[Bug libstdc++/39832] New: program built by x86_64-pc-mingw32-gcc run crash, maybe for _Unwind_SjLj_Unregister,

[Bug libstdc++/39832] New: program built by x86_64-pc-mingw32-gcc run crash, maybe for _Unwind_SjLj_Unregister,

[drangon dot mail at gmail dot com]

I built a x86_64-pc-mingw32 toolchain from scratch with the newest code from
SVN ( 20090421 ).
and the build an application using wxWidgets library, it runs crashed.

(gdb) r
Starting program: E:\code\DMediaInfo/DMediaInfo.exe
[New Thread 2656.0xbd8]
warning: Can not parse XML library list; XML support was disabled at
compile tim
e
[New Thread 2656.0x964]
Program received signal SIGSEGV, Segmentation fault.
0x00000000006e289b in wxObject (this=0x1)
at f:/devel/devel64/include/wx/object.h:412
412 wxObject() { m_refData = NULL; }
Current language: auto; currently c++
(gdb) p this
$1 = (class wxObject * const) 0x1


the wxObject was create by new operator, it return 0x1 which is wrong.

------------------
44 _GLIBCXX_WEAK_DEFINITION void *
45 operator new (std::size_t sz) throw (std::bad_alloc)
46 {
47 void *p;
48
49 /* malloc (0) is unpredictable; avoid it. */
50 if (sz == 0)
51 sz = 1;
52 p = (void *) malloc (sz);
53 while (p == 0)
54 {
55 new_handler handler = __new_handler;
56 if (! handler)
57 #ifdef __EXCEPTIONS
58 throw bad_alloc();
59 #else
60 std::abort();
61 #endif
62 handler ();
63 p = (void *) malloc (sz);
64 }
65
66 return p;
67 }
--------------------------------

malloc() return the correct value, but after _Unwind_SjLj_Unregister(),
$rax changed to 0x1.

----------------------
Dump of assembler code for function _Znwy:
0x0000000000702d50 <_Znwy+0>: push %rbp
0x0000000000702d51 <_Znwy+1>: lea 0x11e8(%rip),%rax # 0x703f40
<__gx
x_personality_sj0>
0x0000000000702d58 <_Znwy+8>: lea 0x7ea9(%rip),%rdx # 0x70ac08
<__DT
OR_LIST__+24584>
0x0000000000702d5f <_Znwy+15>: sub $0x90,%rsp
0x0000000000702d66 <_Znwy+22>: mov %rcx,0xa0(%rsp)
0x0000000000702d6e <_Znwy+30>: mov %rax,0x50(%rsp)
0x0000000000702d73 <_Znwy+35>: lea 0x20(%rsp),%rcx
0x0000000000702d78 <_Znwy+40>: lea 0x90(%rsp),%rax
0x0000000000702d80 <_Znwy+48>: mov %rdx,0x58(%rsp)
0x0000000000702d85 <_Znwy+53>: lea 0xb1(%rip),%rdx # 0x702e3d
<_Znwy+
237>
0x0000000000702d8c <_Znwy+60>: mov %rsp,0x70(%rsp)
0x0000000000702d91 <_Znwy+65>: mov %rax,0x60(%rsp)
0x0000000000702d96 <_Znwy+70>: mov %rdx,0x68(%rsp)
0x0000000000702d9b <_Znwy+75>: callq 0x68df08 <_Unwind_SjLj_Register>
0x0000000000702da0 <_Znwy+80>: cmpq $0x0,0xa0(%rsp)
0x0000000000702da9 <_Znwy+89>: mov $0x1,%eax
0x0000000000702dae <_Znwy+94>: cmovne 0xa0(%rsp),%rax
0x0000000000702db7 <_Znwy+103>: mov %rax,%rcx
0x0000000000702dba <_Znwy+106>: mov %rax,0xa0(%rsp)
0x0000000000702dc2 <_Znwy+114>: callq 0x68f708 <malloc>
0x0000000000702dc7 <_Znwy+119>: test %rax,%rax
0x0000000000702dca <_Znwy+122>: jne 0x702df8 <_Znwy+168>
0x0000000000702dcc <_Znwy+124>: nopl 0x0(%rax)
0x0000000000702dd0 <_Znwy+128>: mov 0x49861(%rip),%rax # 0x74c638
<__n
ew_handler>
0x0000000000702dd7 <_Znwy+135>: test %rax,%rax
0x0000000000702dda <_Znwy+138>: je 0x702e0b <_Znwy+187>
0x0000000000702ddc <_Znwy+140>: movl $0x1,0x28(%rsp)
0x0000000000702de4 <_Znwy+148>: callq *%rax
0x0000000000702de6 <_Znwy+150>: mov 0xa0(%rsp),%rcx
0x0000000000702dee <_Znwy+158>: callq 0x68f708 <malloc>
0x0000000000702df3 <_Znwy+163>: test %rax,%rax
0x0000000000702df6 <_Znwy+166>: je 0x702dd0 <_Znwy+128>
0x0000000000702df8 <_Znwy+168>: lea 0x20(%rsp),%rcx
0x0000000000702dfd <_Znwy+173>: callq 0x68df10 <_Unwind_SjLj_Unregister>
0x0000000000702e02 <_Znwy+178>: add $0x90,%rsp
0x0000000000702e09 <_Znwy+185>: pop %rbp
0x0000000000702e0a <_Znwy+186>: retq
0x0000000000702e0b <_Znwy+187>: mov $0x8,%ecx
0x0000000000702e10 <_Znwy+192>: callq 0x703090 <__cxa_allocate_exception>
0x0000000000702e15 <_Znwy+197>: lea 0x49754(%rip),%rdx # 0x74c570
<_ZT
VSt9bad_alloc+16>
0x0000000000702e1c <_Znwy+204>: lea -0x1dd3(%rip),%r8 # 0x701050
<~bad
_alloc>
0x0000000000702e23 <_Znwy+211>: mov %rax,%rcx
0x0000000000702e26 <_Znwy+214>: mov %rdx,(%rax)
0x0000000000702e29 <_Znwy+217>: lea 0x186f0(%rip),%rdx # 0x71b520
<_ZT
ISt9bad_alloc>
0x0000000000702e30 <_Znwy+224>: movl $0x1,0x28(%rsp)
0x0000000000702e38 <_Znwy+232>: callq 0x703ee0 <__cxa_throw>
0x0000000000702e3d <_Znwy+237>: mov 0x38(%rsp),%rax
0x0000000000702e42 <_Znwy+242>: mov 0x30(%rsp),%rcx
0x0000000000702e47 <_Znwy+247>: cmp $0xffffffffffffffff,%rax
0x0000000000702e4b <_Znwy+251>: je 0x702e5a <_Znwy+266>
0x0000000000702e4d <_Znwy+253>: movl $0xffffffff,0x28(%rsp)
0x0000000000702e55 <_Znwy+261>: callq 0x68df00 <_Unwind_SjLj_Resume>
0x0000000000702e5a <_Znwy+266>: mov %eax,0x28(%rsp)
0x0000000000702e5e <_Znwy+270>: callq 0x7034c0 <__cxa_call_unexpected>
End of assembler dump.
(gdb)

