bug#39208: [3.0.0] Segfault while building on ARMv7

Ludovic Courtès <[email protected]> skribis:

> Unfortunately I’m unable to reproduce the bug outside Guix’s build
> environment, even with ASLR disabled (what guix-daemon does).

I finally managed to reproduce it with from the failed-build tree:

  rm -vf bootstrap/language/cps/{slot-allocation,specialize-numbers,specialize-primcalls,spec}.go
  GUILE_JIT_LOG=4 /run/current-system/profile/bin/linux32 -R make

which shows:

--8<---------------cut here---------------start------------->8---
jit: entering mcode: 0xf7a5d1c0
jit: exited mcode
jit: entering mcode: 0xf7a5d1c0
jit: exited mcode
jit: entering mcode: 0xf7956ca0
jit: exited mcode
jit: entering mcode: 0xf791a9f0
jit: exited mcode
jit: entering mcode: 0xf78b03d0
jit: exited mcode
jit: entering mcode: 0xf7a5d1c0
jit: exited mcode
jit: entering mcode: 0xf79407bb
jit: exited mcode
jit: entering mcode: 0xf7a5d1c0
jit: exited mcode
jit: entering mcode: 0xf79407bb
jit: exited mcode
jit: entering mcode: 0xf7a5d1c0
jit: exited mcode
jit: vcode: start=0xf5fe95d4,+203 entry=+0
jit: mcode: 0xf5c3eac0,+2288
jit: entering mcode: 0xf5c3eac0
jit: exited mcode
jit: vcode: start=0xf5fe9900,+203 entry=+0
jit: mcode: 0xf5c3f3b0,+2288
jit: entering mcode: 0xf5c3f3b0
jit: exited mcode
jit: vcode: start=0xf5fe9c2c,+203 entry=+0
jit: mcode: 0xf5c3fca0,+2288
jit: entering mcode: 0xf5c3fca0
jit: exited mcode
jit: vcode: start=0xf5fe9f58,+203 entry=+0
jit: mcode: 0xf5c40590,+2288
jit: entering mcode: 0xf5c40590
jit: exited mcode
jit: vcode: start=0xf5fea284,+203 entry=+0
jit: mcode: 0xf5c40e80,+2288
jit: entering mcode: 0xf5c40e80
jit: exited mcode
jit: vcode: start=0xf5fea5b0,+203 entry=+0
jit: mcode: 0xf5c41770,+2288
jit: entering mcode: 0xf5c41770
jit: exited mcode
jit: vcode: start=0xf5fea8dc,+203 entry=+0
jit: mcode: 0xf5c42060,+2288
jit: entering mcode: 0xf5c42060
jit: exited mcode
jit: vcode: start=0xf5feac08,+203 entry=+0
jit: mcode: 0xf5c42950,+2288
jit: entering mcode: 0xf5c42950
jit: exited mcode
jit: vcode: start=0xf5feaf34,+203 entry=+0
jit: mcode: 0xf5c43240,+2288
jit: entering mcode: 0xf5c43240
jit: exited mcode
jit: vcode: start=0xf5feb260,+203 entry=+0
jit: mcode: 0xf5c43b30,+2280
jit: entering mcode: 0xf5c43b30
/gnu/store/nvkn00kq4x4g5wjjjvjj6rhzs0ihihxl-bash-minimal-5.0.7/bin/bash: line 6: 13151 Segmentation fault      (core dumped) GUILE_AUTO_COMPILE=0 ../meta/build-env guild compile --target="arm-unknown-linux-gnueabihf" -O1 -Oresolve-primitives -L "/tmp/guix-build-guile-next-3.0.0.drv-0/guile-3.0.0/module" -L "/tmp/guix-build-guile-next-3.0.0.drv-0/guile-3.0.0/guile-readline" -o "language/cps/slot-allocation.go" "../module/language/cps/slot-allocation.scm"
make[2]: *** [Makefile:1931: language/cps/slot-allocation.go] Error 139
--8<---------------cut here---------------end--------------->8---

Backtrace:

