[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace

[ariel.burton at roguewave dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

--- Comment #1 from Ariel Burton <ariel.burton at roguewave dot com> 2011-05-24 17:18:45 UTC ---
Created attachment 24347
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24347
preprocessed file for t_repro.c

[Bug target/49146] New: segv from libgcc_s when raising an exception, or unwinding stack with backtrace

[ariel.burton at roguewave dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

           Summary: segv from libgcc_s when raising an exception, or
                    unwinding stack with backtrace
           Product: gcc
           Version: 4.4.6
            Status: UNCONFIRMED
          Severity: critical
          Priority: P3
         Component: target
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: ariel.burton@roguewave.com


Created attachment 24346
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24346
preprocessed file for t_exception.cpp

Unwinding the stack through a frame for a function annotated
with __attribute__((ms_abi)) causes a segv from libgcc_s.

System type: linux x8664, gcc 4.4.6, 4.5.3, and 4.6.0.

This error can be reproduced in two ways.

The first is to throw an exception and there is a function
annotated with __attribute__((ms_abi)) between where it's
thrown and where it's caught.

The other is to call the (libc) function backtrace.  On most
contemporary linux x8664 distributions, backtrace calls code
in libgcc_s.so.  Note also that in this case the backtrace
shown for f looks wrong (it has too few frames).  The segv
occurs in the unwind code in libgcc_s.so.

This is output of gcc -v:

Using built-in specs.
Target: x86_64-unknown-linux-gnu
Configured with: /packages/gcc-4.4.6/src/gcc-4.4.6/configure
--prefix=/packages/gcc-4.4.6/linux-x8664/installation
--with-gmp=/packages/gcc-4.4.6/linux-x8664/installation
--with-mpfr=/packages/gcc-4.4.6/linux-x8664/installation
--with-mpc=/packages/gcc-4.4.6/linux-x8664/installation
--enable-languages=c,c++,fortran
Thread model: posix
gcc version 4.4.6 (GCC) 

This is how I built the sample programs:

  /packages/gcc-4.4.6/linux-x8664/installation/bin/g++ -save-temps -g
../ms_abi-reproducer/t_exception.cpp -o t_exception
-Wl,-rpath,/packages/gcc-4.4.6/linux-x8664/installation/lib64

  /packages/gcc-4.4.6/linux-x8664/installation/bin/gcc -save-temps -g
../ms_abi-reproducer/t_repro.c  -o t_repro
-Wl,-rpath,/packages/gcc-4.4.6/linux-x8664/installation/lib64

I submit the preprocessed files as attachments.  This is the source
for the two programs:

t_exception.cpp

#include  <stdio.h>

struct E {
};


void
f ( int arg )
{
  if ( arg > 0 )
    {
      f ( arg - 1 );
    }
  else
    {
      throw E ();
    }
} /* f */

int
__attribute__((ms_abi))
f_ms_abi ( int arg )
{
  if ( arg > 0 )
    {
      f_ms_abi ( arg - 1 );
    }
  else
    {
      throw E ();
    }
} /* f_ms_abi */

int
main ( int argc, char *argv [] )
{

  printf ( "calling f\n" );
  try
    {
      f ( 6 );
    }
  catch ( ... )
    {
      printf ( "caught exception thrown by f\n" );
    }

  printf ( "calling f_ms_abi\n" );
  try
    {
      f_ms_abi ( 6 );
    }
  catch ( ... )
    {
      printf ( "caught exception thrown by f_ms_abi\n" );
    }

  return 0;
} /* main */


t_repro.c:



#include  <stdio.h>
#include  <execinfo.h>

void
do_backtrace (void)
{
  void  *pcs [ 64 ];
  int    max_pcs = sizeof ( pcs ) / sizeof ( pcs [ 0 ] );
  int    num_pcs = backtrace ( pcs, max_pcs );
  int    i;

  for ( i = 0; i < num_pcs; i ++ )
    printf ( " %2d: %p\n", i, pcs [ i ] );
} /* do_backtrace */

void
f ( int arg )
{
  if ( arg > 0 )
    {
      f ( arg - 1 );
    }
  else
    {
      do_backtrace ();
    }
} /* f */

int
__attribute__((ms_abi))
f_ms_abi ( int arg )
{
  if ( arg > 0 )
    {
      f_ms_abi ( arg - 1 );
    }
  else
    {
      do_backtrace ();
    }
} /* f_ms_abi */

int
main ( int argc, char *argv [] )
{

  printf ( "calling f\n" );
  f ( 6 );

  printf ( "calling f_ms_abi\n" );
  f_ms_abi ( 6 );

  return 0;
} /* main */

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace

[ariel.burton at roguewave dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

--- Comment #2 from Ariel Burton <ariel.burton at roguewave dot com> 2011-05-24 17:31:22 UTC ---
f and f_ms_abi are identical with the exception that f_ms_abi
is annoted with __attribute__((ms_abi)). This causes the compiler
to emit code to save registers not otherwise saved.  The DWARF
thus also contains directives for these registers.

