search

krfkeith / sx-gcc

Automatically exported from code.google.com/p/sx-gcc
0 stars 0 forks source link

memory corruption on 64-bit hosts #107

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
compiling

gcc.dg/pr19402-2.c

with 

-fno-inline -Os -fno-show-column -msoft-float -msx6  -lm

results in gcc crashing:

*** glibc detected *** /home/fred/tmp/sx/sx-build/gcc/cc1: free(): invalid
next size (fast): 0x0000000001d48430 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3911278228]
/lib64/libc.so.6(cfree+0x76)[0x391127a866]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x4e2836]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x4e2f25]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x4dfeb7]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x546e79]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x548eb7]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x5fae0c]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x545aa6]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x548fd4]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x5f6599]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x623c80]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x620af4]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x620c60]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x469da2]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x40b6e0]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x64c529]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x64cf84]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x40f552]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x601888]
/lib64/libc.so.6(__libc_start_main+0xfa)[0x391121e32a]
/home/fred/tmp/sx/sx-build/gcc/cc1(calloc+0x1a1)[0x402489]
======= Memory map: ========
00400000-007d4000 r-xp 00000000 09:03 5301283                           
/home/fred/tmp/sx/sx-build/gcc/cc1
009d3000-009db000 rw-p 003d3000 09:03 5301283                           
/home/fred/tmp/sx/sx-build/gcc/cc1
009db000-00a21000 rw-p 009db000 00:00 0 
01d20000-01d7f000 rw-p 01d20000 00:00 0                                  [heap]
3910e00000-3910e1d000 r-xp 00000000 09:01 771712                        
/lib64/ld-2.8.so
391101c000-391101d000 r--p 0001c000 09:01 771712                        
/lib64/ld-2.8.so
391101d000-391101e000 rw-p 0001d000 09:01 771712                        
/lib64/ld-2.8.so
3911200000-3911362000 r-xp 00000000 09:01 771713                        
/lib64/libc-2.8.so
3911362000-3911562000 ---p 00162000 09:01 771713                        
/lib64/libc-2.8.so
3911562000-3911566000 r--p 00162000 09:01 771713                        
/lib64/libc-2.8.so
3911566000-3911567000 rw-p 00166000 09:01 771713                        
/lib64/libc-2.8.so
3911567000-391156c000 rw-p 3911567000 00:00 0 
3917600000-3917616000 r-xp 00000000 09:01 771735                        
/lib64/libgcc_s-4.3.0-20080428.so.1
3917616000-3917815000 ---p 00016000 09:01 771735                        
/lib64/libgcc_s-4.3.0-20080428.so.1
3917815000-3917816000 rw-p 00015000 09:01 771735                        
/lib64/libgcc_s-4.3.0-20080428.so.1
7fecf4000000-7fecf4021000 rw-p 7fecf4000000 00:00 0 
7fecf4021000-7fecf8000000 ---p 7fecf4021000 00:00 0 
7fecf9278000-7fecf94ce000 rw-p 7fecf9278000 00:00 0 
7fecf94ce000-7fecf94d1000 rw-p 7fecf94ce000 00:00 0 
7fff014ba000-7fff014d1000 rw-p 7ffffffe8000 00:00 0                     
[stack]
7fff015fd000-7fff015fe000 r-xp 7fff015fd000 00:00 0                      [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                 
[vsyscall]
/home/fred/tmp/sx/src/sx-gcc/gcc/testsuite/gcc.dg/pr19402-2.c: In function
'powicl':
/home/fred/tmp/sx/src/sx-gcc/gcc/testsuite/gcc.dg/pr19402-2.c:51: internal
