bugGNUstep - Bugs: bug #26419, Segfault with libffi on...

 
 

bug #26419: Segfault with libffi on Linux/PowerPC-32

Submitted by:  Eric Wasylishen <ericw>
Submitted on:  Sat 02 May 2009 03:13:26 AM UTC  
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 19 Jun 2009 04:37:06 PM UTC, comment #2: 

Wolfgang fixed this.

Richard Frith-Macdonald <CaS>
Project Member
Sat 06 Jun 2009 02:48:58 PM UTC, comment #1: 

I finally found some time to look into this. I have observed a similar crash on Yellow Dog Linux. Inspecting the code, you are right that an #undef MFRAME_STRUCT_BYREF does indeed fix the bug. In fact, the code thus commented out is completely bogus since libffi is designed to handle these calling convention variances. This problem can also be reproduced on Solaris, which also passes structures by references.
I've fixed this problem by deleting the bogus code in GSFFIInvocation.m in svn.

Wolfgang Lux <wlux>
Sat 02 May 2009 03:13:26 AM UTC, original submission:  

Hi,

I get a segmentation fault when clicking on the Info... menu item in the example Calculator.app. I'm using the latest base from svn (r28264), and the rest of my system is Debian testing.

The segfault is on GSFFIInvocation.m:279, in the memcpy() call. I did a bit of debugging and determined that the source for the memcpy(), (void *)vals[i], was 0, hence the segfault.

I tried adding an #undef MFRAME_STRUCT_BYREF before that section, which seemed to fix the problem with Calculator. All of the NSInvocation tests now pass, but they also passed before I added the #undef MFRAME_STRUCT_BYREF.

The strange thing is, I think PPC Linux does pass structs by reference -
see http://www.nondot.org/sabre/os/files/Processors/SVR4-ABI-PPC.pdf page 35. Linux is supposed to follow this convention except for handling return values differently.

Here's a (long) backtrace:

ericw@debian:~/gnustep-usr-apps/examples/gui/Calculator$ gdb ./Calculator.app/Calculator
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "powerpc-linux-gnu"...
(gdb) run
Starting program: /home/ericw/gnustep-usr-apps/examples/gui/Calculator/Calculator.app/Calculator
[Thread debugging using libthread_db enabled]
[New Thread 0x48031320 (LWP 22880)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x48031320 (LWP 22880)]
0x0f32cff0 in memcpy () from /lib/libc.so.6
(gdb) bt
#0  0x0f32cff0 in memcpy () from /lib/libc.so.6
#1  0x0f8ab9cc in -[GSFFIInvocation initWithCallback:returnp:values:frame:signature:] (self=0x1031f5f8, _cmd=0xfa74b0c, cif=0x1031f4d8,
    retp=0xbf8e2260, vals=0xbf8e21b0, frame=0x1031f4d8, aSignature=0x1031f5b0) at GSFFIInvocation.m:279
#2  0x0f8acad4 in GSFFIInvocationCallback (cif=0x1031f4d8, retp=0xbf8e2260, args=0xbf8e21b0, user=0x1031f4d8) at GSFFIInvocation.m:531
#3  0x0eee8f5c in ffi_closure_helper_SYSV () from /usr/lib/libffi.so.5
#4  0x0eee9d14 in ffi_closure_SYSV () from /usr/lib/libffi.so.5
#5  0x0fc2cd94 in -[NSButtonCell drawImage:withFrame:inView:] (self=0x103076a0, _cmd=0xff2eaf0, anImage=0x102105b8, aRect=
        {origin = {x = 0, y = 0}, size = {width = 48, height = 48}}, controlView=0x102fafc0) at NSButtonCell.m:925
#6  0x0fc2de30 in -[NSButtonCell drawInteriorWithFrame:inView:] (self=0x103076a0, _cmd=0xff32d6c, cellFrame=
        {origin = {x = 0, y = 0}, size = {width = 48, height = 48}}, controlView=0x102fafc0) at NSButtonCell.m:1216
#7  0x0fc3a91c in -[NSCell drawWithFrame:inView:] (self=0x103076a0, _cmd=0xff1599c, cellFrame=
        {origin = {x = 0, y = 0}, size = {width = 48, height = 48}}, controlView=0x102fafc0) at NSCell.m:2006
#8  0x0fbc31ec in -[NSActionCell drawWithFrame:inView:] (self=0x103076a0, _cmd=0xff40a6c, cellFrame=
        {origin = {x = 0, y = 0}, size = {width = 48, height = 48}}, controlView=0x102fafc0) at NSActionCell.m:308
#9  0x0fc6f804 in -[NSControl drawCell:] (self=0x102fafc0, _cmd=0xff40a64, aCell=0x103076a0) at NSControl.m:655
#10 0x0fc6f738 in -[NSControl drawRect:] (self=0x102fafc0, _cmd=0xffb15e0) at NSControl.m:645
#11 0x0fdef6e4 in -[NSView displayRectIgnoringOpacity:inContext:] (self=0x102fafc0, _cmd=0xffb15d0, aRect=
        {origin = {x = 0, y = 0}, size = {width = 48, height = 48}}, context=0x10333080) at NSView.m:2418
#12 0x0fdefa98 in -[NSView displayRectIgnoringOpacity:inContext:] (self=0x1032ee78, _cmd=0xffb15d0, aRect=
        {origin = {x = 0, y = 0}, size = {width = 351, height = 248}}, context=0x10333080) at NSView.m:2451
#13 0x0fdefa98 in -[NSView displayRectIgnoringOpacity:inContext:] (self=0x1032ecc8, _cmd=0xffb15d0, aRect=
        {origin = {x = 0, y = 0}, size = {width = 353, height = 273}}, context=0x10333080) at NSView.m:2451
#14 0x0fdef280 in -[NSView displayRectIgnoringOpacity:] (self=0x1032ecc8, _cmd=0xffb15c0, aRect=
        {origin = {x = 0, y = 0}, size = {width = 353, height = 273}}) at NSView.m:2364
#15 0x0fdef0d4 in -[NSView displayRect:] (self=0x1032ecc8, _cmd=0xffb15a0, aRect={origin = {x = 0, y = 0}, size = {width = 353, height = 273}})
---Type <return> to continue, or q <return> to quit---
    at NSView.m:2351
#16 0x0fdee7f0 in -[NSView display] (self=0x1032ecc8, _cmd=0xffb7ae4) at NSView.m:2249
#17 0x0fe046a8 in -[NSWindow orderWindow:relativeTo:] (self=0x10332178, _cmd=0xffb7abc, place=NSWindowAbove, otherWin=0) at NSWindow.m:1686
#18 0x0fe042bc in -[NSWindow orderFront:] (self=0x10332178, _cmd=0xff1f658, sender=0x1011a918) at NSWindow.m:1599
#19 0x0fbe8298 in -[NSApplication orderFrontStandardInfoPanelWithOptions:] (self=0x1011a918, _cmd=0xff1fb90, dictionary=0x0) at NSApplication.m:2675
#20 0x0fbe8138 in -[NSApplication orderFrontStandardInfoPanel:] (self=0x1011a918, _cmd=0x10017ff4, sender=0x1022abd0) at NSApplication.m:2575
#21 0x0eee9bec in ffi_call_SYSV () from /usr/lib/libffi.so.5
#22 0x0eee9364 in ffi_call () from /usr/lib/libffi.so.5
#23 0x0f8abb94 in GSFFIInvokeWithTargetAndImp (_inv=0x103336d0, anObject=0x1011a918, imp=0xfbe80d4 <-[NSApplication orderFrontStandardInfoPanel:]>)
    at GSFFIInvocation.m:314
#24 0x0f8ac038 in -[GSFFIInvocation invokeWithTarget:] (self=0x103336d0, _cmd=0xff1fad8, anObject=0x1011a918) at GSFFIInvocation.m:384
#25 0x0fbe615c in -[NSApplication sendAction:to:from:] (self=0x1011a918, _cmd=0xff697d0, aSelector=0x10017ff4, aTarget=0x0, sender=0x1022abd0)
    at NSApplication.m:2084
#26 0x0fcfab44 in -[NSMenu performActionForItemAtIndex:] (self=0x10210e00, _cmd=0xff6c190, index=0) at NSMenu.m:1242
#27 0x0fd0740c in -[NSMenuView trackWithEvent:] (self=0x10292af8, _cmd=0xff6c210, event=0x10340f88) at NSMenuView.m:1633
#28 0x0fd075f8 in -[NSMenuView mouseDown:] (self=0x10292af8, _cmd=0xffb7f04, theEvent=0x10317148) at NSMenuView.m:1678
#29 0x0fe0edc8 in -[NSWindow sendEvent:] (self=0x10212140, _cmd=0xff1fa70, theEvent=0x10317148) at NSWindow.m:3587
#30 0x0fbe58e4 in -[NSApplication sendEvent:] (self=0x1011a918, _cmd=0xff1f9b0, theEvent=0x10317148) at NSApplication.m:1960
#31 0x0fbe3ce4 in -[NSApplication run] (self=0x1011a918, _cmd=0x1001804c) at NSApplication.m:1462
#32 0x10002484 in main () at main.m:85
(gdb)

Eric Wasylishen <ericw>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by wlux (Posted a comment)
  • -email is unavailable- added by ericw (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-06-19 CaS StatusNone => Fixed
        Open/ClosedOpen => Closed

    Back to the top


    Powered by Savane 3.6