I believe that the problem is that the arrays of registers in
struct _Unwind_Context and _Unwind_FrameState *fs are too small
to accommodate the higher-numbered registers saved in the prologues
of the ms_abi annotated functions.

This change made the segv go away:

*** src/gcc-4.6.0/gcc/config/i386/i386.h        2011-05-18 22:43:30.642575000
-0400
--- tmp/gcc-4.6.0/gcc/config/i386/i386.h        2011-01-14 16:03:22.000000000
-0500
***************
*** 889,899 ****
  #define FIRST_PSEUDO_REGISTER 53

  /* Number of hardware registers that go into the DWARF-2 unwind info.
     If not defined, equals FIRST_PSEUDO_REGISTER.  */

! // #define DWARF_FRAME_REGISTERS 17

  /* 1 for registers that have pervasive standard uses
     and are not available for the register allocator.
     On the 80386, the stack pointer is such, as is the arg pointer.

--- 889,899 ----
  #define FIRST_PSEUDO_REGISTER 53

  /* Number of hardware registers that go into the DWARF-2 unwind info.
     If not defined, equals FIRST_PSEUDO_REGISTER.  */

! #define DWARF_FRAME_REGISTERS 17

  /* 1 for registers that have pervasive standard uses
     and are not available for the register allocator.
     On the 80386, the stack pointer is such, as is the arg pointer.


However, the wrong backtrace remained.

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Target|                            |x86_64-unknown-linux-gnu
            Summary|segv from libgcc_s when     |segv from libgcc_s when
                   |raising an exception, or    |raising an exception, or
                   |unwinding stack with        |unwinding stack with
                   |backtrace                   |backtrace with ms_abi
           Severity|critical                    |normal

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[ariel.burton at roguewave dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

Ariel Burton <ariel.burton at roguewave dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|4.4.6                       |4.8.0

--- Comment #3 from Ariel Burton <ariel.burton at roguewave dot com> 2013-05-01 17:47:39 UTC ---
I found another case where taking a backtrace causes a SEGV.
This time the error occurs when the unwinder attempts to deal
with a frame that saves some of the xmm registers.  The code
in question is in the openmp (shared) library distributed
with the intel compiler.

The component at fault here is libgcc_s.so.  The patch of
2011-05-24 fixed the SEGV, and returned a correct backtrace.

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[woodard at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

--- Comment #4 from Ben Woodard <woodard at redhat dot com> ---
Created attachment 30127
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30127&action=edit
Patch from Ariel that prevents the segv

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[woodard at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

--- Comment #5 from Ben Woodard <woodard at redhat dot com> ---
Ariel,

In talking to the engineers regarding this, they would like _builtin_expect
hints to tell the compiler to generate code saying that hitting this is
unlikely. 

http://blog.man7.org/2012/10/how-much-do-builtinexpect-likely-and.html

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[woodard at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

--- Comment #6 from Ben Woodard <woodard at redhat dot com> ---
Created attachment 30134
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30134&action=edit
reproducer program

still working on getting access to the machine where I have ICC. My password
expired.

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

Richard Henderson <rth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2013-05-16
                 CC|                            |rth at gcc dot gnu.org
           Assignee|unassigned at gcc dot gnu.org      |rth at gcc dot gnu.org
     Ever confirmed|0                           |1

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[woodard at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

--- Comment #7 from Ben Woodard <woodard at redhat dot com> ---
Created attachment 30137
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30137&action=edit
t_repro.c compiled -g -O2

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

Richard Henderson <rth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.8.2

--- Comment #8 from Richard Henderson <rth at gcc dot gnu.org> ---
http://gcc.gnu.org/ml/gcc-patches/2013-05/msg01001.html

Fixed for mainline; just missed the 4.8.1 cutoff.

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[woodard at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

Ben Woodard <woodard at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #30127|0                           |1
        is obsolete|                            |

--- Comment #9 from Ben Woodard <woodard at redhat dot com> ---
Created attachment 30177
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30177&action=edit
updated patch that includes __builtin_expect

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

--- Comment #10 from Richard Henderson <rth at gcc dot gnu.org> ---
(In reply to Ben Woodard from comment #9)
> Created attachment 30177 [details]
> updated patch that includes __builtin_expect

The patch in #8 is better, and indeed has a bug fix relative to this
in that the condition should be <= DWARF_FRAME_REGISTERS.  Note that
the array size is DWARF_FRAME_REGISTERS + 1.

[Bug target/49146] segv from libgcc_s when raising an exception, or unwinding stack with backtrace with ms_abi

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49146

Richard Henderson <rth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #11 from Richard Henderson <rth at gcc dot gnu.org> ---
Fixed.