Breakpoint 2, 0x0000000000702dfd in operator new (sz=64)
at ../../../../gcc/libstdc++-v3/libsupc++/new_op.cc:53
53 ../../../../gcc/libstdc++-v3/libsupc++/new_op.cc: No such file or
direct
ory.
in ../../../../gcc/libstdc++-v3/libsupc++/new_op.cc
(gdb) echo $pc
$pc(gdb) p $pc
$28 = (void (*)(void)) 0x702dfd <operator new(unsigned long long)+173>
(gdb) p $rax
$29 = 63978736
(gdb) p $rcx
$30 = 2292480
(gdb) x/i $pc
0x702dfd <_Znwy+173>: callq 0x68df10 <_Unwind_SjLj_Unregister>
(gdb) ni
67 in ../../../../gcc/libstdc++-v3/libsupc++/new_op.cc
(gdb) p $pc
$31 = (void (*)(void)) 0x702e02 <operator new(unsigned long long)+178>
(gdb) p $rax
$32 = 1
(gdb)
-------------------

E:\code\DMediaInfo>gcc -v
Using built-in specs.
Target: x86_64-pc-mingw32
Configured with: ../gcc/configure --host=x86_64-pc-mingw32
--target=x86_64-pc-mi
ngw32 --disable-nls --enable-languages=c,c++
--with-gmp=/compile/mingw/for_targe
t --enable-twoprocess --disable-libstdcxx-pch --prefix=/compile/mingw/target
--w
ith-sysroot=/compile/mingw/target
Thread model: win32
gcc version 4.5.0 20090421 (experimental) (GCC)


-- 
           Summary: program built by x86_64-pc-mingw32-gcc run crash, maybe
                    for _Unwind_SjLj_Unregister,
           Product: gcc
           Version: 4.5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: drangon dot mail at gmail dot com
 GCC build triplet: x86_64-redhat-linux-gnu
  GCC host triplet: x86_64-pc-mingw32
GCC target triplet: x86_64-pc-mingw32


