[Bug ada/25819] New: CXF3A01 core dump

[Bug ada/25819] New: CXF3A01 core dump

[danglin at gcc dot gnu dot org]

-bash-2.05b$ cd tests/cxf/cxf3a01
-bash-2.05b$ less *.log

,.,. CXF3A01 ACATS 2.5 06-01-17 04:01:09
---- CXF3A01 Check that the Valid function from package
                Ada.Text_IO.Editing returns False for strings that fail
                to comply with the composition constraints defined for
                picture strings. Check that the Valid function returns
                True for strings that conform to the composition
                constraints defined for picture strings.
/test/gnu/gcc-4.0/gcc/gcc/testsuite/ada/acats/run_all.sh: 25833 Illegal
instruct
ion(coredump)

-bash-2.05b$ gdb -c run/core tests/cxf/cxf3a01/cxf3a01
GNU gdb 6.4.50.20051230-cvs
Copyright (C) 2005 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "hppa2.0w-hp-hpux11.11"...
Core was generated by `cxf3a01'.
Program terminated with signal 4, Illegal instruction.

warning: The shared libraries were not privately mapped; setting a
breakpoint in a shared library will not work until you rerun the program.

Reading symbols from /usr/lib/libc.2...done.
Loaded symbols for /usr/lib/libc.2
Reading symbols from /usr/lib/libdld.2...done.
Loaded symbols for /usr/lib/libdld.2
Reading symbols from /opt/graphics/OpenGL/lib/libogltls.sl...done.
Loaded symbols for /opt/graphics/OpenGL/lib/libogltls.sl
#0  0xc0197d50 in _sigfillset () from /usr/lib/libc.2
(gdb) bt
#0  0xc0197d50 in _sigfillset () from /usr/lib/libc.2
#1  0xc019584c in _sscanf () from /usr/lib/libc.2
#2  0xc019b01c in malloc () from /usr/lib/libc.2
#3  0xc019b01c in malloc () from /usr/lib/libc.2
Previous frame identical to this frame (corrupt stack?)
(gdb) disass 0xc0197d30 0xc0197d70
Dump of assembler code from 0xc0197d30 to 0xc0197d70:
0xc0197d30 <_sigfillset+1904>:  ldi 2,r26
0xc0197d34 <_sigfillset+1908>:  ldw -20(sp),r19
0xc0197d38 <_sigfillset+1912>:  movb,tr r0,ret0,0xc0198154 <_sigfillset+2964>
0xc0197d3c <_sigfillset+1916>:  ldw -114(sp),rp
0xc0197d40 <_sigfillset+1920>:  cmpb,>>,n r9,r23,0xc0197d54 <_sigfillset+1940>
0xc0197d44 <_sigfillset+1924>:  ldo 0(r31),r8
0xc0197d48 <_sigfillset+1928>:  ldw 4(r8),r31
0xc0197d4c <_sigfillset+1932>:  cmpb,<>,n r0,r31,0xc0197d40 <_sigfillset+1920>
0xc0197d50 <_sigfillset+1936>:  ldw c(r31),r23
0xc0197d54 <_sigfillset+1940>:  ldw c(r8),r26
0xc0197d58 <_sigfillset+1944>:  cmpb,<<,n r26,r9,0xc0197d94 <_sigfillset+2004>
0xc0197d5c <_sigfillset+1948>:  b,l 0xc0197e78 <_sigfillset+2232>,r0
0xc0197d60 <_sigfillset+1952>:  ldw 10(r8),r7
0xc0197d64 <_sigfillset+1956>:  ldw 60(r5),r22
0xc0197d68 <_sigfillset+1960>:  ldo 8(r7),r25
0xc0197d6c <_sigfillset+1964>:  ldw 54(r5),r20
End of assembler dump.
(gdb) p/x $r31
$1 = 0x28

The faulting instruction attempted a load from page 0 causing
the core dump.

The core dump causes the testsuite for ada to terminate:

Running chapter cxf ...
make[1]: *** [check-gnat] Error 132


-- 
           Summary: CXF3A01 core dump
           Product: gcc
           Version: 4.0.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ada
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: danglin at gcc dot gnu dot org
 GCC build triplet: hppa2.0w-hp-hpux11.11
  GCC host triplet: hppa2.0w-hp-hpux11.11
GCC target triplet: hppa2.0w-hp-hpux11.11


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[dave at hiauly1 dot hia dot nrc dot ca]

------- Comment #1 from dave at hiauly1 dot hia dot nrc dot ca  2006-01-18 00:52 -------
Subject: Re:   New: CXF3A01 core dump

cxf3a02 also fails at the same place:

Core was generated by `cxf3a02'.
Program terminated with signal 4, Illegal instruction.

warning: The shared libraries were not privately mapped; setting a
breakpoint in a shared library will not work until you rerun the program.