compiler error: Aborted
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.
compiler exited with status 1
output is:
*** glibc detected *** /home/fred/tmp/sx/sx-build/gcc/cc1: free(): invalid
next size (fast): 0x0000000001d48430 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3911278228]
/lib64/libc.so.6(cfree+0x76)[0x391127a866]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x4e2836]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x4e2f25]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x4dfeb7]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x546e79]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x548eb7]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x5fae0c]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x545aa6]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x548fd4]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x5f6599]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x623c80]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x620af4]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x620c60]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x469da2]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x40b6e0]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x64c529]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x64cf84]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x40f552]
/home/fred/tmp/sx/sx-build/gcc/cc1[0x601888]
/lib64/libc.so.6(__libc_start_main+0xfa)[0x391121e32a]
/home/fred/tmp/sx/sx-build/gcc/cc1(calloc+0x1a1)[0x402489]
======= Memory map: ========
00400000-007d4000 r-xp 00000000 09:03 5301283                           
/home/fred/tmp/sx/sx-build/gcc/cc1
009d3000-009db000 rw-p 003d3000 09:03 5301283                           
/home/fred/tmp/sx/sx-build/gcc/cc1
009db000-00a21000 rw-p 009db000 00:00 0 
01d20000-01d7f000 rw-p 01d20000 00:00 0                                  [heap]
3910e00000-3910e1d000 r-xp 00000000 09:01 771712                        
/lib64/ld-2.8.so
391101c000-391101d000 r--p 0001c000 09:01 771712                        
/lib64/ld-2.8.so
391101d000-391101e000 rw-p 0001d000 09:01 771712                        
/lib64/ld-2.8.so
3911200000-3911362000 r-xp 00000000 09:01 771713                        
/lib64/libc-2.8.so
3911362000-3911562000 ---p 00162000 09:01 771713                        
/lib64/libc-2.8.so
3911562000-3911566000 r--p 00162000 09:01 771713                        
/lib64/libc-2.8.so
3911566000-3911567000 rw-p 00166000 09:01 771713                        
/lib64/libc-2.8.so
3911567000-391156c000 rw-p 3911567000 00:00 0 
3917600000-3917616000 r-xp 00000000 09:01 771735                        
/lib64/libgcc_s-4.3.0-20080428.so.1
3917616000-3917815000 ---p 00016000 09:01 771735                        
/lib64/libgcc_s-4.3.0-20080428.so.1
3917815000-3917816000 rw-p 00015000 09:01 771735                        
/lib64/libgcc_s-4.3.0-20080428.so.1
7fecf4000000-7fecf4021000 rw-p 7fecf4000000 00:00 0 
7fecf4021000-7fecf8000000 ---p 7fecf4021000 00:00 0 
7fecf9278000-7fecf94ce000 rw-p 7fecf9278000 00:00 0 
7fecf94ce000-7fecf94d1000 rw-p 7fecf94ce000 00:00 0 
7fff014ba000-7fff014d1000 rw-p 7ffffffe8000 00:00 0                     
[stack]
7fff015fd000-7fff015fe000 r-xp 7fff015fd000 00:00 0                      [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                 
[vsyscall]
/home/fred/tmp/sx/src/sx-gcc/gcc/testsuite/gcc.dg/pr19402-2.c: In function
'powicl':
/home/fred/tmp/sx/src/sx-gcc/gcc/testsuite/gcc.dg/pr19402-2.c:51: internal
compiler error: Aborted
Please submit a full bug report,
with preprocessed source if appropriate.
See <URL:http://gcc.gnu.org/bugs.html> for instructions.

