[Bug preprocessor/60436] New: C preprocessor segfaults on assembly file

[Bug preprocessor/60436] New: C preprocessor segfaults on assembly file

[dan.doel at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

            Bug ID: 60436
           Summary: C preprocessor segfaults on assembly file
           Product: gcc
           Version: 4.8.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: preprocessor
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dan.doel at gmail dot com

Greetings,

While testing the latest GHC, I came across a segfault in GCC. I've tracked it
down to the preprocessor segfaulting on an intermediate assembly file produced
during compilation. I've also reproduced the segfault using the stock 4.8.2
release, although I first encountered it on the 2014-02-06 snapshot which is
currently distributed on Arch.

The assembly file is very large, but I have no smaller test case. I cannot
attach it here, because xz -9e only compresses it to ~2MiB. However, you can
find it at the Arch bug report I'll link below. Various bits about the
reproduction of the segfault are also quite odd:

  The assembly file contains no macros or includes.

  A macro must be defined to produce the segfault. The one GHC uses is
    -DTABLES_NEXT_TO_CODE. One can also get the segfault by putting
    '#define TABLES_NEXT_TO_CODE' at the top of the file

  TABLES_NEXT_TO_CODE is meaningless, though. Any macro definition of 13
  letters or more triggers the segfault. But 12 or fewer seems to work fine.

  Adding a blank line anywhere before line 395,848 stops the segfault, but
  adding blank lines after does nothing.

  Truncating the file before line 4,400,769 stops the segfault, but truncating
  after does nothing.

Here's the crash output of running `cpp -v -DABCDEFGHIJKLM` on the file:

----

Using built-in specs.
COLLECT_GCC=cpp
Target: x86_64-unknown-linux-gnu
Configured with: ./configure
Thread model: posix
gcc version 4.8.2 (GCC) 
COLLECT_GCC_OPTIONS='-E' '-v' '-D' 'ABCDEFGHIJKLM' '-o' 'ghc3240_8.pps'
'-mtune=generic' '-march=x86-64'
 /usr/local/libexec/gcc/x86_64-unknown-linux-gnu/4.8.2/cc1 -E -lang-asm -quiet
-v -D ABCDEFGHIJKLM ghc3240_8.s -o ghc3240_8.pps -mtune=generic -march=x86-64
-fno-directives-only
ignoring nonexistent directory
"/usr/local/lib/gcc/x86_64-unknown-linux-gnu/4.8.2/../../../../x86_64-unknown-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/local/lib/gcc/x86_64-unknown-linux-gnu/4.8.2/include
 /usr/local/include
 /usr/local/lib/gcc/x86_64-unknown-linux-gnu/4.8.2/include-fixed
 /usr/include
End of search list.
ghc3240_8.s:1:0: internal compiler error: Segmentation fault
 .section .rodata
 ^
0x80cdcf crash_signal
    ../.././gcc/toplev.c:332
0xc4916e get_data_from_adhoc_loc(line_maps*, unsigned int)
    ../.././libcpp/line-map.c:156
0xc371db expand_location_1
    ../.././gcc/input.c:57
0xc3740d expand_location(unsigned int)
    ../.././gcc/input.c:150
0x578c1d scan_translation_unit
    ../.././gcc/c-family/c-ppoutput.c:214
0x578c1d preprocess_file(cpp_reader*)
    ../.././gcc/c-family/c-ppoutput.c:101
0x5774d0 c_common_init()
    ../.././gcc/c-family/c-opts.c:1026
0x52e59d c_objc_common_init()
    ../.././gcc/c/c-objc-common.c:63
0x80e7c6 lang_dependent_init
    ../.././gcc/toplev.c:1688
0x80e7c6 do_compile
    ../.././gcc/toplev.c:1850


----

Here is a link to the Arch bug I've filed. You can find the offending file
(compressed) there:

    https://bugs.archlinux.org/task/39180

If any further information is desired, let me know. Thanks.

