Function arguments related segfault on amd64

[Henri Kemppainen]

% cat fuu.c
void fun(int badarg[][4][4]) {
return;
}

% ~/pre/bin/pcc -v fuu.c
pcc 1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9
/home/duclare/pre/libexec/cpp -v -D__PCC__=1 -D__PCC_MINOR__=1
-D__PCC_MINORMINOR__=0 -D__GNUC__=4 -D__GNUC_MINOR__=3
-D__GNUC_PATCHLEVEL__=1 -D__GNUC_STDC_INLINE__=1 -D__VERSION__="pcc
1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9" -D__SCHAR_MAX__=127
-D__SHRT_MAX__=32767 -D__INT_MAX__=0x7fffffff
-D__LONG_MAX__=0x7fffffffffffffffL
-D__LONG_LONG_MAX__=0x7fffffffffffffffLL -D__REGISTER_PREFIX__=
-D__USER_LABEL_PREFIX__= -D__OpenBSD__ -D__ELF__
-D__STDC_ISO_10646__=200009L -D__WCHAR_TYPE__=int -D__SIZEOF_WCHAR_T__=4
-D__WCHAR_MAX__=2147483647 -D__WINT_TYPE__=unsigned int
-D__SIZE_TYPE__=unsigned long -D__PTRDIFF_TYPE__=long int
-D__SIZEOF_WINT_T__=4 -D__amd64__ -S /home/duclare/pre/include/pcc/ -S
/usr/include/ -S
/home/duclare/pre/lib/pcc/x86_64-unknown-openbsd4.9/1.1.0.DEVEL/include/
fuu.c /tmp/ctm.EJhM98
cpp: pcc 1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9
/home/duclare/pre/libexec/ccom -v /tmp/ctm.EJhM98 /tmp/ctm.2nTebM
ccom: pcc 1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9
major internal compiler error: fuu.c, line 1

% gdb ~/pre/libexec/ccom
(gdb) run fuu.c
Starting program: /home/duclare/pre/libexec/ccom fuu.c

Program received signal SIGSEGV, Segmentation fault.
0x0000000000409f4d in bfcode (s=0x20b8df130, cnt=1)
at ../../arch/amd64/code.c:309
309 for (; al->type != TELLIPSIS; al++) {
(gdb) bt
#0 0x0000000000409f4d in bfcode (s=0x20b8df130, cnt=1)
at ../../arch/amd64/code.c:309
#1 0x0000000000420d4c in dclargs () at ./pftn.c:640
#2 0x00000000004073bb in yyparse () at cgram.y:771
#3 0x00000000004161c0 in main (argc=1, argv=0x7f7ffffbd000) at
./main.c:324

It looks like this loop in bfcode() skips over the TNULL that should
terminate it. I didn't dig deep enough to figure out if it's a bug
in the loop or somewhere up the stream. Didn't test on i386.

[Anders Magnusson]

Fixed now, thanks for the bug report!

-- Ragge

Post by Henri Kemppainen
% cat fuu.c
void fun(int badarg[][4][4]) {
return;
}
% ~/pre/bin/pcc -v fuu.c
pcc 1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9
/home/duclare/pre/libexec/cpp -v -D__PCC__=1 -D__PCC_MINOR__=1
-D__PCC_MINORMINOR__=0 -D__GNUC__=4 -D__GNUC_MINOR__=3
-D__GNUC_PATCHLEVEL__=1 -D__GNUC_STDC_INLINE__=1 -D__VERSION__="pcc
1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9" -D__SCHAR_MAX__=127
-D__SHRT_MAX__=32767 -D__INT_MAX__=0x7fffffff
-D__LONG_MAX__=0x7fffffffffffffffL
-D__LONG_LONG_MAX__=0x7fffffffffffffffLL -D__REGISTER_PREFIX__=
-D__USER_LABEL_PREFIX__= -D__OpenBSD__ -D__ELF__
-D__STDC_ISO_10646__=200009L -D__WCHAR_TYPE__=int -D__SIZEOF_WCHAR_T__=4
-D__WCHAR_MAX__=2147483647 -D__WINT_TYPE__=unsigned int
-D__SIZE_TYPE__=unsigned long -D__PTRDIFF_TYPE__=long int
-D__SIZEOF_WINT_T__=4 -D__amd64__ -S /home/duclare/pre/include/pcc/ -S
/usr/include/ -S
/home/duclare/pre/lib/pcc/x86_64-unknown-openbsd4.9/1.1.0.DEVEL/include/
fuu.c /tmp/ctm.EJhM98
cpp: pcc 1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9
/home/duclare/pre/libexec/ccom -v /tmp/ctm.EJhM98 /tmp/ctm.2nTebM
ccom: pcc 1.1.0.DEVEL 20110719 for x86_64-unknown-openbsd4.9
major internal compiler error: fuu.c, line 1
% gdb ~/pre/libexec/ccom
(gdb) run fuu.c
Starting program: /home/duclare/pre/libexec/ccom fuu.c
Program received signal SIGSEGV, Segmentation fault.
0x0000000000409f4d in bfcode (s=0x20b8df130, cnt=1)
at ../../arch/amd64/code.c:309
309 for (; al->type != TELLIPSIS; al++) {
(gdb) bt
#0 0x0000000000409f4d in bfcode (s=0x20b8df130, cnt=1)
at ../../arch/amd64/code.c:309
#1 0x0000000000420d4c in dclargs () at ./pftn.c:640
#2 0x00000000004073bb in yyparse () at cgram.y:771
#3 0x00000000004161c0 in main (argc=1, argv=0x7f7ffffbd000) at
./main.c:324
It looks like this loop in bfcode() skips over the TNULL that should
terminate it. I didn't dig deep enough to figure out if it's a bug
in the loop or somewhere up the stream. Didn't test on i386.