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] program built by x86_64-pc-mingw32-gcc run crash, maybe for _Unwind_SjLj_Unregister,

[pinskia at gcc dot gnu dot org]

------- Comment #1 from pinskia at gcc dot gnu dot org  2009-04-22 23:53 -------
Can you try this again, there were some Exceptions handling issues recently.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
          Component|libstdc++                   |middle-end
           Keywords|                            |wrong-code


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] program built by x86_64-pc-mingw32-gcc run crash, maybe for _Unwind_SjLj_Unregister,

[drangon dot mail at gmail dot com]

------- Comment #2 from drangon dot mail at gmail dot com  2009-04-23 15:49 -------
(In reply to comment #1)
> Can you try this again, there were some Exceptions handling issues recently.
> 
I update the newest gcc code from SVN (20090423), and rebuilt the toolchain.
The application built by this new toolchain runs well, no longer crashed.
This bug should bave been fixed. Good Job!


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.5 Regression] program built by x86_64-pc-mingw32-gcc run crash, maybe for _Unwind_SjLj_Unregister,

[pinskia at gcc dot gnu dot org]

------- Comment #3 from pinskia at gcc dot gnu dot org  2009-04-23 15:50 -------
Fixed.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
           Keywords|                            |EH
         Resolution|                            |FIXED
            Summary|program built by x86_64-pc- |[4.5 Regression] program
                   |mingw32-gcc run crash, maybe|built by x86_64-pc-mingw32-
                   |for _Unwind_SjLj_Unregister,|gcc run crash, maybe for
                   |                            |_Unwind_SjLj_Unregister,
   Target Milestone|---                         |4.5.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.5 Regression] program built by x86_64-pc-mingw32-gcc run crash, maybe for _Unwind_SjLj_Unregister,

[drangon dot mail at gmail dot com]

------- Comment #4 from drangon dot mail at gmail dot com  2009-07-21 07:46 -------
The bug seems to occur again. It is ok in svn 2009-06-20, but today's svn code
is has problem.

C program is fine, but C++ program crashed. The error message is :

The instruction at "0x0040a7e0 referenced memory at "0x00000046". The memory
could not be "read".

If I change the libgcc_s_sjlj-1.dll to version 2009-06-20, the program works
fine.

the code at "0x0040a7e0" is :

000000000040a7c0 <__ZL15eh_globals_dtorPv>:

#if __GTHREADS

static void
eh_globals_dtor(void* ptr)
{
  40a7c0:   56                      push   %rsi
  40a7c1:   48 89 ce                mov    %rcx,%rsi
  40a7c4:   53                      push   %rbx
  40a7c5:   48 83 ec 28             sub    $0x28,%rsp
  if (ptr)
  40a7c9:   48 85 c9                test   %rcx,%rcx
  40a7cc:   74 35                   je     40a803
<__ZL15eh_globals_dtorPv+0x43>
    {
      __cxa_eh_globals* g = reinterpret_cast<__cxa_eh_globals*>(ptr);
      __cxa_exception* exn = g->caughtExceptions;
  40a7ce:   48 8b 09                mov    (%rcx),%rcx
      __cxa_exception* next;
      while (exn)
  40a7d1:   48 85 c9                test   %rcx,%rcx
  40a7d4:   74 1f                   je     40a7f5
<__ZL15eh_globals_dtorPv+0x35>
  40a7d6:   66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
  40a7dd:   00 00 00
    {
      next = exn->nextException;
  40a7e0:   48 8b 59 20             mov    0x20(%rcx),%rbx
      _Unwind_DeleteException(&exn->unwindHeader);
  40a7e4:   48 83 c1 50             add    $0x50,%rcx
  40a7e8:   e8 63 ca ff ff          callq  407250 <__Unwind_DeleteException>
  if (ptr)
    {
      __cxa_eh_globals* g = reinterpret_cast<__cxa_eh_globals*>(ptr);
      __cxa_exception* exn = g->caughtExceptions;
      __cxa_exception* next;
      while (exn)
  40a7ed:   48 85 db                test   %rbx,%rbx
    {
      next = exn->nextException;
      _Unwind_DeleteException(&exn->unwindHeader);
  40a7f0:   48 89 d9                mov    %rbx,%rcx
  if (ptr)
    {
      __cxa_eh_globals* g = reinterpret_cast<__cxa_eh_globals*>(ptr);
      __cxa_exception* exn = g->caughtExceptions;
      __cxa_exception* next;
      while (exn)
  40a7f3:   75 eb                   jne    40a7e0
<__ZL15eh_globals_dtorPv+0x20>
      _Unwind_DeleteException(&exn->unwindHeader);
      exn = next;
    }
      free(ptr);
    }
}
  40a7f5:   48 83 c4 28             add    $0x28,%rsp
    {
      next = exn->nextException;
      _Unwind_DeleteException(&exn->unwindHeader);
      exn = next;
    }
      free(ptr);
  40a7f9:   48 89 f1                mov    %rsi,%rcx
    }
}
  40a7fc:   5b                      pop    %rbx
  40a7fd:   5e                      pop    %rsi
    {
      next = exn->nextException;
      _Unwind_DeleteException(&exn->unwindHeader);
      exn = next;
    }
      free(ptr);
  40a7fe:   e9 fd f6 ff ff          jmpq   409f00 <_free>
    }
}
  40a803:   48 83 c4 28             add    $0x28,%rsp
  40a807:   5b                      pop    %rbx
  40a808:   5e                      pop    %rsi
  40a809:   c3                      retq
  40a80a:   90                      nop
  40a80b:   90                      nop
  40a80c:   90                      nop
  40a80d:   90                      nop
  40a80e:   90                      nop
  40a80f:   90                      nop

