[Bug c++/58366] New: thread_local class containing bound function leads to : "Illegal instruction: 4"

[Bug c++/58366] New: thread_local class containing bound function leads to : "Illegal instruction: 4"

[jbcoe at me dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

            Bug ID: 58366
           Summary: thread_local class containing bound function leads to
                    : "Illegal instruction: 4"
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jbcoe at me dot com

Created attachment 30768
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30768&action=edit
small program illustrating crash

I've struggled to pare this bug down to a smaller example but noticed that 
invocation of a thread_local random number generating functor in GCC 4.8.1
caused a regular, though not always reproducible, crash that I did not see in
Clang 3.3.

Both thread_local and use of std::bind seem to be necessary to reproduce the
crash.

Code was compiled with -std=c++11

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2013-09-08
     Ever confirmed|0                           |1

--- Comment #1 from Paolo Carlini <paolo.carlini at oracle dot com> ---
Which kind of crash? And which target?

On x86_64-linux, I built (and ran 10-20 times) your snippet with:

g++ GCC4.8Issues.cpp -std=c++11 -pthread

and various optimization levels, with 4.8.0, current 4.8.x and current mainline
and nothing special happened.

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[jbcoe at me dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

Jonathan Coe <jbcoe at me dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jbcoe at me dot com

--- Comment #2 from Jonathan Coe <jbcoe at me dot com> ---
Created attachment 30777
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30777&action=edit
Crash log

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jbcoe at me dot com                |jwakely.gcc at gmail dot com

--- Comment #3 from Paolo Carlini <paolo.carlini at oracle dot com> ---
Thus this OSX, right? Because on x86_64-linux the problem cannot be reproduced.
I think Jon triaged an issue about OSX a few weeks ago.

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[jbcoe at me dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

--- Comment #4 from Jonathan Coe <jbcoe at me dot com> ---
Yes, I've built on OS X 10.8.4 using a macports build of GCC 4.8.1.
I've tried adding -pthread when building - it makes no difference to the
crashing.
19 of 20 runs on my machine crash. I think if you managed 10-20 runs without a
crash I think that the bug does not exist on your machine.

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

--- Comment #5 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
On x86_64-apple-darwin10, if I compile the test with -std=c++11
-fsanitize=address (w/wo -pthread), I get

==60580== ERROR: AddressSanitizer: heap-use-after-free on address
0x60080001bfe8 at pc 0x10000249d bp 0x1039cce10 sp 0x1039cce08
READ of size 8 at 0x60080001bfe8 thread T16777215
0x60080001bfe8 is located 24 bytes inside of 40-byte region
[0x60080001bfd0,0x60080001bff8)
==60580== AddressSanitizer CHECK failed:
../../../../work/libsanitizer/asan/asan_report.cc:344 "((t)) != (0)" (0x0, 0x0)