--8<---------------cut here---------------start------------->8---
#0  0xf5c43ca4 in ?? ()
[Current thread is 1 (Thread 0xf7fe8010 (LWP 13151))]
(gdb) bt
#0  0xf5c43ca4 in ?? ()
#1  0xf7f3ffcc in scm_jit_enter_mcode (thread=0x74fe10,
    mcode=0xf5c43b30 " 8\r\032(-@\360c\203%i\250B\300\362_\203\240`\245m") at jit.c:5725
#2  0x00021048 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) disassemble 0xf5c43b30,+2280
Dump of assembler code from 0xf5c43b30 to 0xf5c44418:
   0xf5c43b30:  subs    r0, #32
   0xf5c43b32:  subs    r5, r1, r0
   0xf5c43b34:  cmp     r5, #40 ; 0x28
   0xf5c43b36:  bne.w   0xf5c44200
   0xf5c43b3a:  ldr     r5, [r4, #16]
   0xf5c43b3c:  cmp     r0, r5
   0xf5c43b3e:  blt.w   0xf5c44200
   0xf5c43b42:  str     r0, [r4, #8]
   0xf5c43b44:  ldr     r5, [r4, #88]   ; 0x58
   0xf5c43b46:  cmp     r5, #0
   0xf5c43b48:  beq.w   0xf5c44232
   0xf5c43b4c:  ldrt    r6, [r5]
   0xf5c43b50:  str     r6, [r4, #88]   ; 0x58
   0xf5c43b52:  str     r5, [r0, #24]
   0xf5c43b54:  movw    r5, #1293       ; 0x50d
   0xf5c43b58:  movs    r6, #0
[…]
   0xf5c43c52:  and.w   r5, r5, #127    ; 0x7f
   0xf5c43c56:  cmp     r5, #13
   0xf5c43c58:  bne.w   0xf5c4411e
   0xf5c43c5c:  ldr     r5, [r0, #32]
   0xf5c43c5e:  ldr     r5, [r5, #20]
   0xf5c43c60:  str     r5, [r0, #16]
   0xf5c43c62:  ldr     r5, [r0, #16]
   0xf5c43c64:  ldrt    r5, [r5]
   0xf5c43c68:  str     r5, [r0, #16]
   0xf5c43c6a:  eors    r5, r5
   0xf5c43c6c:  str     r5, [r0, #20]
   0xf5c43c6e:  ldr     r5, [r0, #16]
   0xf5c43c70:  ldr     r6, [r0, #20]
   0xf5c43c72:  lsls    r2, r6, #24
   0xf5c43c74:  lsrs    r6, r6, #8
   0xf5c43c76:  lsrs    r5, r5, #8
   0xf5c43c78:  adds    r5, r5, r2
   0xf5c43c7a:  str     r5, [r0, #16]
   0xf5c43c7c:  str     r6, [r0, #20]
   0xf5c43c7e:  ldr     r5, [r0, #16]
   0xf5c43c80:  ldr     r6, [r0, #20]
   0xf5c43c82:  cmp     r6, #0
   0xf5c43c84:  blt.w   0xf5c440fe
   0xf5c43c88:  cmp     r6, #0
   0xf5c43c8a:  bne.w   0xf5c43c94
   0xf5c43c8e:  cmp     r5, #0
   0xf5c43c90:  ble.w   0xf5c440fe
   0xf5c43c94:  ldr     r5, [r0, #32]
   0xf5c43c96:  ldr     r5, [r5, #20]
   0xf5c43c98:  str     r5, [r0, #16]
   0xf5c43c9a:  ldr     r5, [r0, #16]
   0xf5c43c9c:  ldr     r5, [r5, #4]
   0xf5c43c9e:  str     r5, [r0, #16]
   0xf5c43ca0:  mov.w   r12, #0
=> 0xf5c43ca4:  ldrt    r5, [r12]
   0xf5c43ca8:  str     r5, [r0, #8]
[…]
   0xf5c443fc:  ands    r0, r6
   0xf5c443fe:                  ; <UNDEFINED> instruction: 0xf7a24f00
   0xf5c44402:  mov     pc, r7
   0xf5c44404:  ands    r0, r6
   0xf5c44406:                  ; <UNDEFINED> instruction: 0xf7a24f00
   0xf5c4440a:  mov     pc, r7
   0xf5c4440c:  ands    r0, r6
   0xf5c4440e:                  ; <UNDEFINED> instruction: 0xf7a24f00
   0xf5c44412:  mov     pc, r7
   0xf5c44414:  ands    r0, r6
   0xf5c44416:                  ; <UNDEFINED> instruction: 0xf7a20000
End of assembler dump.
(gdb) p $r12
$1 = 0
--8<---------------cut here---------------end--------------->8---

Apparently r12 is JIT_TMP0.

Anyway, it seems that I have an environment in which to reproduce and
debug it now.

Ludo’.