From: xtkoba+ruby@...
Date: 2021-03-01T02:16:09+00:00
Subject: [ruby-core:102673] [Ruby master Bug#17540] A segfault due to Clang/LLVM optimization on 32-bit ARM Linux

Issue #17540 has been updated by xtkoba (Tee KOBAYASHI).


MWE:
``` c
#include <stdarg.h>
#include <assert.h>

#ifndef WORKAROUND
#define WORKAROUND 0
#endif

typedef unsigned long VALUE;

static void RBASIC_SET_CLASS_RAW(VALUE obj, VALUE klass)
{
    struct { VALUE flags; VALUE klass; } *ptr = (void *)obj;
    ptr->klass = klass;
}

struct RBasic {
    VALUE flags;
    /*const*/ VALUE klass;
};

#define RBASIC(obj) ((struct RBasic *)(obj))

struct RString {
    struct RBasic basic;
    union {
        struct { long len; char *ptr; } heap;
        char ary[8];
    } as;
};

/* dummy function */
#pragma clang optimize off
static int dummy_vfprintf(char *fmt, va_list ap) { return 0; }
#pragma clang optimize on

#define NOP __asm__ __volatile__ ("nop")

VALUE rb_str_catf(VALUE str, char *format, ...)
{
    va_list ap;
    __builtin_va_start(ap, format);
    struct RString buf;
    if (RBASIC(str)->flags & 0x2000) { NOP; }
    else {
        buf.as.heap.ptr = ((struct RString *)str)->as.ary;
    }
    if (__builtin_expect(!!(! buf.as.heap.ptr), 0)) { NOP; }
    VALUE klass = RBASIC(str)->klass;
#if WORKAROUND
    __asm__ __volatile__ ("" : : : "memory");
#endif
    RBASIC_SET_CLASS_RAW(str, 0);
    dummy_vfprintf(format, ap);
    RBASIC_SET_CLASS_RAW(str, klass);
    __builtin_va_end(ap);
    return str;
}

int main()
{
    struct RBasic obj = { .flags = 0, .klass = 1 };
    rb_str_catf((VALUE)&obj, "");
    assert(obj.klass == 1);
    return 0;
}
```
The assertion fails when compiled with `-DWORKAROUND=0`, and holds with `-DWORKAROUND=1`.

----------------------------------------
Bug #17540: A segfault due to Clang/LLVM optimization on 32-bit ARM Linux 
https://bugs.ruby-lang.org/issues/17540#change-90667

* Author: xtkoba (Tee KOBAYASHI)
* Status: Open
* Priority: Normal
* ruby -v: ruby 3.0.0p0 (2020-12-25 revision 95aff21468) [armv7a-linux-eabi]
* Backport: 2.5: UNKNOWN, 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN
----------------------------------------
When built with `optflags=-O3` (which is the default), `ruby -e "pp Thread.main"` causes a segfault, which seems to be worked around by the following change:
```
--- a/include/ruby/internal/fl_type.h
+++ b/include/ruby/internal/fl_type.h
@@ -231,7 +231,7 @@
 RBIMPL_ATTR_PURE_UNLESS_DEBUG()
 RBIMPL_ATTR_ARTIFICIAL()
 static inline VALUE
-RB_FL_TEST_RAW(VALUE obj, VALUE flags)
+RB_FL_TEST_RAW(volatile VALUE obj, VALUE flags)
 {
     RBIMPL_ASSERT_OR_ASSUME(RB_FL_ABLE(obj));
     return RBASIC(obj)->flags & flags;
```

There might be a bug in the optimizer of Clang/LLVM (version 11.0.1).



-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>