If I compile with -g -std=c++11 (w/wo -pthread), valgrind crashes with

==60478== Thread 3:
==60478== Invalid read of size 8
==60478==    at 0x100002624: std::_Function_base::~_Function_base()
(functional:1997)
==60478==    by 0x10000284F: std::function<int ()()>::~function()
(functional:2138)
==60478==    by 0x1000046C7: ThreadLocalGenerator::~ThreadLocalGenerator()
(pr58366.cpp:9)
==60478==    by 0x100043218: (anonymous namespace)::run(void*) (in
/opt/gcc/gcc4.9w/lib/libstdc++.6.dylib)
==60478==    by 0x1001BA39B: _pthread_exit (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1001B9E88: thread_start (in /usr/lib/libSystem.B.dylib)
==60478==  Address 0x1003fcc78 is 24 bytes inside a block of size 40 free'd
==60478==    at 0x10003452D: free (vg_replace_malloc.c:430)
==60478==    by 0x1003E3A62: emutls_destroy (in
/opt/gcc/gcc4.9w/lib/libgcc_s.1.dylib)
==60478==    by 0xFF: ???
==60478==    by 0x1008FEEBF: ???
==60478==    by 0x1008FEFFF: ???
==60478==    by 0x1001BA6E7: _pthread_tsd_cleanup (in
/usr/lib/libSystem.B.dylib)
==60478== 
==60478== Invalid read of size 8
==60478==    at 0x100002631: std::_Function_base::~_Function_base()
(functional:1998)
==60478==    by 0x10000284F: std::function<int ()()>::~function()
(functional:2138)
==60478==    by 0x1000046C7: ThreadLocalGenerator::~ThreadLocalGenerator()
(pr58366.cpp:9)
==60478==    by 0x100043218: (anonymous namespace)::run(void*) (in
/opt/gcc/gcc4.9w/lib/libstdc++.6.dylib)
==60478==    by 0x1001BA39B: _pthread_exit (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1001B9E88: thread_start (in /usr/lib/libSystem.B.dylib)
==60478==  Address 0x1003fcc78 is 24 bytes inside a block of size 40 free'd
==60478==    at 0x10003452D: free (vg_replace_malloc.c:430)
==60478==    by 0x1003E3A62: emutls_destroy (in
/opt/gcc/gcc4.9w/lib/libgcc_s.1.dylib)
==60478==    by 0xFF: ???
==60478==    by 0x1008FEEBF: ???
==60478==    by 0x1008FEFFF: ???
==60478==    by 0x1001BA6E7: _pthread_tsd_cleanup (in
/usr/lib/libSystem.B.dylib)
==60478== 
==60478== Invalid read of size 8
==60478==    at 0x100003B39:
std::_Function_base::_Base_manager<std::_Bind<std::uniform_int_distribution<int>
()(std::mersenne_twister_engine<unsigned int, 32ul, 624ul, 397ul, 31ul,
2567483615u, 11ul, 4294967295u, 7ul, 2636928640u, 15ul, 4022730752u, 18ul,
1812433253u>)> >::_M_destroy(std::_Any_data&, std::integral_constant<bool,
false>) (functional:1894)
==60478==    by 0x1000034CE:
std::_Function_base::_Base_manager<std::_Bind<std::uniform_int_distribution<int>
()(std::mersenne_twister_engine<unsigned int, 32ul, 624ul, 397ul, 31ul,
2567483615u, 11ul, 4294967295u, 7ul, 2636928640u, 15ul, 4022730752u, 18ul,
1812433253u>)> >::_M_manager(std::_Any_data&, std::_Any_data const&,
std::_Manager_operation) (functional:1918)
==60478==    by 0x100002646: std::_Function_base::~_Function_base()
(functional:1998)
==60478==    by 0x10000284F: std::function<int ()()>::~function()
(functional:2138)
==60478==    by 0x1000046C7: ThreadLocalGenerator::~ThreadLocalGenerator()
(pr58366.cpp:9)
==60478==    by 0x100043218: (anonymous namespace)::run(void*) (in
/opt/gcc/gcc4.9w/lib/libstdc++.6.dylib)
==60478==    by 0x1001BA39B: _pthread_exit (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1001B9E88: thread_start (in /usr/lib/libSystem.B.dylib)
==60478==  Address 0x1003fcc68 is 8 bytes inside a block of size 40 free'd
==60478==    at 0x10003452D: free (vg_replace_malloc.c:430)
==60478==    by 0x1003E3A62: emutls_destroy (in
/opt/gcc/gcc4.9w/lib/libgcc_s.1.dylib)
==60478==    by 0xFF: ???
==60478==    by 0x1008FEEBF: ???
==60478==    by 0x1008FEFFF: ???
==60478==    by 0x1001BA6E7: _pthread_tsd_cleanup (in
/usr/lib/libSystem.B.dylib)
==60478== 
vg_alloc_ThreadState: no free slots available
Increase VG_N_THREADS, rebuild and try again.

valgrind: the 'impossible' happened:
   VG_N_THREADS is too low
==60478==    at 0x1380340C7: ???
==60478==    by 0x13803412E: ???
==60478==    by 0x13803417C: ???
==60478==    by 0x13803418A: ???
==60478==    by 0x13809B5BF: ???
==60478==    by 0x1380C4C9B: ???
==60478==    by 0x1380A0179: ???
==60478==    by 0x13809DAD2: ???
==60478==    by 0x1380C463F: ???

