stopped: previous frame identical to this frame (corrupt
> stack?)

OK.

On IRC you mentioned that this does not happen with
GUILE_JIT_THRESHOLD=-1, right?

Thanks,
Ludo’.

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[dsmich]

I'm still seeing segfaults on rasbian on an rpi3. Have not tried
buildroot yet.

That patch *did* fix a boatload of errors on arm, but this segfault is
an unrelated problem I think. Only happens on arm though.

Here is a way to reproduce:

In the test-suite/standalone dir:
while GUILE_JIT_THRESHOLD=0 make TESTS=test-language check-TESTS; do
:;done

And then:
../../meta/uninstalled-env ../../libtool --mode=execute gdb
../../libguile/guile core

Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x76f505cc in scm_is_string (x=0x0) at strings.h:293
293 return SCM_HAS_TYP7 (x, scm_tc7_string);
[Current thread is 1 (Thread 0x76fe6010 (LWP 21616))]
(gdb) bt
#0 0x76f505cc in scm_is_string (x=0x0) at strings.h:293
#1 scm_string_to_symbol (string=0x0) at symbols.c:361
#2 0x722df4cc in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt
stack?)

-From: "Ludovic Courtès" 
To: dsm...@roadrunner.com
Cc: 40...@debbugs.gnu.org
Sent: Wednesday June 17 2020 6:36:34PM
Subject: Re: bug#40737: Segfault in arm gcc7, thumb2 builroot, with
arm patch

Hi Dale,

 dsm...@roadrunner.com skribis:

 > Here is a backtrace of running guile on a builtroot constructed
 system
 > for rpi3.
 > Thumb2 instructions: BR2_ARM_INSTRUCTIONS_THUMB2=y
 > Gcc 7.5: BR2_GCC_VERSION="7.5.0"
 > Glibc.
 >
 > Uses the patch from
 >

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[Ludovic Courtès]

Hi Dale,

dsm...@roadrunner.com skribis:

> Here is a backtrace of running guile on a builtroot constructed system
> for rpi3.
> Thumb2 instructions: BR2_ARM_INSTRUCTIONS_THUMB2=y
> Gcc 7.5: BR2_GCC_VERSION="7.5.0"
> Glibc.
>
> Uses the patch from
> https://gitlab.com/wingo/lightening/-/merge_requests/3
>
> I hope this makes it through the mail client ok. 
>
> -Dale
>
> Core was generated by `guile'.
> Program terminated with signal SIGSEGV, Segmentation fault.

[...]

> #0 0x76ee6f12 in scm_is_pair (x=0x0) at pairs.h:182
> #1 scm_sloppy_assq (key=0x752076f0, alist=0x0) at alist.c:59
> #2 0x76effef8 in scm_hash_fn_ref (table=table@entry=0x751da8b0,
> obj=obj@entry=0x752076f0, dflt=dflt@entry=0x4,
> hash_fn=hash_fn@entry=0x76eff79d , assoc_fn=0x76ee6f0d ,
> closure=closure@entry=0x0) at hashtab.c:300
> #3 0x76efff5c in scm_hashq_ref (table=0x751da8b0,
> key=key@entry=0x752076f0, dflt=0x4, dflt@entry=0x904) at hashtab.c:426
> #4 0x76f11f74 in scm_module_variable (module=0x74f281e0,
> sym=0x752076f0) at modules.c:500
> #5 0x76f430c4 in vm_debug_engine (thread=0x76a46e00) at
> vm-engine.c:1560

Is this bug still present after the recent lightening merge in
3c3270491e78891e988af1b8007c6d8de9071a3c?

Thanks,
Ludo’.

bug#40737: Segfault in arm gcc7, thumb2 builroot, with arm patch

[dsmich]

Here is a backtrace of running guile on a builtroot constructed system
for rpi3.
Thumb2 instructions: BR2_ARM_INSTRUCTIONS_THUMB2=y
Gcc 7.5: BR2_GCC_VERSION="7.5.0"
Glibc.

Uses the patch from
https://gitlab.com/wingo/lightening/-/merge_requests/3

I hope this makes it through the mail client ok. 

