Segfault in feedback system

[GoogleCodeExporter]

A --with-pydebug build of Unladen trunk r940 segfaults when running 
`Lib/test/regrtest.py -R:: test_funcattrs`. This happens on 
both OS X (Apple gcc 4.0.1) and Ubuntu Hardy (gcc 4.2.4), though in slightly 
different places:

Backtrace from Hardy:

test_funcattrs
beginning 9 repetitions
123456789
.
Program received signal SIGSEGV, Segmentation fault.
0x0000000000a166ec in std::operator==<unsigned int, unsigned int> (__x=..., 
__y=...)
    at /usr/include/c++/4.2/bits/stl_pair.h:97
97      { return __x.first == __y.first && __x.second == __y.second; }
(gdb) bt
#0  0x0000000000a166ec in std::operator==<unsigned int, unsigned int> (__x=..., 
__y=...)
    at /usr/include/c++/4.2/bits/stl_pair.h:97
#1  0x0000000000a16737 in llvm::DenseMapInfo<std::pair<unsigned int, unsigned 
int> >::isEqual (
    LHS=..., RHS=...)
    at /usr/local/google/collinwinter/llvm-dbg/include/llvm/ADT/DenseMapInfo.h:129
#2  0x0000000000a16795 in llvm::DenseMapIterator<std::pair<unsigned int, 
unsigned int>, PyLimitedFeedback, 
llvm::DenseMapInfo<std::pair<unsigned int, unsigned int> >, 
llvm::DenseMapInfo<PyLimitedFeedback>, false>::AdvancePastEmptyBuckets 
(this=0x7fffffffbc20)
    at /usr/local/google/collinwinter/llvm-dbg/include/llvm/ADT/DenseMap.h:484
#3  0x0000000000a167f8 in DenseMapIterator (this=0x7fffffffbc20, 
Pos=0x72657469007373, 
    E=0x726583176ee093)
    at /usr/local/google/collinwinter/llvm-dbg/include/llvm/ADT/DenseMap.h:446
#4  0x0000000000a16831 in llvm::DenseMap<std::pair<unsigned int, unsigned int>, 
PyLimitedFeedback, 
llvm::DenseMapInfo<std::pair<unsigned int, unsigned int> >, 
llvm::DenseMapInfo<PyLimitedFeedback> >::begin (this=0x128ebc4)
    at /usr/local/google/collinwinter/llvm-dbg/include/llvm/ADT/DenseMap.h:76
#5  0x0000000000a1595f in PyFeedbackMap::Clear (this=0x128ebc4)
    at ../trunk-pristine/Util/RuntimeFeedback.cc:442
#6  0x0000000000a159bf in PyFeedbackMap_Clear (map=0x128ebc4)
    at ../trunk-pristine/Util/RuntimeFeedback.cc:418
#7  0x00007ffff5c523d9 in llvm_clear_feedback (self=0x0, obj=0x1fcd560)
    at /usr/local/google/collinwinter/us/trunk-pristine/Modules/_llvm.cc:111
(gdb) p __x
$6 = (
    const std::pair<unsigned int, unsigned int> &) @0x72657469007373: <error reading variable>
(gdb) p __y
$7 = (const std::pair<unsigned int, unsigned int> &) @0x7fffffffbb80: {first = 
4294967295, 
  second = 4294967295}
(gdb)

I'll append the OS X traceback in an update.

Original issue reported on code.google.com by collinw on 18 Dec 2009 at 12:05

[GoogleCodeExporter]

Traceback on OS X:

test_funcattrs
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
beginning 9 repetitions
123456789
Reading symbols for shared libraries ..... done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
.
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000024
0x009388be in llvm::DenseMap<std::pair<unsigned int, unsigned int>, 
PyLimitedFeedback, llvm::DenseMapInfo<std::pair<unsigned int, unsigned int> >, 
llvm::DenseMapInfo<PyLimitedFeedback> >::begin (this=0x20) at DenseMap.h:76
76       return iterator(Buckets, Buckets+NumBuckets);
(gdb) bt
#0  0x009388be in llvm::DenseMap<std::pair<unsigned int, unsigned int>, 
PyLimitedFeedback, llvm::DenseMapInfo<std::pair<unsigned int, unsigned int> >, 
llvm::DenseMapInfo<PyLimitedFeedback> >::begin (this=0x20) at DenseMap.h:76
#1  0x00937a1c in PyFeedbackMap::Clear (this=0x20) at 
../fast-calls/Util/RuntimeFeedback.cc:442
#2  0x00937a93 in PyFeedbackMap_Clear (map=0x20) at 
../fast-calls/Util/RuntimeFeedback.cc:418
#3  0x01b029e2 in llvm_clear_feedback (self=0x0, obj=0x1e28db8) at 
/Users/collinwinter/src/us/hg/fast-calls/Modules/_llvm.cc:111
(gdb) p Buckets
Cannot access memory at address 0x24
(gdb) p this
$1 = (llvm::DenseMap<std::pair<unsigned int, unsigned int>, PyLimitedFeedback, 
llvm::DenseMapInfo<std::pair<unsigned int, unsigned int> >, 
llvm::DenseMapInfo<PyLimitedFeedback> > * const) 0x20

Original comment by collinw on 18 Dec 2009 at 12:08

[GoogleCodeExporter]

Problem identified, patch sent for review 
(http://codereview.appspot.com/180083).

Original comment by collinw on 18 Dec 2009 at 1:12

• Changed state: Started

[GoogleCodeExporter]

Fixed in r941.

Original comment by collinw on 18 Dec 2009 at 1:35

• Changed state: Fixed