Reading symbols from /usr/lib/libc.2...done.
Loaded symbols for /usr/lib/libc.2
Reading symbols from /usr/lib/libdld.2...done.
Loaded symbols for /usr/lib/libdld.2
Reading symbols from /opt/graphics/OpenGL/lib/libogltls.sl...done.
Loaded symbols for /opt/graphics/OpenGL/lib/libogltls.sl
#0  0xc0197d50 in _sigfillset () from /usr/lib/libc.2
(gdb) bt
#0  0xc0197d50 in _sigfillset () from /usr/lib/libc.2
#1  0xc019584c in _sscanf () from /usr/lib/libc.2
#2  0xc019b01c in malloc () from /usr/lib/libc.2

Dave


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[danglin at gcc dot gnu dot org]

------- Comment #2 from danglin at gcc dot gnu dot org  2007-01-10 00:44 -------
Still see this in 4.0.4.  Gdb is now working somewhat better.  Here's
a better backtrace:

Program received signal SIGSEGV, Segmentation fault.
_Unwind_SjLj_RaiseException (exc=0x40012808) at ../../gcc/gcc/unwind-sjlj.c:255
255           fs->personality = context->fc->personality;
(gdb) bt
#0  _Unwind_SjLj_RaiseException (exc=0x40012808)
    at ../../gcc/gcc/unwind-sjlj.c:255
#1  0x0003a378 in __gnat_Unwind_RaiseException (e=0x4) at raise.c:1100
#2  0x00013788 in ada.exceptions.exception_propagation.propagate_exception (
    from_signal_handler=4) at a-exexpr.adb:579
#3  0x00014708 in ada.exceptions.process_raise_exception (e=0x4,
    from_signal_handler=false) at a-except.adb:813
#4  0x000147d0 in <__gnat_raise_nodefer_with_msg> (e=0x4) at a-except.adb:902
#5  0x0001485c in <__gnat_raise_exception> (e=0x40002548,
    message=<incomplete type>) at a-except.adb:932
#6  0x0002c814 in ada.text_io.editing.precalculate (pic=@0x39393939)
    at a-teioed.adb:2688
#7  0x0002f978 in ada.text_io.editing.valid (pic_string=
      {P_ARRAY = 0x40011240, P_BOUNDS = 0x40011238}, blank_when_zero=false)
    at a-teioed.adb:2762
#8  0x00037500 in _ada_cxf3a01 ()

(gdb) p/x $pc
$1 = 0x485ec
(gdb) disass 0x485dc 0x485fc
Dump of assembler code from 0x485dc to 0x485fc:
0x000485dc <_Unwind_SjLj_RaiseException+60>:    stw ret0,-78(sp)
0x000485e0 <_Unwind_SjLj_RaiseException+64>:    movb,= ret0,r22,0x48608
<_Unwind_SjLj_RaiseException+104>
0x000485e4 <_Unwind_SjLj_RaiseException+68>:    stw ret0,-74(sp)
0x000485e8 <_Unwind_SjLj_RaiseException+72>:    ldo -74(sp),r3
0x000485ec <_Unwind_SjLj_RaiseException+76>:    ldw 18(r22),r22
0x000485f0 <_Unwind_SjLj_RaiseException+80>:    cmpib,<> 0,r22,0x48624
<_Unwind_SjLj_RaiseException+132>
0x000485f4 <_Unwind_SjLj_RaiseException+84>:    copy r19,r4
0x000485f8 <_Unwind_SjLj_RaiseException+88>:    ldw -74(sp),ret0
End of assembler dump.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[charlet at gcc dot gnu dot org]

------- Comment #3 from charlet at gcc dot gnu dot org  2007-05-02 07:41 -------
Do you still get this failure with 4.2.0 or 4.3.0 ?

Arno


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[charlet at gcc dot gnu dot org]

------- Comment #4 from charlet at gcc dot gnu dot org  2007-05-04 08:25 -------
>From the test results you posted yesterday on 4.3.0, I assume this is fixed:

<<
                === acats tests ===
FAIL:   c37215h
FAIL:   cd10002
FAIL:   cxh1001

Native configuration is hppa-unknown-linux-gnu
>>


-- 

charlet at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|---                         |4.3.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[danglin at gcc dot gnu dot org]

------- Comment #5 from danglin at gcc dot gnu dot org  2007-09-30 15:55 -------
Reappeared between 128058 and 128311.


-- 

danglin at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|FIXED                       |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[danglin at gcc dot gnu dot org]

------- Comment #6 from danglin at gcc dot gnu dot org  2007-09-30 16:15 -------
This is now also failing on hppa-unknown-linux-gnu.  I first see it in
128257.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[danglin at gcc dot gnu dot org]

------- Comment #7 from danglin at gcc dot gnu dot org  2007-09-30 19:52 -------
This is probably a different problem.  Oh well,

(gdb) r
Starting program:
/test/gnu/gcc/objdir/gcc/testsuite/ada/acats/tests/cxf/cxf3a01/cxf3a01
warning: The shared libraries were not privately mapped; setting a
breakpoint in a shared library will not work until you rerun the program.


,.,. CXF3A01 ACATS 2.5 07-09-30 15:19:49
---- CXF3A01 Check that the Valid function from package
                Ada.Text_IO.Editing returns False for strings that fail
                to comply with the composition constraints defined for
                picture strings. Check that the Valid function returns
                True for strings that conform to the composition
                constraints defined for picture strings.

