search

NickThePowerful / iphone-dev

Automatically exported from code.google.com/p/iphone-dev
0 stars 0 forks source link

Cross-compiled ruby has memory corruption issues #44

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Use iphone-dev to create a build environment
2. Use this build environment to cross-compile Ruby 1.8.6
3. Run any "big" ruby program (irb, test scripts, etc)
4. Watch it crash

What is the expected output? What do you see instead?

Expected the scripts to execute normally, instead, I see a variety of
memory corruption related crashes.

What version of the product are you using? On what operating system?

# svn update

Fetching external item into 'llvm-gcc-4.0'
External at revision 41997.

Fetching external item into 'llvm-gcc-4.2'
External at revision 41997.

At revision 171.
metasploitmac:/Users/hdm/dev/iphone-dev root# svn update

Fetching external item into 'llvm-gcc-4.0'
External at revision 42002.

Fetching external item into 'llvm-gcc-4.2'
External at revision 42002.

At revision 171.

PowerPC / Mac OS X / 10.4

Please provide any additional information below.

 # weasel bin/ruby -e 'require "socket"; load "bin/irb";'
Read 21 symbols.
Starting process...
Process with PID 116 started...
[$2fe0100c weasel] c
Continuing.
Listening for exceptions.
/usr/local/ruby/lib/ruby/1.8/irb/extend-command.rb:264: [BUG] terminated
node (0x1133c)
ruby 1.8.6 (2007-09-12) [arm-darwin]
Inferior exited with signal 6.

(Line 264 is the end of file for this loaded script).

Similar bugs appear for all scripts that do more than print hello world. My
guess is something is being assembled incorrectly. Nate True's Ruby build
is equally broken right now.

Cross-building ruby can be painful, if you need the config.status or
configure lines, let me know.

Original issue reported on code.google.com by x...@hdm.io on 16 Sep 2007 at 5:32

GoogleCodeExporter commented 9 years ago 
Rebuilding a version of ruby which does not exit when internal object state is 
wrong
-- this should help me nail down whether this is a corruption issue or just
mis-interpreter instructions somewhere. Sounds like issue #43 may be related, 
so this
build is also specifying -O0.

Original comment by x...@hdm.io on 16 Sep 2007 at 5:39

GoogleCodeExporter commented 9 years ago 
Removing the call to abort() in rb_bug still doesnt lead to a process crash, 
just a
ton of internal errors from the ruby interpreter. This is with -O0

/usr/local/ruby/lib/ruby/1.8/irb/extend-command.rb:264: [BUG] terminated node 
(0x12228)
/usr/local/ruby/lib/ruby/1.8/irb/extend-command.rb:264: [BUG] not a node 0x00 
(0x12228)
/usr/local/ruby/lib/ruby/1.8/irb/extend-command.rb:264: [BUG] unknown node type 
0
(0x12228)
/usr/local/ruby/lib/ruby/1.8/irb/extend-command.rb:264: tried to create Proc 
object
without a block (ArgumentError)

Original comment by x...@hdm.io on 16 Sep 2007 at 5:44

GoogleCodeExporter commented 9 years ago 
Removed ruby's own segv handler, ran it with weasel, after setting -O0, forcing 
the
build includes first, etc. Same problem occurs with the macports arm-darwin 
package,
so maybe its llvm?

