bug#47067: 28.0.50; [feature/native-comp] Crash while scrolling through dispnew.c

[Pip Cet <pipcet@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 4656 bytes --]

On Sat, Mar 13, 2021 at 4:21 PM Eli Zaretskii <eliz@gnu.org> wrote:
> > From: Pip Cet <pipcet@gmail.com>
> > Date: Sat, 13 Mar 2021 15:45:52 +0000
> > Cc: Andrea Corallo <akrl@sdf.org>, 47067@debbugs.gnu.org
> >
> > On Sat, Mar 13, 2021 at 3:27 PM Eli Zaretskii <eliz@gnu.org> wrote:
> > > > > It's nowhere in the C backtrace, only its caller
> > > >
> > > > But it was in one of the previous backtraces?
> > >
> > > Too many moons ago.  The ABI was bumped since then, and so did the
> > > *.eln files.
> >
> > The code you pasted matches c-beginning-of-statement-1, and so does
> > the Lisp backtrace, so I would suggest we go with it...
>
> I don't know how to go with it: the backtrace is truncated (for
> reasons I don't yet understand) before it gets to it.

I'm pretty sure the first ?? is c-beginning-of-stmt-1. It's a function
with five arguments, at least.

> > > > So EDI is bunk at this point. Can you go back a bit further to where
> > > > it's initialized?
> > >
> > > Sorry, I don't understand: I gave you the disassembly of 512 bytes
> > > before, isn't that enough to see where EDI is assigned the value?  Or
> > > what do you mean by "go back"?
> >
> > It's not enough, no. we're looking for an insn of the form mov XXX,
> > %edi or lea XXX, %edi, or anything like that.
>
> I went back 4KB, and the only two instructions that write into EDI are

It's a long function, that might not have been enough.

> the following:
>
>    0x09e3159d:  mov    -0x100(%ebp),%edi
>    0x09e31c71:  mov    0x9f37b9c,%edi
>
> > I'm suspicious because EDI is a register variable that is clobbered
> > somehow right after a setjmp returned. Which setjmp implementation are
> > you using?
>
> Not sure how to answer that.  AFAIK, it's a setjmp from the MS runtime.

So not some mingw wrapper for it? I just checked the only "mingw"-like
sources I could find, and they don't appear to use the frame pointer
argument properly...

> > Is it possible that you're on Windows, but unlike other Windows
> > setjmps, it's unsafe to call your setjmp through a function pointer?
>
> How do I tell?

Well, you could just apply this untested patch, fix any obvious
compile errors I might not have spotted, and try to reproduce it. I'm
not currently on a Windows (or x86) machine, so it's a bit hard for me
to test...

> And why I never had any problems with setjmp elsewhere in Emacs,
> although we use it all the time in keyboard.c and elsewhere?

It's only natively-compiled code that attempts to call setjmp through
a function pointer. This was fixed in the POSIX case, but I didn't
touch the Windows code because I assumed that they used the extra
argument in their non-standard API to do this right...

> Here's an interesting factoid: while most addresses in the backtraces
> I see with this recipe are identical from run to run, the 'fun'
> arguments of funcall_lambda's aren't.  Compare the backtrace I sent 3
> messages ago with this one:
>
>   #0  0x01236964 in arithcompare_driver (nargs=2, args=0x28,
>       comparison=ARITH_LESS) at data.c:2673
>   #1  0x01236a3c in Flss (nargs=2, args=0x28) at data.c:2691
>   #2  0x09e32285 in ?? ()
>   #3  0x01261a74 in funcall_lambda (fun=XIL(0xa000000007650188), nargs=5,
>       arg_vector=0x826a08) at eval.c:3292
>   #4  0x012603c9 in Ffuncall (nargs=6, args=0x826a00) at eval.c:3013
>   #5  0x09ea0dbf in ?? ()
>   #6  0x012603c9 in Ffuncall (nargs=1, args=0x826bd8) at eval.c:3013
>   #7  0x09e8e041 in ?? ()
>   #8  0x01261a74 in funcall_lambda (fun=XIL(0xa00000000778d5b8), nargs=1,
>       arg_vector=0x826db8) at eval.c:3292
>   #9  0x012603c9 in Ffuncall (nargs=2, args=0x826db0) at eval.c:3013
>   #10 0x70895b36 in F632d666f6e742d6c6f636b2d6375742d6f66662d6465636c617261746f7273_c_font_lock_cut_off_declarators_0 ()
>      from d:\usr\eli\.emacs.d\eln-cache\28.0.50-7d88f6c1\cc-fonts-d7d8a7f5-b7c359cd.eln
>   #11 0x01261a74 in funcall_lambda (fun=XIL(0xa000000007785f78), nargs=1,
>       arg_vector=0x827050) at eval.c:3292
>   #12 0x012603c9 in Ffuncall (nargs=2, args=0x827048) at eval.c:3013
>   #13 0x068daf93 in ?? ()
>   #14 0x012dea14 in helper_save_restriction () at comp.c:4575
>   #15 0x0122eb86 in wrong_type_argument (predicate=XIL(0x892404890c245c89),
>       value=XIL(0x8244c89e45d8be0)) at data.c:143
>   Backtrace stopped: previous frame inner to this frame (corrupt stack?)
>
> Note how arguments to Funcall's are the same, whereas arguments to
> funcall_lambda's aren't.  Even the garbage in the 2 arguments to
> wrong_type_argument are identical.

Which non-stack addresses are invariant in that backtrace?

> Sounds like something is uninitialized somewhere?  Hmm...

Maybe...

Pip

[-- Attachment #2: bug46824.diff --]
[-- Type: text/x-diff, Size: 1056 bytes --]

diff --git a/src/comp.c b/src/comp.c
index b24fcb5bf5a99..ce3ad22b30576 100644
--- a/src/comp.c
+++ b/src/comp.c
@@ -1946,6 +1946,11 @@ emit_setjmp (gcc_jit_rvalue *buf)
   return gcc_jit_context_new_call (comp.ctxt, NULL, f, 1, args);
 #else
   /* _setjmp (buf, __builtin_frame_address (0)) */
+  gcc_jit_param *params[] =
+  {
+    gcc_jit_context_new_param (comp.ctxt, NULL, comp.void_ptr_type, "buf"),
+    gcc_jit_context_new_param (comp.ctxt, NULL, comp.unsigned_type, "ret"),
+  };
   gcc_jit_rvalue *args[2];
 
   args[0] =
@@ -1959,8 +1964,14 @@ emit_setjmp (gcc_jit_rvalue *buf)
 					    "__builtin_frame_address"),
       1, args);
   args[0] = buf;
-  return emit_call (intern_c_string (STR (SETJMP_NAME)), comp.int_type, 2, args,
-                    false);
+  gcc_jit_function *f =
+    gcc_jit_context_new_function (comp.ctxt, NULL,
+				  GCC_JIT_FUNCTION_IMPORTED,
+				  comp.int_type, STR (SETJMP_NAME),
+				  ARRAYELTS (params), params,
+				  false);
+
+  return gcc_jit_context_new_call (comp.ctxt, NULL, f, 2, args);
 #endif
 }