[Henri Kemppainen]

Post by Anders Magnusson
Fixed now, thanks for the bug report!

Post by Henri Kemppainen
% cat fuu.c
void fun(int badarg[][4][4]) {
return;
}

Thanks for the fix. Can we apply the same change to funcode() as well?
With this, calling the function above won't crash the compiler, and I
can succesfully build libtheora.

Index: arch/amd64/code.c
===================================================================
RCS file: /cvsroot/pcc/arch/amd64/code.c,v
retrieving revision 1.61
diff -u -p -r1.61 code.c
--- arch/amd64/code.c 12 Aug 2011 15:33:58 -0000 1.61
+++ arch/amd64/code.c 20 Aug 2011 11:26:02 -0000
@@ -855,6 +855,7 @@ funcode(NODE *p)
{
NODE *l, *r;
TWORD t;
+ int i;

nsse = ngpr = nrsp = 0;
/* Check if hidden arg needed */
@@ -882,11 +883,13 @@ funcode(NODE *p)
for (; al->type != TELLIPSIS; al++) {
if ((t = al->type) == TNULL)
return p; /* No need */
- if (BTYPE(t) == STRTY || BTYPE(t) == UNIONTY)
+ if (ISSOU(BTYPE(t)))
al++;
- for (; t > BTMASK; t = DECREF(t))
+ for (i = 0; t > BTMASK; t = DECREF(t))
if (ISARY(t) || ISFTN(t))
- al++;
+ i++;
+ if (i)
+ al++;
}
}

[Anders Magnusson]

Post by Henri Kemppainen

Post by Anders Magnusson
Fixed now, thanks for the bug report!

Post by Henri Kemppainen
% cat fuu.c
void fun(int badarg[][4][4]) {
return;
}

Thanks for the fix. Can we apply the same change to funcode() as well?
With this, calling the function above won't crash the compiler, and I
can succesfully build libtheora.

Of course, thanks, applied. Hm, I should have common routines to
check this stuff I suppose.

-- Ragge

Post by Henri Kemppainen
Index: arch/amd64/code.c
===================================================================
RCS file: /cvsroot/pcc/arch/amd64/code.c,v
retrieving revision 1.61
diff -u -p -r1.61 code.c
--- arch/amd64/code.c 12 Aug 2011 15:33:58 -0000 1.61
+++ arch/amd64/code.c 20 Aug 2011 11:26:02 -0000
@@ -855,6 +855,7 @@ funcode(NODE *p)
{
NODE *l, *r;
TWORD t;
+ int i;
nsse = ngpr = nrsp = 0;
/* Check if hidden arg needed */
@@ -882,11 +883,13 @@ funcode(NODE *p)
for (; al->type != TELLIPSIS; al++) {
if ((t = al->type) == TNULL)
return p; /* No need */
- if (BTYPE(t) == STRTY || BTYPE(t) == UNIONTY)
+ if (ISSOU(BTYPE(t)))
al++;
- for (; t> BTMASK; t = DECREF(t))
+ for (i = 0; t> BTMASK; t = DECREF(t))
if (ISARY(t) || ISFTN(t))
- al++;
+ i++;
+ if (i)
+ al++;
}
}