# weasel ./bin/ruby -e "load 'bin/irb'"
Read 10717 symbols.
Starting process...
Process with PID 225 started...
[$2fe0100c weasel] c
Continuing.
Listening for exceptions.
Exceptional event received.
Inferior received exception 1, 2ffff6cc.
[$00000000 weasel] r
R        0        1        2        3        4        5        6        7
= 0017000c 00000001 00000002 00000002 00000000 00000000 000dc034 00000000
R        8        9       10       11       12       13       14       15
= 2ffffca0 3800da94 00000000 00000000 0000000c 2fffd444 00022074 00000000
[$00000000 weasel] help
Available weasel commands:
    b set a breakpoint at the given address
    c continue execution
    d disassemble starting at the given address
         (if no address given, continues from last point)
    n print the symbol table of the main image
    p peek at memory starting at the given address
    q quit weasel and inferior
    r print the current values of the CPU registers
    x delete the breakpoint with the given number
[$00000000 weasel] d
Failed to unprotect memory: 2.
[$00000000 weasel] d 2ffff6cc
2ffff6cc 00000001       andeq   r0, r0, r1
2ffff6d0 00000b91       muleq   r0, r1, r11
2ffff6d4 00000b91       muleq   r0, r1, r11
2ffff6d8 0016c72c       andeqs  r12, r6, r12, lsr #14
2ffff6dc 2ffffa30       swics   0xfffa30
2ffff6e0 00000000       andeq   r0, r0, r0
2ffff6e4 00000000       andeq   r0, r0, r0
2ffff6e8 00000000       andeq   r0, r0, r0
2ffff6ec 00000000       andeq   r0, r0, r0
2ffff6f0 000000a1       andeq   r0, r0, r1, lsr #1
2ffff6f4 2ffff708       swics   0xfff708
2ffff6f8 00000000       andeq   r0, r0, r0
2ffff6fc 2ffff7e4       swics   0xfff7e4
2ffff700 2ffff720       swics   0xfff720
2ffff704 0000306c       andeq   r3, r0, r12, rrx
2ffff708 0016c6a0       andeqs  r12, r6, r0, lsr #13
2ffff70c ffffffff       swinv?  0xffffff
2ffff710 00000000       andeq   r0, r0, r0
2ffff714 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff718 00000001       andeq   r0, r0, r1
2ffff71c 00000000       andeq   r0, r0, r0
2ffff720 00000000       andeq   r0, r0, r0
[$00000000 weasel] d 2ffff6c8
2ffff6c8 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff6cc 00000001       andeq   r0, r0, r1
2ffff6d0 00000b91       muleq   r0, r1, r11
2ffff6d4 00000b91       muleq   r0, r1, r11
2ffff6d8 0016c72c       andeqs  r12, r6, r12, lsr #14
2ffff6dc 2ffffa30       swics   0xfffa30
2ffff6e0 00000000       andeq   r0, r0, r0
2ffff6e4 00000000       andeq   r0, r0, r0
2ffff6e8 00000000       andeq   r0, r0, r0
2ffff6ec 00000000       andeq   r0, r0, r0
2ffff6f0 000000a1       andeq   r0, r0, r1, lsr #1
2ffff6f4 2ffff708       swics   0xfff708
2ffff6f8 00000000       andeq   r0, r0, r0
2ffff6fc 2ffff7e4       swics   0xfff7e4
2ffff700 2ffff720       swics   0xfff720
2ffff704 0000306c       andeq   r3, r0, r12, rrx
2ffff708 0016c6a0       andeqs  r12, r6, r0, lsr #13
2ffff70c ffffffff       swinv?  0xffffff
2ffff710 00000000       andeq   r0, r0, r0
2ffff714 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff718 00000001       andeq   r0, r0, r1
2ffff71c 00000000       andeq   r0, r0, r0
[$00000000 weasel] d pc
2ffff720 00000000       andeq   r0, r0, r0
2ffff724 2ffffbac       swics   0xfffbac
2ffff728 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff72c 00000002       andeq   r0, r0, r2
2ffff730 0016c6b4       andeqs  r12, r6, r4, lsr r6
2ffff734 00000000       andeq   r0, r0, r0
2ffff738 00000000       andeq   r0, r0, r0
2ffff73c 2ffff55c       swics   0xfff55c
2ffff740 00000001       andeq   r0, r0, r1
2ffff744 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff748 0016c72c       andeqs  r12, r6, r12, lsr #14
2ffff74c 2ffffb2c       swics   0xfffb2c
2ffff750 2ffff7b0       swics   0xfff7b0
2ffff754 0000e8e0       andeq   lr, r0, r0, ror #17
2ffff758 00000001       andeq   r0, r0, r1
2ffff75c 2ffffb2c       swics   0xfffb2c
2ffff760 0016c6b4       andeqs  r12, r6, r4, lsr r6
2ffff764 00000002       andeq   r0, r0, r2
2ffff768 00000000       andeq   r0, r0, r0
2ffff76c 000d2998       muleq   sp, r8, r9
2ffff770 00000b91       muleq   r0, r1, r11
2ffff774 00000002       andeq   r0, r0, r2
[$00000000 weasel] d pc-4
2ffff778 0016c6b4       andeqs  r12, r6, r4, lsr r6
2ffff77c 00000000       andeq   r0, r0, r0
2ffff780 2ffff7b8       swics   0xfff7b8
2ffff784 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff788 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff78c 00000006       andeq   r0, r0, r6
2ffff790 00000001       andeq   r0, r0, r1
2ffff794 2ffffb2c       swics   0xfffb2c
2ffff798 00000001       andeq   r0, r0, r1
2ffff79c 00000b91       muleq   r0, r1, r11
2ffff7a0 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff7a4 0016c72c       andeqs  r12, r6, r12, lsr #14
2ffff7a8 000d94ec       andeq   r9, sp, r12, ror #9
2ffff7ac 00000000       andeq   r0, r0, r0
2ffff7b0 2ffff7dc       swics   0xfff7dc
2ffff7b4 0000b76c       andeq   r11, r0, r12, ror #14
2ffff7b8 2ffffb2c       swics   0xfffb2c
2ffff7bc 00000001       andeq   r0, r0, r1
2ffff7c0 00000006       andeq   r0, r0, r6
2ffff7c4 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff7c8 0015f914       andeqs  pc, r5, r4, lsl r9
2ffff7cc 2ffffb2c       swics   0xfffb2c

Original comment by x...@hdm.io on 16 Sep 2007 at 9:15

GoogleCodeExporter commented 9 years ago 
Please try to compile 'native' version of Ruby with TOT llvm-gcc (doesn't 
matter,
where - on MacOS or Linux). If it will be broken - please fill LLVM's PR.

Ruby was broken with LLVM before 2.1 release due to completely insane code 
inside
(inside Ruby interpreter), however, that problem was fixed, maybe there is 
something
else remaining.

Original comment by korobeyn...@gmail.com on 10 Oct 2007 at 1:10

GoogleCodeExporter commented 9 years ago 
This was not a bug in the toolchain, this was a bug in Ruby's garbage 
collection 
routines. They assume that alloca() returns memory that is aligned to a word 
boundary, when the alloca() on this platform returns unaligned memory. You can 
find 
a patch here: http://svn.telesphoreo.org/trunk/data/ruby/stackend.diff . If you 
install Ruby from Telesphoreo it at least pretty much works. ;P

Original comment by saurik on 11 Mar 2008 at 9:02