000000000040a810 <__ZL15get_ttype_entryP16lsda_header_infoy>:


-- 

drangon dot mail at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|FIXED                       |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.5 Regression] program built by x86_64-pc-mingw32-gcc run crash, maybe for _Unwind_SjLj_Unregister,

[drangon dot mail at gmail dot com]

------- Comment #5 from drangon dot mail at gmail dot com  2009-07-21 07:47 -------
and newest code in gcc svn trunk and gcc svn branch-4.4 both has this problem.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.4/4.5 Regression] program built by x86_64-pc-mingw32-g++ run crash, maybe for _Unwind_SjLj_Unregister or __dyn_tls_dtor

[drangon dot mail at gmail dot com]

------- Comment #6 from drangon dot mail at gmail dot com  2009-07-25 07:45 -------
I try the newest gcc svn trunk code, the problem still exist.
program built by x86_64-w64-mingw32-gcc runs ok, but program built by
x86_64-w64-mingw32-g++ runs failed, change libgcc_s_sjlj-1.dll to version
2009-06-20, the same program runs ok ( need not recompile ).

I use gdb or windbg to run the program, it show the following result:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000408059 in __dyn_tls_dtor (hDllHandle=0x400000, dwReason=0,
    lpreserved=0x0)
    at
/compile/mingw-w64-dgn/source/mingw-w64/trunk/mingw-w64-crt/crt/tlssup.c:
120
120    
/compile/mingw-w64-dgn/source/mingw-w64/trunk/mingw-w64-crt/crt/tlssup.c
: No such file or directory.
        in
/compile/mingw-w64-dgn/source/mingw-w64/trunk/mingw-w64-crt/crt/tlssu
p.c
(gdb) bt
#0  0x0000000000408059 in __dyn_tls_dtor (hDllHandle=0x400000, dwReason=0,
    lpreserved=0x0)
    at
/compile/mingw-w64-dgn/source/mingw-w64/trunk/mingw-w64-crt/crt/tlssup.c:
120
#1  0x0000000077f1cc41 in ?? ()
warning: (Internal error: pc 0x3fffff in read in psymtab, but not in symtab.)

#2  0x0000000000400000 in ?? (warning: (Internal error: pc 0x3fffff in read in
p
symtab, but not in symtab.)

)
warning: (Internal error: pc 0x3fffff in read in psymtab, but not in symtab.)

#3  0x0000000000000000 in ?? ()
(gdb) info register
rax            0xfeeefeeefeeefeee       -76843841185972498
rbx            0x49e050 4841552
rcx            0x0      0
rdx            0x0      0
rsi            0x400000 4194304
rdi            0x408024 4227108
rbp            0x22fb10 0x22fb10
rsp            0x22fad0 0x22fad0
r8             0x0      0
r9             0x9f000  651264
r10            0x400080 4194432
r11            0x22fb50 2292560
r12            0x0      0
r13            0x7fffffd8000    8796092858368
r14            0x77fa8f50       2012909392
r15            0x0      0
rip            0x408059 0x408059 <__dyn_tls_dtor+53>
eflags         0x10202  [ IF RF ]
cs             0x33     51
ss             0x202002b        33685547
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x2b0000 2818048
(gdb)