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==60478==    at 0x1001B9E52: __bsdthread_create (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1000A8DEA:
std::thread::_M_start_thread(std::shared_ptr<std::thread::_Impl_base>) (in
/opt/gcc/gcc4.9w/lib/libstdc++.6.dylib)
==60478==    by 0x7FFF5FBFE97F: ???
==60478==    by 0x7FFF5FBFE96F: ???

Thread 2: status = VgTs_Init
==60478==    at 0x1001B9E7C: thread_start (in /usr/lib/libSystem.B.dylib)

Thread 3: status = VgTs_WaitSys
==60478==    at 0x100180D7A: mach_msg_trap (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1001817FF: semaphore_create (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1001BCDF1: new_sem_from_pool (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1001BA5B0: _pthread_exit (in /usr/lib/libSystem.B.dylib)
==60478==    by 0x1001B9E88: thread_start (in /usr/lib/libSystem.B.dylib)

Thread 4: status = VgTs_Init
==60478==    at 0x1001B9E7C: thread_start (in /usr/lib/libSystem.B.dylib)
...
Thread 499: status = VgTs_Init
==60478==    at 0x1001B9E7C: thread_start (in /usr/lib/libSystem.B.dylib)

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

--- Comment #6 from Paolo Carlini <paolo.carlini at oracle dot com> ---
In my opinion, the only hope to make progress about this issue is that somebody
knowledgeable about that target reduces the test to 20/30 lines of code with no
includes. Because, as is, with hundreds of kbytes of preprocessed code, and an
error about an illegal instruction which means nothing to the bulk of GCC
developers working mostly on linux, it could be anything, literally.
Personally, I don't even know whether thread local storage works fine with
gcc4.8.1 on darwin. For example, did you run the gcc and libstdc++ testsuites
on that machine? Are they clean?

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[dominiq at lps dot ens.fr]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |iains at gcc dot gnu.org

--- Comment #7 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
> For example, did you run the gcc and libstdc++ testsuites on that machine? 
> Are they clean?

I run the full testsuite on trunk (all languages but go) and yes the tests are
mostly clean.

CCed Iain Sandoe.

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[jbcoe at me dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

--- Comment #8 from Jonathan Coe <jbcoe at me dot com> ---
I've pared down the example. The crash is much harder to reproduce now (maybe 1
in 20 runs). Please find code and crash log attached.

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[jbcoe at me dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

Jonathan Coe <jbcoe at me dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #30768|0                           |1
        is obsolete|                            |

--- Comment #9 from Jonathan Coe <jbcoe at me dot com> ---
Created attachment 30779
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30779&action=edit
Smaller program illustrating crash (fewer includes)

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[jbcoe at me dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

--- Comment #10 from Jonathan Coe <jbcoe at me dot com> ---
Created attachment 30780
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=30780&action=edit
OSX 10.8.4 Crash log from smaller program crash

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

--- Comment #11 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Paolo Carlini from comment #3)
> Thus this OSX, right? Because on x86_64-linux the problem cannot be
> reproduced. I think Jon triaged an issue about OSX a few weeks ago.

Hmm, maybe, I don't remember, OS X just seems generally broken to me :-\

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

--- Comment #12 from Paolo Carlini <paolo.carlini at oracle dot com> ---
For the record, I think I had in mind target/58104.

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[tobias.bruell at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

Toby Brull <tobias.bruell at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tobias.bruell at gmail dot com

--- Comment #13 from Toby Brull <tobias.bruell at gmail dot com> ---
Seems to be fixed in more recent versions (I tried 7.5, 8.4, 10.1).

[Bug c++/58366] invocation of thread_local class containing bound function leads to : "Illegal instruction: 4"

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58366

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
             Target|                            |x86_64-apple-darwin10
         Resolution|---                         |WORKSFORME

--- Comment #14 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Let's close as WORKSFORME then.