Re: git-blame segfault

[Markus Trippelsdorf <markus@trippelsdorf.de>]

On 2013.12.02 at 15:15 +0100, Antoine Pelisse wrote:
> On Mon, Dec 2, 2013 at 1:57 PM, Markus Trippelsdorf
> <markus@trippelsdorf.de> wrote:
> > When git is compiled with current gcc and "-march=native"
> > git-blame segfaults:
> >
> > For example:
> >
> >  % gdb --args /var/tmp/git/git-blame gcc/tree-object-size.c
> > ...
> > Program received signal SIGSEGV, Segmentation fault.
> > 0x0000000000000000 in ?? ()
> > (gdb) bt
> > #0  0x0000000000000000 in ?? ()
> > #1  0x000000000051240d in xdl_emit_hunk_hdr (s1=s1@entry=30, c1=<optimized out>, s2=s2@entry=30, c2=c2@entry=6, func=func@entry=0x7fffffffd2d8 "", funclen=0,
> >     ecb=ecb@entry=0x7fffffffd580) at xdiff/xutils.c:460
> > #2  0x0000000000512af7 in xdl_emit_diff (xe=0x7fffffffd390, xscr=<optimized out>, ecb=0x7fffffffd580, xecfg=0x7fffffffd590) at xdiff/xemit.c:237
> 
> xdl_emit_diff() should not be called, because xecfg->hunk_func should
> be non-null and called instead. xld_emit_diff() is the one that needs
> outf to be set.
> 
> > #3  0x0000000000510a5d in xdl_diff (mf1=mf1@entry=0x7fffffffd510, mf2=mf2@entry=0x7fffffffd520, xpp=xpp@entry=0x7fffffffd570, xecfg=xecfg@entry=0x7fffffffd590,
> >     ecb=ecb@entry=0x7fffffffd580) at xdiff/xdiffi.c:601
> 
> Here we decide that xecfg->hunk_func is empty, and ef is set to xdl_emit_diff.
> 
> > #4  0x000000000050b005 in xdi_diff (mf1=<optimized out>, mf2=<optimized out>, xpp=xpp@entry=0x7fffffffd570, xecfg=xecfg@entry=0x7fffffffd590, xecb=xecb@entry=0x7fffffffd580)
> >     at xdiff-interface.c:136
> > #5  0x00000000004104df in diff_hunks (file_a=<optimized out>, file_b=<optimized out>, ctxlen=ctxlen@entry=0, hunk_func=hunk_func@entry=0x411320 <blame_chunk_cb>,
> >     cb_data=cb_data@entry=0x7fffffffd830) at builtin/blame.c:105
> 
> As we can see in your code below, ecb.outf is not set here, because
> it's not needed by hunk_func.
> hunk_func is set to blame_chunck_cb, passed by the function below.
> 
> > #6  0x0000000000412b54 in pass_blame_to_parent (parent=0x11da810, target=0x11dab50, sb=0x7fffffffd6e0) at builtin/blame.c:815
> 
> diff_hunks() is called with blame_chunck_cb as hunk_func.
> 
> I think the best thing to do is to find out where xecfg->hunk_func
> loses the blame_chunck_cb value to NULL. You could start with a
> watchpoint.

It happens in diff_hunks (from builtin/blame.c):

(gdb) up
#5  0x00000000004104df in diff_hunks (file_a=<optimized out>, file_b=<optimized out>, ctxlen=ctxlen@entry=0, hunk_func=hunk_func@entry=0x411320 <blame_chunk_cb>, 
    cb_data=cb_data@entry=0x7fffffffd830) at builtin/blame.c:105
105             return xdi_diff(file_a, file_b, &xpp, &xecfg, &ecb);
(gdb) l
100
101             xpp.flags = xdl_opts;
102             xecfg.ctxlen = ctxlen;
103             xecfg.hunk_func = hunk_func;
104             ecb.priv = cb_data;
105             return xdi_diff(file_a, file_b, &xpp, &xecfg, &ecb);
106     }
107
108     /*
109      * Prepare diff_filespec and convert it using diff textconv API
(gdb) p hunk_func
$1 = (xdl_emit_hunk_consume_func_t) 0x411320 <blame_chunk_cb>
(gdb) p xecfg.hunk_func
$2 = (xdl_emit_hunk_consume_func_t) 0x0
(gdb) p xecfg
$3 = {
  ctxlen = 0, 
  interhunkctxlen = 0, 
  flags = 0, 
  find_func = 0x0, 
  find_func_priv = 0x0, 
  hunk_func = 0x0
}
> 
> Would that mean that gcc is doing some steps in the wrong order ? That
> is setting xecfg.hunk_func and then emptying the structure ? I've
> already had a similar bug, but that's very unfortunate.

Yes. I think this might be the case:

(gdb) disass
Dump of assembler code for function diff_hunks:
   0x0000000000410460 <+0>:     sub    $0x58,%rsp
   0x0000000000410464 <+4>:     xor    %eax,%eax
   0x0000000000410466 <+6>:     mov    %eax,%r9d
   0x0000000000410469 <+9>:     add    $0x20,%eax
   0x000000000041046c <+12>:    cmp    $0x20,%eax
   0x000000000041046f <+15>:    movq   $0x0,0x20(%rsp,%r9,1)
   0x0000000000410478 <+24>:    movq   $0x0,0x28(%rsp,%r9,1)
   0x0000000000410481 <+33>:    movq   $0x0,0x30(%rsp,%r9,1)
   0x000000000041048a <+42>:    movq   $0x0,0x38(%rsp,%r9,1)
   0x0000000000410493 <+51>:    jb     0x410466 <diff_hunks+6>
   0x0000000000410495 <+53>:    lea    0x20(%rsp),%r10
   0x000000000041049a <+58>:    mov    %rdx,0x20(%rsp)
   0x000000000041049f <+63>:    mov    %rcx,0x48(%rsp)
   0x00000000004104a4 <+68>:    add    %r10,%rax
   0x00000000004104a7 <+71>:    mov    %r8,0x10(%rsp)
   0x00000000004104ac <+76>:    mov    %rsp,%rdx
   0x00000000004104af <+79>:    movq   $0x0,(%rax)
   0x00000000004104b6 <+86>:    movq   $0x0,0x8(%rax)
   0x00000000004104be <+94>:    lea    0x10(%rsp),%r8
   0x00000000004104c3 <+99>:    movslq 0x171882(%rip),%rax        # 0x581d4c <xdl_opts>
   0x00000000004104ca <+106>:   mov    %r10,%rcx
   0x00000000004104cd <+109>:   movq   $0x0,0x18(%rsp)
   0x00000000004104d6 <+118>:   mov    %rax,(%rsp)
   0x00000000004104da <+122>:   callq  0x50aee0 <xdi_diff>
=> 0x00000000004104df <+127>:   add    $0x58,%rsp
   0x00000000004104e3 <+131>:   retq   
End of assembler dump.


-- 
Markus