bug#47067: 28.0.50; [feature/native-comp] Crash while scrolling through dispnew.c

[Andrea Corallo]

Eli Zaretskii <eliz@gnu.org> writes:

>> Date: Sun, 14 Mar 2021 15:31:43 +0200
>> From: Eli Zaretskii <eliz@gnu.org>
>> Cc: akrl@sdf.org, 47067@debbugs.gnu.org
>> 
>> > Still don't have a Windows machine (and I gave up on setting up a Wine
>> > environment for Emacs testing), so can someone check this compiles on
>> > WINDOWSNT and avoids the crash?
>> 
>> Compiles and avoids the crash, thanks.
>> 
>> This also has a positive effect on backtraces: fewer "??" thingies,
>> and the backtrace is truncated further upward and without the error
>> message from GDB.
>
> stage2 of comp-tests.el still crashes.  But this time I have a
> backtrace (let me know if you need me to demangle the libgccjit part
> of the backtrace):
>
>   Thread 1 received signal SIGSEGV, Segmentation fault.
>   [Switching to Thread 8020.0x16c4]
>   0x074abd71 in libgccjit-0!_Z23ipcp_transform_functionP11cgraph_node ()
>    from d:\usr\bin\libgccjit-0.dll
>   (gdb) bt
>   #0  0x074abd71 in libgccjit-0!_Z23ipcp_transform_functionP11cgraph_node ()
>    from d:\usr\bin\libgccjit-0.dll
>   #1  0x0759b7c5 in libgccjit-0!_Z26execute_all_ipa_transformsb ()
>    from d:\usr\bin\libgccjit-0.dll
>   #2  0x072d76ea in libgccjit-0!_ZN11cgraph_node6expandEv ()
>    from d:\usr\bin\libgccjit-0.dll
>   #3  0x072d86c9 in libgccjit-0!_ZN12symbol_table15output_weakrefsEv ()
>    from d:\usr\bin\libgccjit-0.dll
>   #4  0x072da6f1 in libgccjit-0!_ZN12symbol_table25finalize_compilation_unitEv
>     () from d:\usr\bin\libgccjit-0.dll
>   #5  0x0765c551 in libgccjit-0!_ZN5timer3popE12timevar_id_t ()
>    from d:\usr\bin\libgccjit-0.dll
>   #6  0x07fc9e4c in libgccjit-0!_ZN6toplev4mainEiPPc ()
>    from d:\usr\bin\libgccjit-0.dll
>   #7  0x072478ca in libgccjit-0!_ZN3gcc3jit8playback7context7compileEv ()
>    from d:\usr\bin\libgccjit-0.dll
>   #8  0x0723b9b8 in 
> libgccjit-0!_ZN3gcc3jit9recording7context15compile_to_fileE19gcc_jit_output_kindPKc
>  () from d:\usr\bin\libgccjit-0.dll
>   #9  0x0722e29e in libgccjit-0!gcc_jit_context_compile_to_file ()
>    from d:\usr\bin\libgccjit-0.dll
>   #10 0x012de6fe in Fcomp__compile_ctxt_to_file (
>     filename=XIL(0x800000000968c910)) at comp.c:4502
>   #11 0x01260916 in funcall_subr (subr=0x17340c0 
> <Scomp__compile_ctxt_to_file>,
>     numargs=1, args=0x82b3f8) at eval.c:3095
>   #12 0x0126035f in Ffuncall (nargs=2, args=0x82b3f0) at eval.c:3016
>   #13 0x0ee85513 in 
> F636f6d702d636f6d70696c652d637478742d746f2d66696c65_comp_compile_ctxt_to_file_0
>  ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\stage1-oKpQqd-5af2e625-ed123e94.eln
>   #14 0x01260916 in funcall_subr (subr=0xc5c08d0, numargs=1, args=0x82b608)
>     at eval.c:3095
>   #15 0x0126035f in Ffuncall (nargs=2, args=0x82b600) at eval.c:3016
>   #16 0x0ee856e6 in F636f6d702d66696e616c31_comp_final1_0 ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\stage1-oKpQqd-5af2e625-ed123e94.eln
>   #17 0x012608fa in funcall_subr (subr=0xc5c9018, numargs=0, args=0x82b930)
>     at eval.c:3093
>   #18 0x0126035f in Ffuncall (nargs=1, args=0x82b928) at eval.c:3016
>   #19 0x0ee86601 in F636f6d702d66696e616c_comp_final_0 ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\stage1-oKpQqd-5af2e625-ed123e94.eln
>   #20 0x01260916 in funcall_subr (subr=0xc5c9dc8, numargs=1, args=0x82bbc8)
>     at eval.c:3095
>   #21 0x0126035f in Ffuncall (nargs=2, args=0x82bbc0) at eval.c:3016
>   #22 0x0ee8ad5a in 
> F636f6d702d2d6e61746976652d636f6d70696c65_comp__native_compile_0 ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\stage1-oKpQqd-5af2e625-ed123e94.eln
>   #23 0x0126098d in funcall_subr (subr=0xc533ff0, numargs=3, args=0x82bdc8)
