[Bug c++/104862] New: extern thread_local (emutls) code crashes with ASLR on Windows

["alvinhochun at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104862

            Bug ID: 104862
           Summary: extern thread_local (emutls) code crashes with ASLR on
                    Windows
           Product: gcc
           Version: 11.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: alvinhochun at gmail dot com
                CC: martin at martin dot st
  Target Milestone: ---

Test code:

/// static_test.cpp

#include <iostream>

thread_local int s1;
extern thread_local int s2;

void dummy(void *a) {
    // no-op
}

void __attribute__ ((noinline)) a(int v) {
    s1 = v;
    dummy(&v);
    s2 = v + 1;
}

int __attribute__ ((noinline)) b() {
    return s1 + s2;
}

int main() {
    int n;
    std::cin >> n;
    a(n);
    std::cout << b();
    return 0;
}

/// static_obj.cpp

thread_local int s2;

/// ----------


Compiled with mingw-builds mingw-w64 gcc
x86_64-11.2.0-release-posix-seh-rt_v9-rev1 [1]:

g++ -Og -g -std=gnu++17 -c static_obj.cpp -o static_obj.o
g++ -Og -g -std=gnu++17 static_test.cpp static_obj.o -o static_test.exe


Running it segfaults:

(gdb) r
Starting program: D:\temp\static_test.exe
[New Thread 5368.0x4568]
[New Thread 5368.0x5598]
[New Thread 5368.0x4aec]
1   # <-- user input

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007ff663890000 in ?? ()


(gdb) disas a
Dump of assembler code for function _Z1ai:
   0x00007ff6a3891587 <+0>:     push   %rbx
   0x00007ff6a3891588 <+1>:     sub    $0x20,%rsp
   0x00007ff6a389158c <+5>:     mov    %ecx,%ebx
   0x00007ff6a389158e <+7>:     lea    0x1a8b(%rip),%rcx        #
0x7ff6a3893020 <__emutls_v.s1>
   0x00007ff6a3891595 <+14>:    call   0x7ff6a3892730 <__emutls_get_address>
   0x00007ff6a389159a <+19>:    mov    %ebx,(%rax)
   0x00007ff6a389159c <+21>:    add    $0x1,%ebx
   0x00007ff6a389159f <+24>:    lea    -0x400015a6(%rip),%rax        #
0x7ff663890000
   0x00007ff6a38915a6 <+31>:    test   %rax,%rax
   0x00007ff6a38915a9 <+34>:    je     0x7ff6a38915b0 <_Z1ai+41>
   0x00007ff6a38915ab <+36>:    call   0x7ff663890000
   0x00007ff6a38915b0 <+41>:    mov    0x2d99(%rip),%rcx        #
0x7ff6a3894350 <.refptr.__emutls_v.s2>
   0x00007ff6a38915b7 <+48>:    call   0x7ff6a3892730 <__emutls_get_address>
   0x00007ff6a38915bc <+53>:    mov    %ebx,(%rax)
   0x00007ff6a38915be <+55>:    add    $0x20,%rsp
   0x00007ff6a38915c2 <+59>:    pop    %rbx
   0x00007ff6a38915c3 <+60>:    ret
End of assembler dump.


Note the assembler from +24 to +36.

The generated assembler (corresponding to +24 ~ +53):

        leaq    _ZTH2s2(%rip), %rax
        testq   %rax, %rax
        je      .L7
        call    _ZTH2s2
.L7:
        movq    .refptr.__emutls_v.s2(%rip), %rcx
        call    __emutls_get_address
        movl    %ebx, (%rax)


It looks like the symbol _ZTH2s2 is the "thread-local initialization routine
for s2" (which is declared weak) and ends up being null, which is what
`-0x400015a6(%rip)` is supposed to point to. But due to ASLR this address ends
up being offset and causing the jump to not be taken and then calling an
invalid address.

Clang uses `cmpq $0, .refptr._ZTH2s2(%rip)` for this which doesn't have the
same problem.

(Many thanks to Martin Storsjö for helping me on this.)


[1]:
https://github.com/niXman/mingw-builds-binaries/releases/tag/11.2.0-rt_v9-rev1