the issue only occurs on x86_64 host (not x86), so probably a
64-bit-cleanliness issue ...

Original issue reported on code.google.com by jmoc...@gmail.com on 10 Feb 2009 at 10:52

GoogleCodeExporter commented 9 years ago 
sigh ... seems we're thrashing memory quite happily. valgrinding gcc obscures 
the
problem (i.e. gcc doesn't crash), but one of these reported errors (one of the
invalid writes to be precise) probably causes the crash:

Compiler executable checksum: 238504851d240ad16a5b51495855d9c8
==9422== Invalid read of size 1
==9422==    at 0x52DBAB: emit_library_call_value_1 (calls.c:3676)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x6AB8DA: expand_expr (expr.h:492)
==9422==    by 0x6AC141: expand_expr_stmt (stmt.c:1363)
==9422==  Address 0x5240808 is 0 bytes after a block of size 16 alloc'd
==9422==    at 0x4C2291E: malloc (vg_replace_malloc.c:207)
==9422==    by 0x817A9B: xmalloc (xmalloc.c:147)
==9422==    by 0x52D911: emit_library_call_value_1 (calls.c:3586)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422== 
==9422== Invalid write of size 1
==9422==    at 0x52DFBE: emit_library_call_value_1 (calls.c:3722)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x6AB8DA: expand_expr (expr.h:492)
==9422==    by 0x6AC141: expand_expr_stmt (stmt.c:1363)
==9422==  Address 0x5240808 is 0 bytes after a block of size 16 alloc'd
==9422==    at 0x4C2291E: malloc (vg_replace_malloc.c:207)
==9422==    by 0x817A9B: xmalloc (xmalloc.c:147)
==9422==    by 0x52D911: emit_library_call_value_1 (calls.c:3586)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
--9422-- REDIR: 0x4ea1110 (strnlen) redirected to 0x4c23040 (strnlen)
==9422== 
==9422== ERROR SUMMARY: 48 errors from 2 contexts (suppressed: 8 from 1)
==9422== 
==9422== 24 errors in context 1 of 2:
==9422== Invalid write of size 1
==9422==    at 0x52DFBE: emit_library_call_value_1 (calls.c:3722)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x6AB8DA: expand_expr (expr.h:492)
==9422==    by 0x6AC141: expand_expr_stmt (stmt.c:1363)
==9422==  Address 0x5240808 is 0 bytes after a block of size 16 alloc'd
==9422==    at 0x4C2291E: malloc (vg_replace_malloc.c:207)
==9422==    by 0x817A9B: xmalloc (xmalloc.c:147)
==9422==    by 0x52D911: emit_library_call_value_1 (calls.c:3586)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422== 
==9422== 24 errors in context 2 of 2:
==9422== Invalid read of size 1
==9422==    at 0x52DBAB: emit_library_call_value_1 (calls.c:3676)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x6AB8DA: expand_expr (expr.h:492)
==9422==    by 0x6AC141: expand_expr_stmt (stmt.c:1363)
==9422==  Address 0x5240808 is 0 bytes after a block of size 16 alloc'd
==9422==    at 0x4C2291E: malloc (vg_replace_malloc.c:207)
==9422==    by 0x817A9B: xmalloc (xmalloc.c:147)
==9422==    by 0x52D911: emit_library_call_value_1 (calls.c:3586)
==9422==    by 0x52EC07: emit_library_call_value (calls.c:4011)
==9422==    by 0x515AAC: expand_builtin_powi (builtins.c:2630)
==9422==    by 0x51AD91: expand_builtin (builtins.c:5769)
==9422==    by 0x5BC493: expand_expr_real_1 (expr.c:7731)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)
==9422==    by 0x5B3DB9: store_expr (expr.c:4384)
==9422==    by 0x5B3869: expand_assignment (expr.c:4263)
==9422==    by 0x5BF6AD: expand_expr_real_1 (expr.c:8667)
==9422==    by 0x5B947C: expand_expr_real (expr.c:6763)

Original comment by jmoc...@gmail.com on 10 Feb 2009 at 2:17

GoogleCodeExporter commented 9 years ago 
the problem appears only with long doubles ...

Original comment by jmoc...@gmail.com on 10 Feb 2009 at 2:53

GoogleCodeExporter commented 9 years ago 
the problem does not appear only with long doubles and not only on 64-bit hosts.

it is due to a buffer overflow in calls.c:emit_library_call_value_1(). upper 
bound
for indexing a buffer is calculated incorrectly due to using offset instead of
slot_offset of args.

writes past the end of the buffer occur regulary, but only manage to crash the
compiler in the case described above.

tentative fix (to calls.c) was sent to gcc mailing list and is included in r225.

Original comment by jmoc...@gmail.com on 10 Feb 2009 at 5:13

GoogleCodeExporter commented 9 years ago

Original comment by jmoc...@gmail.com on 13 Feb 2009 at 9:22

GoogleCodeExporter commented 9 years ago 
Issue 43 has been merged into this issue.

Original comment by jmoc...@gmail.com on 6 Mar 2009 at 12:22