>     at eval.c:3100
>   #24 0x0126035f in Ffuncall (nargs=4, args=0x82bdc0) at eval.c:3016
>   #25 0x0ee8c050 in F6e61746976652d636f6d70696c65_native_compile_0 ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\stage1-oKpQqd-5af2e625-ed123e94.eln
>   #26 0x0125de95 in eval_sub (form=XIL(0xc000000006c9c180)) at eval.c:2487
>   #27 0x01258978 in Flet (args=XIL(0xc000000006d68130)) at eval.c:1027
>   #28 0x0125da4f in eval_sub (form=XIL(0xc000000006d680f0)) at eval.c:2437
>   #29 0x01256014 in Fprogn (body=XIL(0)) at eval.c:471
>   #30 0x01258672 in FletX (args=XIL(0xc000000006d68090)) at eval.c:989
>   #31 0x0125da4f in eval_sub (form=XIL(0xc000000006d68050)) at eval.c:2437
>   #32 0x01256014 in Fprogn (body=XIL(0)) at eval.c:471
>   #33 0x01258672 in FletX (args=XIL(0xc000000006d67fa0)) at eval.c:989
>   #34 0x0125da4f in eval_sub (form=XIL(0xc000000006d67f90)) at eval.c:2437
>   #35 0x01256014 in Fprogn (body=XIL(0)) at eval.c:471
>   #36 0x01261a30 in funcall_lambda (fun=XIL(0xc000000006f79830), nargs=0,
>     arg_vector=0x82c828) at eval.c:3297
>   #37 0x01260598 in Ffuncall (nargs=1, args=0x82c820) at eval.c:3036
>   #38 0x012cbfbc in exec_byte_code (bytestr=XIL(0x8000000006ce8d20),
>     vector=XIL(0xa000000006790318), maxdepth=make_fixnum(10),
>     args_template=make_fixnum(257), nargs=1, args=0x82ced8) at bytecode.c:632
>   #39 0x01260ecf in fetch_and_exec_byte_code (fun=XIL(0xa000000006790420),
>     syms_left=make_fixnum(257), nargs=1, args=0x82ced0) at eval.c:3144
>   #40 0x0126144c in funcall_lambda (fun=XIL(0xa000000006790420), nargs=1,
>     arg_vector=0x82ced0) at eval.c:3225
>   #41 0x012603fa in Ffuncall (nargs=2, args=0x82cec8) at eval.c:3023
>   #42 0x012cbfbc in exec_byte_code (bytestr=XIL(0x8000000006ce8dc0),
>     vector=XIL(0xa000000006790610), maxdepth=make_fixnum(11),
>     args_template=make_fixnum(257), nargs=1, args=0x82d530) at bytecode.c:632
>   #43 0x01260ecf in fetch_and_exec_byte_code (fun=XIL(0xa0000000067906f0),
>     syms_left=make_fixnum(257), nargs=1, args=0x82d528) at eval.c:3144
>   #44 0x0126144c in funcall_lambda (fun=XIL(0xa0000000067906f0), nargs=1,
>     arg_vector=0x82d528) at eval.c:3225
>   #45 0x012603fa in Ffuncall (nargs=2, args=0x82d520) at eval.c:3023
>   #46 0x012cbfbc in exec_byte_code (bytestr=XIL(0x8000000006cec680),
>     vector=XIL(0xa000000006886b08), maxdepth=make_fixnum(11),
>     args_template=make_fixnum(771), nargs=3, args=0x82dba8) at bytecode.c:632
>   #47 0x01260ecf in fetch_and_exec_byte_code (fun=XIL(0xa000000006886ba8),
>     syms_left=make_fixnum(771), nargs=3, args=0x82db90) at eval.c:3144
>   #48 0x0126144c in funcall_lambda (fun=XIL(0xa000000006886ba8), nargs=3,
>     arg_vector=0x82db90) at eval.c:3225
>   #49 0x012603fa in Ffuncall (nargs=4, args=0x82db88) at eval.c:3023
>   #50 0x012cbfbc in exec_byte_code (bytestr=XIL(0x8000000006cec6e0),
>     vector=XIL(0xa000000006886c90), maxdepth=make_fixnum(13),
>     args_template=make_fixnum(770), nargs=3, args=0x82e1e8) at bytecode.c:632
>   #51 0x01260ecf in fetch_and_exec_byte_code (fun=XIL(0xa000000006886d68),
>     syms_left=make_fixnum(770), nargs=3, args=0x82e1d0) at eval.c:3144
>   #52 0x0126144c in funcall_lambda (fun=XIL(0xa000000006886d68), nargs=3,
>     arg_vector=0x82e1d0) at eval.c:3225
>   #53 0x012603fa in Ffuncall (nargs=4, args=0x82e1c8) at eval.c:3023
>   #54 0x012cbfbc in exec_byte_code (bytestr=XIL(0x8000000006cefe10),
>     vector=XIL(0xa00000000688acc0), maxdepth=make_fixnum(7),
>     args_template=make_fixnum(256), nargs=1, args=0x82e7b0) at bytecode.c:632
>   #55 0x01260ecf in fetch_and_exec_byte_code (fun=XIL(0xa00000000688acf0),
>     syms_left=make_fixnum(256), nargs=1, args=0x82e7a8) at eval.c:3144