0000000000408024 <___dyn_tls_dtor>:

static BOOL WINAPI
__dyn_tls_dtor (HANDLE hDllHandle, DWORD dwReason, LPVOID lpreserved)
{
  408024:   55                      push   %rbp
  408025:   48 89 e5                mov    %rsp,%rbp
  408028:   48 83 ec 40             sub    $0x40,%rsp
  40802c:   48 89 4d 10             mov    %rcx,0x10(%rbp)
  408030:   89 55 18                mov    %edx,0x18(%rbp)
  408033:   4c 89 45 20             mov    %r8,0x20(%rbp)
  TlsDtorNode *pnode, *pnext;
  int i;

  if (dwReason != DLL_THREAD_DETACH && dwReason != DLL_PROCESS_DETACH)
  408037:   83 7d 18 03             cmpl   $0x3,0x18(%rbp)
  40803b:   74 10                   je     40804d <___dyn_tls_dtor+0x29>
  40803d:   83 7d 18 00             cmpl   $0x0,0x18(%rbp)
  408041:   74 0a                   je     40804d <___dyn_tls_dtor+0x29>
    return TRUE;
  408043:   b8 01 00 00 00          mov    $0x1,%eax
  408048:   e9 ab 00 00 00          jmpq   4080f8 <___dyn_tls_dtor+0xd4>

  for (pnode = dtor_list; pnode != NULL; pnode = pnext)
  40804d:   48 8d 0d 6c 3a 08 00    lea    0x83a6c(%rip),%rcx        # 48bac0
<___emutls_v.dtor_list>
  408054:   e8 ef 0c 00 00          callq  408d48 <___emutls_get_address>
  408059:   48 8b 00                mov    (%rax),%rax
  40805c:   48 89 45 f0             mov    %rax,-0x10(%rbp)
  408060:   eb 6a                   jmp    4080cc <___dyn_tls_dtor+0xa8>
    {
      for (i = pnode->count - 1; i >= 0; --i)
  408062:   48 8b 45 f0             mov    -0x10(%rbp),%rax
  408066:   8b 00                   mov    (%rax),%eax
  408068:   83 e8 01                sub    $0x1,%eax
  40806b:   89 45 fc                mov    %eax,-0x4(%rbp)
  40806e:   eb 2f                   jmp    40809f <___dyn_tls_dtor+0x7b>


-- 

drangon dot mail at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[4.5 Regression] program    |[4.4/4.5 Regression] program
                   |built by x86_64-pc-mingw32- |built by x86_64-pc-mingw32-
                   |gcc run crash, maybe for    |g++ run crash, maybe for
                   |_Unwind_SjLj_Unregister,    |_Unwind_SjLj_Unregister or
                   |                            |__dyn_tls_dtor


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.4/4.5 Regression] program built by x86_64-pc-mingw32-g++ run crash, maybe for _Unwind_SjLj_Unregister or __dyn_tls_dtor

[jsm28 at gcc dot gnu dot org]

------- Comment #7 from jsm28 at gcc dot gnu dot org  2009-07-29 22:33 -------
x86_64-pc-mingw32 is not a primary or secondary platform, moving to P4.
Please restore to P3 if this also appears on i686-mingw32 or another
primary or secondary platform.


-- 

jsm28 at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P4


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.4/4.5 Regression] program built by x86_64-pc-mingw32-g++ run crash, maybe for _Unwind_SjLj_Unregister or __dyn_tls_dtor

[ktietz at gcc dot gnu dot org]

------- Comment #8 from ktietz at gcc dot gnu dot org  2009-08-30 08:27 -------
(In reply to comment #7)
> x86_64-pc-mingw32 is not a primary or secondary platform, moving to P4.
> Please restore to P3 if this also appears on i686-mingw32 or another
> primary or secondary platform.
> 

Could you please re-test your failure. It seems to be a duplicate of PR/41184.
It is fix on trunk and on 4.4.x branch.

Cheers,
Kai


-- 

ktietz at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ktietz at gcc dot gnu dot
                   |                            |org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.4/4.5 Regression] program built by x86_64-pc-mingw32-g++ run crash, maybe for _Unwind_SjLj_Unregister or __dyn_tls_dtor

[drangon dot mail at gmail dot com]

------- Comment #9 from drangon dot mail at gmail dot com  2009-08-30 13:53 -------
yes, the issue should be fixed, wxWidgets works fine now.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832

[Bug middle-end/39832] [4.4/4.5 Regression] program built by x86_64-pc-mingw32-g++ run crash, maybe for _Unwind_SjLj_Unregister or __dyn_tls_dtor

[fxcoudert at gcc dot gnu dot org]

------- Comment #10 from fxcoudert at gcc dot gnu dot org  2009-09-04 12:18 -------


*** This bug has been marked as a duplicate of 41184 ***


-- 

fxcoudert at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |DUPLICATE


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39832