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-03-06
                 CC|                            |trippels at gcc dot gnu.org
      Known to work|                            |4.7.3
   Target Milestone|---                         |4.8.4
            Summary|C preprocessor segfaults on |[4.8/4.9 Regression] C
                   |assembly file               |preprocessor segfaults on
                   |                            |assembly file
     Ever confirmed|0                           |1
      Known to fail|                            |4.8.3, 4.9.0

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Confirmed. Both trunk and 4.8.3 segfault. 4.7.3 is fine.

/usr/libexec/gcc/x86_64-pc-linux-gnu/4.8.3/cc1 -o /dev/null -E -lang-asm -quiet
-v -D ABCDEFGHIJKLM ghc3240_8.s

#0  0x0000000000c7136e in get_data_from_adhoc_loc(line_maps*, unsigned int) ()
#1  0x0000000000c67fe8 in expand_location(unsigned int) ()
#2  0x00000000004cc7b3 in preprocess_file(cpp_reader*) ()
#3  0x0000000000c806df in c_common_init() ()
#4  0x0000000000c7c90c in c_objc_common_init() ()
#5  0x0000000000cc12fb in toplev_main(int, char**) ()
#6  0x00007ffff7756fb0 in __libc_start_main () from /lib/libc.so.6
#7  0x0000000000c7bb1a in _start ()

/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1 -o /dev/null -E -lang-asm -quiet
-v -D ABCDEFGHIJKLM ghc3240_8.s

#0  0x0000000000aeeaac in expand_location_1(unsigned int, bool) [clone
.lto_priv.2583] ()
#1  0x0000000000b60b10 in preprocess_file(cpp_reader*) ()
#2  0x0000000000b53316 in c_common_init() ()
#3  0x0000000000b1190b in c_objc_common_init() ()
#4  0x0000000000aeb141 in toplev_main(int, char**) ()
#5  0x00007ffff7756fb0 in __libc_start_main () from /lib/libc.so.6
#6  0x0000000000ae56e9 in _start ()

Valgrind shows:

==28570== Invalid read of size 4
==28570==    at 0xAEEAAC: expand_location_1(unsigned int, bool) [clone
.lto_priv.2583] (in /usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xB60B0F: preprocess_file(cpp_reader*) (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xB53315: c_common_init() (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xB1190A: c_objc_common_init() (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xAEB140: toplev_main(int, char**) (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0x4D70FAF: (below main) (in /lib64/libc-2.19.so)
==28570==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==28570== 
==28570== Invalid read of size 4
==28570==    at 0xAEEAAC: expand_location_1(unsigned int, bool) [clone
.lto_priv.2583] (in /usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xB6DB50: location_get_source_line(expanded_location, int*) (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xAEF365: diagnostic_show_locus(diagnostic_context*,
diagnostic_info const*) (in /usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xAEC294: diagnostic_report_diagnostic(diagnostic_context*,
diagnostic_info*) (in /usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0x4DC59B: internal_error(char const*, ...) (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xA377DB: crash_signal(int) [clone .lto_priv.1176] (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0x4D8508F: ??? (in /lib64/libc-2.19.so)
==28570==    by 0xAEEAAB: expand_location_1(unsigned int, bool) [clone
.lto_priv.2583] (in /usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xB60B0F: preprocess_file(cpp_reader*) (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xB53315: c_common_init() (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xB1190A: c_objc_common_init() (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==    by 0xAEB140: toplev_main(int, char**) (in
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.9.0/cc1)
==28570==  Address 0x610 is not stack'd, malloc'd or (recently) free'd

Could be related to PR58893.

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Strange, can't reproduce this myself using the same options, neither in
bootstrapped cc1, nor in non-bootstrapped -O0 built, nor bootstrapped cc1 under
valgrind, both 4.8 (older and latest) and trunk.
I'd have thought this would be r200376, but that is fixed on the trunk and now
(since today) on the 4.8 branch too.