>   #56 0x0126144c in funcall_lambda (fun=XIL(0xa00000000688acf0), nargs=1,
>     arg_vector=0x82e7a8) at eval.c:3225
>   #57 0x012603fa in Ffuncall (nargs=2, args=0x82e7a0) at eval.c:3023
>   #58 0x012cbfbc in exec_byte_code (bytestr=XIL(0x8000000006ceffe0),
>     vector=XIL(0xa00000000688ad90), maxdepth=make_fixnum(6),
>     args_template=make_fixnum(256), nargs=1, args=0x82ecd8) at bytecode.c:632
>   #59 0x01260ecf in fetch_and_exec_byte_code (fun=XIL(0xa00000000688adf8),
>     syms_left=make_fixnum(256), nargs=1, args=0x82ecd0) at eval.c:3144
>   #60 0x0126144c in funcall_lambda (fun=XIL(0xa00000000688adf8), nargs=1,
>     arg_vector=0x82ecd0) at eval.c:3225
>   #61 0x01261095 in apply_lambda (fun=XIL(0xa00000000688adf8),
>     args=XIL(0xc00000000970f360), count=11) at eval.c:3169
>   #62 0x0125e420 in eval_sub (form=XIL(0xc00000000970f430)) at eval.c:2531
>   #63 0x0125d2cb in Feval (form=XIL(0xc00000000970f430), lexical=XIL(0x30))
>     at eval.c:2313
>   #64 0x06b757b6 in F636f6d6d616e642d6c696e652d31_command_line_1_0 ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\startup-bbc6ea72-9be7c541.eln
>   #65 0x01260916 in funcall_subr (subr=0x5dd3bcc, numargs=1, args=0x82f3e8)
>     at eval.c:3095
>   #66 0x0126035f in Ffuncall (nargs=2, args=0x82f3e0) at eval.c:3016
>   #67 0x06b6af88 in F636f6d6d616e642d6c696e65_command_line_0 ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\startup-bbc6ea72-9be7c541.eln
>   #68 0x012608fa in funcall_subr (subr=0x5de5bec, numargs=0, args=0x82f638)
>     at eval.c:3093
>   #69 0x0126035f in Ffuncall (nargs=1, args=0x82f630) at eval.c:3016
>   #70 0x06b65dd5 in F6e6f726d616c2d746f702d6c6576656c_normal_top_level_0 ()
>    from 
> d:\gnu\git\emacs\native-comp\native-lisp\28.0.50-88a242e7\startup-bbc6ea72-9be7c541.eln
>   #71 0x0125de17 in eval_sub (form=XIL(0xc000000005dcd95c)) at eval.c:2481
>   #72 0x0125d2cb in Feval (form=XIL(0xc000000005dcd95c), lexical=XIL(0))
>     at eval.c:2313
>   #73 0x01164353 in top_level_2 () at keyboard.c:1103
>   #74 0x0125a2e9 in internal_condition_case (bfun=0x1164320 <top_level_2>,
>     handlers=XIL(0x90), hfun=0x1163ad1 <cmd_error>) at eval.c:1448
>   #75 0x011643cd in top_level_1 (ignore=XIL(0)) at keyboard.c:1111
>   #76 0x012593cc in internal_catch (tag=XIL(0xee80),
>     func=0x1164359 <top_level_1>, arg=XIL(0)) at eval.c:1198
>   #77 0x01164225 in command_loop () at keyboard.c:1072
>   #78 0x01163561 in recursive_edit_1 () at keyboard.c:720
>   #79 0x011637cf in Frecursive_edit () at keyboard.c:789
>   #80 0x0115ee6e in main (argc=14, argv=0xa445f8) at emacs.c:2095

Hi Eli,

this really look like a libgccjit bug.  I think would be interesting if
you have time to:

1- produce a libgccjit reproducer (applying the attached patch before
running the test) and post it so we can check if we can reproduce and
investigate this on other setups.

2- run all the comp-tests.el tests excluding `comp-tests-bootstrap' just
to make sure we are fine with all the reduced testcases.

Thanks!

  Andrea

diff --git a/test/src/comp-tests.el b/test/src/comp-tests.el
index f60e4ab049..3813728687 100644
--- a/test/src/comp-tests.el
+++ b/test/src/comp-tests.el
@@ -75,8 +75,9 @@ comp-tests-bootstrap
       (load comp1-eln nil nil t t)
       (should (subr-native-elisp-p (symbol-function 'native-compile)))
       (message "Compiling stage2...")
-      (let ((t0 (current-time))
-            (comp2-eln (native-compile comp2-src)))
+      (let* ((comp-libgccjit-reproducer t)
+             (t0 (current-time))
+             (comp2-eln (native-compile comp2-src)))
         (message "Done in %d secs" (float-time (time-since t0)))
         (message "Comparing %s %s" comp1-eln comp2-eln)
         (should (= (call-process "cmp" nil nil nil comp1-eln comp2-eln) 0))))))