Program received signal SIGSEGV, Segmentation fault.
0x0002a9e0 in ada.text_io.editing.expand () at a-teioed.adb:110
110           return Result (1 .. Result_Index - 1);
Current language:  auto; currently ada
(gdb) bt
#0  0x0002a9e0 in ada.text_io.editing.expand () at a-teioed.adb:110
#1  0x0002ac64 in ada.text_io.editing.valid (blank_when_zero=true)
    at a-teioed.adb:2754
#2  0x0002f228 in _ada_cxf3a01 ()
(gdb) disass 0x0002a9d0 0x0002a9f0
Dump of assembler code from 0x2a9d0 to 0x2a9f0:
0x0002a9d0 <ada__text_io__editing__expand+200>: b,l 0xdf08
<system__secondary_stack__ss_allocate>,rp
0x0002a9d4 <ada__text_io__editing__expand+204>: depwi 0,31,2,r26
0x0002a9d8 <ada__text_io__editing__expand+208>: copy ret0,r3
0x0002a9dc <ada__text_io__editing__expand+212>: ldi 1,ret0
0x0002a9e0 <ada__text_io__editing__expand+216>: stw ret0,0(r3)
0x0002a9e4 <ada__text_io__editing__expand+220>: stw r4,4(r3)
0x0002a9e8 <ada__text_io__editing__expand+224>: copy r5,r24
0x0002a9ec <ada__text_io__editing__expand+228>: ldo 8(r3),r4
End of assembler dump.

It appears system__secondary_stack__ss_allocate is broken:

(gdb) p/x $ret0
$7 = 0x7900ff48
(gdb) p *$ret0
Cannot access memory at address 0x7900ff48


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[rguenth at gcc dot gnu dot org]

-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.3.0                       |---


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[danglin at gcc dot gnu dot org]

------- Comment #8 from danglin at gcc dot gnu dot org  2008-06-28 21:19 -------
This still fails with 4.4.0.  The segv in _Unwind_SjLj_RaiseException
still occurs on hppa2.0w-hp-hpux11.11 when GCC is configured with SJLJ
exceptions.

Also, still seem the same fails with dwarf exceptions 


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] CXF3A01 core dump

[danglin at gcc dot gnu dot org]

------- Comment #9 from danglin at gcc dot gnu dot org  2008-06-29 03:29 -------
The linux and hpux problems are the same.  It appears this code in
ada__text_io__editing__expand() is stomping on the function context.
In particular, the high order byte of the fc->prev value stomped on.

            when others =>
               Result (Result_Index) := Picture (Picture_Index);
               Picture_Index := Picture_Index + 1;
               Result_Index := Result_Index + 1;

The corresponding assembler code is

0x0002c48c <ada__text_io__editing__expand+268>: ldw -a4(,sp),ret1
0x0002c490 <ada__text_io__editing__expand+272>: add,l r22,ret1,ret0
0x0002c494 <ada__text_io__editing__expand+276>: stb r20,0(,ret0)
0x0002c498 <ada__text_io__editing__expand+280>: ldo 1(ret1),ret1
0x0002c49c <ada__text_io__editing__expand+284>: ldo 1(r19),r19
0x0002c4a0 <ada__text_io__editing__expand+288>: stw ret1,-a4(,sp)
0x0002c4a4 <ada__text_io__editing__expand+292>: ldw -90(,sp),r20

(gdb) p/x $r20
$9 = 0x39
(gdb) p $r22
$3 = 2130644039
(gdb) p $ret1
$4 = 65
(gdb) p/x $ret1 + $r22
$7 = 0x7eff0c88
(gdb) c
Continuing.

Breakpoint 15, _Unwind_SjLj_Unregister (fc=0x7eff0c88)
    at ../../../gcc/libgcc/../gcc/unwind-sjlj.c:173
173     {
(gdb) p &fc->prev
$10 = (struct SjLj_Function_Context **) 0x7eff0c88
(gdb) p *fc
$11 = {prev = 0x39ff0ac8, call_site = 4, data = {1073765631, 2130643768, 
    55035, 140523}, personality = 0x4000315a <U_ARM_MASK+1030>, 
  lsda = 0x400022ac}

_Unwind_SjLj_Unregister installs fc->prev and this leads to a segv when
the context is accessed.

It appears the offset of 65 is outside the bounds of the Result array.


-- 

danglin at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  GCC build triplet|hppa2.0w-hp-hpux11.11       |hppa*-*-*
   GCC host triplet|hppa2.0w-hp-hpux11.11       |hppa*-*-*
 GCC target triplet|hppa2.0w-hp-hpux11.11       |hppa*-*-*


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819

[Bug ada/25819] ACATS cxf3a01 core dump

[ebotcazou at gcc dot gnu dot org]

------- Comment #10 from ebotcazou at gcc dot gnu dot org  2009-03-08 10:03 -------


*** This bug has been marked as a duplicate of 39221 ***


-- 

ebotcazou at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |DUPLICATE
            Summary|CXF3A01 core dump           |ACATS cxf3a01 core dump


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25819