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dehao at gcc dot gnu.org

--- Comment #4 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Probably started with r191494.

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

--- Comment #5 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
markus@x4 tmp % gdb --args /var/tmp/gcc_test/usr/local/bin/g++
-DTABLES_NEXT_TO_CODE -x assembler-with-cpp -c ghc3240_8.s
Reading symbols from /var/tmp/gcc_test/usr/local/bin/g++...done.
(gdb) run
Starting program: /var/tmp/gcc_test/usr/local/bin/g++ -DTABLES_NEXT_TO_CODE -x
assembler-with-cpp -c ghc3240_8.s
[New process 7553]
process 7553 is executing new program:
/var/tmp/gcc_test/usr/local/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/cc1

Program received signal SIGABRT, Aborted.
[Switching to process 7553]
0x00007ffff7604ff4 in raise () from /lib/libc.so.6
(gdb) bt
#0  0x00007ffff7604ff4 in raise () from /lib/libc.so.6
#1  0x00007ffff76063e7 in abort () from /lib/libc.so.6
#2  0x0000000000f25198 in linemap_location_from_macro_expansion_p
(set=<optimized out>, location=<optimized out>, location@entry=2147483542)
    at ../../gcc/libcpp/line-map.c:948
#3  0x0000000000f252ff in linemap_lookup (set=set@entry=0x7ffff7ff8000,
line=line@entry=2147483542) at ../../gcc/libcpp/line-map.c:642
#4  0x0000000000f253bc in linemap_macro_loc_to_exp_point (set=0x7ffff7ff8000,
location=2147483542, original_map=original_map@entry=0x7fffffffdfb8)
    at ../../gcc/libcpp/line-map.c:1181
#5  0x0000000000f25611 in linemap_resolve_location (set=<optimized out>,
loc=<optimized out>, loc@entry=2147483542, lrk=<optimized out>,
map=map@entry=0x7fffffffdfb8)
    at ../../gcc/libcpp/line-map.c:1262
#6  0x0000000000f0e3ae in expand_location_1 (loc=loc@entry=2147483542,
expansion_point_p=expansion_point_p@entry=true) at ../../gcc/gcc/input.c:164
#7  0x0000000000f0f08e in expand_location (loc=loc@entry=2147483542) at
../../gcc/gcc/input.c:724
#8  0x00000000005ec236 in maybe_print_line_1 (stream=0x15e2860,
src_loc=2147483542) at ../../gcc/gcc/c-family/c-ppoutput.c:314
#9  maybe_print_line (src_loc=src_loc@entry=2147483542) at
../../gcc/gcc/c-family/c-ppoutput.c:351
#10 0x00000000005ec7fb in do_line_change (pfile=0x15d8cd0, token=0x15d9210,
src_loc=2147483542, parsing_args=0) at ../../gcc/gcc/c-family/c-ppoutput.c:420
#11 0x0000000000f240b4 in _cpp_lex_token (pfile=0x15d8cd0) at
../../gcc/libcpp/lex.c:2078
#12 0x0000000000f28d10 in cpp_get_token_1 (pfile=0x15d8cd0, location=0x1d81,
location@entry=0x7fffffffe134) at ../../gcc/libcpp/macro.c:2359
#13 0x0000000000f28f75 in cpp_get_token_with_location
(pfile=pfile@entry=0x15d8cd0, loc=loc@entry=0x7fffffffe134) at
../../gcc/libcpp/macro.c:2541
#14 0x00000000005ec9d8 in scan_translation_unit (pfile=0x15d8cd0) at
../../gcc/gcc/c-family/c-ppoutput.c:176
#15 preprocess_file (pfile=0x15d8cd0) at
../../gcc/gcc/c-family/c-ppoutput.c:101
#16 0x00000000005eb3e9 in c_common_init () at
../../gcc/gcc/c-family/c-opts.c:1040
#17 0x000000000057dd7e in c_objc_common_init () at
../../gcc/gcc/c/c-objc-common.c:65
#18 0x000000000099f477 in lang_dependent_init (name=0x7fffffffe73b
"ghc3240_8.s") at ../../gcc/gcc/toplev.c:1712
#19 do_compile () at ../../gcc/gcc/toplev.c:1900
#20 toplev_main (argc=14, argv=0x7fffffffe2c8) at ../../gcc/gcc/toplev.c:1990
#21 0x00007ffff75f0fb0 in __libc_start_main () from /lib/libc.so.6
#22 0x00000000005306a1 in _start ()
(gdb)