-Dale

Core was generated by `guile'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x76ee6f12 in ?? ()
[Current thread is 1 (LWP 507)]
(gdb) thread apply all backtrace

Thread 5 (LWP 508):
#0 0x76e59674 in __libc_do_syscall () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#1 0x76e5499e in pthread_cond_wait@@GLIBC_2.4 () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#2 0x76e7d7aa in GC_wait_marker () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#3 0x76e7dab0 in GC_help_marker () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#4 0x76e7db26 in GC_mark_thread () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#5 0x76e4fbb0 in start_thread () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#6 0x76b450ec in ?? () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt
stack?)

Thread 4 (LWP 510):
#0 0x76e59674 in __libc_do_syscall () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#1 0x76e5499e in pthread_cond_wait@@GLIBC_2.4 () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#2 0x76e7d7aa in GC_wait_marker () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#3 0x76e7dab0 in GC_help_marker () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#4 0x76e7db26 in GC_mark_thread () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#5 0x76e4fbb0 in start_thread () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#6 0x76b450ec in ?? () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt
stack?)

Thread 3 (LWP 511):
#0 0x76e59674 in __libc_do_syscall () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#1 0x76e57720 in read () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/lib/libpthread.so.0
#2 0x76ef8aee in read_finalization_pipe_data (data=0x74c1f95c) at
finalizers.c:205
#3 0x76e7cea8 in GC_do_blocking_inner () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#4 0x76e7b068 in GC_with_callee_saves_pushed () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#5 0x76e7b094 in GC_do_blocking () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#6 0x76f3f10c in scm_without_guile (func=0x76ef8add , data=0x74c1f95c)
at threads.c:706
#7 0x76ef8d7a in finalization_thread_proc (unused=) at
finalizers.c:218
#8 0x76eef876 in c_body (d=0x74c1fe1c) at continuations.c:430
#9 0x76f4298e in vm_debug_engine (thread=0x76a46c00) at
vm-engine.c:972
#10 0x76f47b9c in scm_call_n (proc=0x7521dc70,
argv=argv@entry=0x74c1fbc0, nargs=nargs@entry=2) at vm.c:1608
#11 0x76ef22c4 in scm_call_2 (proc=, arg1=, arg2=) at eval.c:503
#12 0x76ef31a2 in scm_c_with_exception_handler (type=type@entry=0x404,
handler=0x76f3f9b9 , handler_data=handler_data@entry=0x74c1fda8, 
 thunk=0x76f3fa7d , thunk_data=thunk_data@entry=0x74c1fda8) at
exceptions.c:170
#13 0x76f3fbd4 in scm_c_catch (tag=tag@entry=0x404,
body=body@entry=0x76eef86d , body_data=body_data@entry=0x74c1fe1c, 
 handler=handler@entry=0x76eefa1d ,
handler_data=handler_data@entry=0x74c1fe1c, 
 pre_unwind_handler=pre_unwind_handler@entry=0x76eef8fb ,
pre_unwind_handler_data=pre_unwind_handler_data@entry=0x751fc300) at
throw.c:168
--Type  for more, q to quit, c to continue without paging--c
#14 0x76eefba2 in scm_i_with_continuation_barrier (body=0x76eef86d ,
body_data=body_data@entry=0x74c1fe1c, handler=0x76eefa1d ,
handler_data=handler_data@entry=0x74c1fe1c,
pre_unwind_handler=0x76eef8fb , pre_unwind_handler_data=0x751fc300) at
continuations.c:368
#15 0x76eefc06 in scm_c_with_continuation_barrier (func=, data=) at
continuations.c:464
#16 0x76f3edd4 in with_guile (base=0x74c1fe4c, data=0x74c1fe64) at
threads.c:645
#17 0x76e78e98 in GC_call_with_stack_base () from
/home/dales/br/rpi/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libgc.so.1
#18 0x76f3f0cc in scm_i_with_guile (dynamic_state=, data=, func=) at
threads.c:688
#19 scm_with_guile (func=, data=) at threads.c:694
#20 0x76e4fbb0 in start_thread () from