location@entry=2147483542 = 0x7FFFFF96 is near "#define MAX_SOURCE_LOCATION
0x7FFFFFFF"

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jsm28 at gcc dot gnu.org

--- Comment #6 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to Markus Trippelsdorf from comment #4)
> Probably started with r191494.

No, sorry.
This issue started with r192715.

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

--- Comment #7 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Adding "-nostdinc" is a simple workaround.

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[joseph at codesourcery dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

--- Comment #8 from joseph at codesourcery dot com <joseph at codesourcery dot com> ---
Implicit preincludes should probably be disabled when preprocessing .S 
files (though I don't know if that would help with this issue).

[Bug preprocessor/60436] [4.8/4.9 Regression] C preprocessor segfaults on assembly file

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug preprocessor/60436] [4.8/4.9/5 Regression] C preprocessor segfaults on assembly file

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |jakub at gcc dot gnu.org
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 34089
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34089&action=edit
gcc5-pr60436.patch

Untested fix.  For add_map we have code to handle this.  But if add_map is
false too many times, we can still overflow.  This patch forces add_map to true
if highest is too high.

[Bug preprocessor/60436] [4.8/4.9/5 Regression] C preprocessor segfaults on assembly file

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Tue Nov 25 11:16:27 2014
New Revision: 218042

URL: https://gcc.gnu.org/viewcvs?rev=218042&root=gcc&view=rev
Log:
    PR preprocessor/60436
    * line-map.c (linemap_line_start): If highest is above 0x60000000
    and we are still tracking columns or highest is above 0x70000000,
    force add_map.

Modified:
    trunk/libcpp/ChangeLog
    trunk/libcpp/line-map.c

[Bug preprocessor/60436] [4.8/4.9/5 Regression] C preprocessor segfaults on assembly file

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Fri Nov 28 13:37:13 2014
New Revision: 218154

URL: https://gcc.gnu.org/viewcvs?rev=218154&root=gcc&view=rev
Log:
    Backported from mainline
    2014-11-25  Jakub Jelinek  <jakub@redhat.com>

    PR preprocessor/60436
    * line-map.c (linemap_line_start): If highest is above 0x60000000
    and we are still tracking columns or highest is above 0x70000000,
    force add_map.

Modified:
    branches/gcc-4_9-branch/libcpp/ChangeLog
    branches/gcc-4_9-branch/libcpp/line-map.c

[Bug preprocessor/60436] [4.8/4.9/5 Regression] C preprocessor segfaults on assembly file

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Fri Nov 28 17:05:34 2014
New Revision: 218168

URL: https://gcc.gnu.org/viewcvs?rev=218168&root=gcc&view=rev
Log:
    Backported from mainline
    2014-11-25  Jakub Jelinek  <jakub@redhat.com>

    PR preprocessor/60436
    * line-map.c (linemap_line_start): If highest is above 0x60000000
    and we are still tracking columns or highest is above 0x70000000,
    force add_map.

Modified:
    branches/gcc-4_8-branch/libcpp/ChangeLog
    branches/gcc-4_8-branch/libcpp/line-map.c

[Bug preprocessor/60436] [4.8/4.9/5 Regression] C preprocessor segfaults on assembly file

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60436

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.