port-macppc/54953: 5.0 binaries on 9.0_RC2 macppc dumps core in jemalloc(3)

[Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>]

>Number:         54953
>Category:       port-macppc
>Synopsis:       5.0 binaries on 9.0_RC2 macppc dumps core in jemalloc(3)
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    port-macppc-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 10 17:25:00 +0000 2020
>Originator:     Izumi Tsutsui
>Release:        NetBSD 9.0_RC2
>Organization:
>Environment:
System: NetBSD 9.0_RC2 macppc (GENERIC)
Architecture: powerpc
Machine: macppc (probably affects all powerpc ports?)
>Description:
Many NetBSD/macppc 5.0 binaries (probably using malloc(3)) gets
kernel trap and dumps core on NetBSD/macppc 9.0_RC2.
5.99.10 binary (tcsh) also dumps core.

- 6.0 binaries work without problem.
- The 5.99.10 tcsh worked on 8.1.

>How-To-Repeat:
# uname -a
NetBSD lancer 9.0_RC2 NetBSD 9.0_RC2 (GENERIC) #5: Tue Feb 11 00:45:10 JST 2020  tsutsui@mirage:/s/netbsd-9/src/sys/arch/macppc/compile/GENERIC macppc
# file 5.0/bin/test
5.0/bin/test: ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, interpreter /libexec/ld.elf_so, for NetBSD 5.0, not stripped
# ldd 5.0/bin/test
5.0/bin/test:
        -lc.12 => /lib/libc.so.12
# 5.0/bin/test
[ 5360.1396803] trap: pid 766.1 (test): user read DSI trap @ 0x1802d90 by 0xfddaae50 (DSISR 0x40000000, err=14)
[1]   Segmentation fault (core dumped) 5.0/bin/test
# gdb 5.0/bin/test test.core
GNU gdb (GDB) 8.3
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "powerpc--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from 5.0/bin/test...
(No debugging symbols found in 5.0/bin/test)
[New process 1]
Core was generated by `test'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xfddaae50 in malloc () from /lib/libc.so.12
(gdb) bt
#0  0xfddaae50 in malloc () from /lib/libc.so.12
#1  0xfddff4e4 in __setlocale () from /lib/libc.so.12
#2  0xfdd27698 in __setlocale_mb_len_max_32 () from /lib/libc.so.12
#3  0x018018dc in main ()
(gdb)

---

# file /usr/local/bin/tcsh
/usr/local/bin/tcsh: ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, interpreter /usr/libexec/ld.elf_so, for NetBSD 5.99.10, stripped
# ldd /usr/local/bin/tcsh
/usr/local/bin/tcsh:
        -ltermcap.0 => /usr/lib/libtermcap.so.0
        -lc.12 => /usr/lib/libc.so.12
        -lcrypt.1 => /usr/lib/libcrypt.so.1
# /usr/local/bin/tcsh
[ 5565.0401313] trap: pid 359.1 (tcsh): user read DSI trap @ 0x18544e0 by 0xfdd77f50 (DSISR 0x40000000, err=14)
[1]   Segmentation fault (core dumped) /usr/local/bin/tcsh
# gdb /usr/local/bin/tcsh tcsh.core
GNU gdb (GDB) 8.3
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "powerpc--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/local/bin/tcsh...
(No debugging symbols found in /usr/local/bin/tcsh)
[New process 1]
Core was generated by `tcsh'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xfdd77f50 in je_jemalloc_prefork () from /usr/lib/libc.so.12
(gdb) bt
#0  0xfdd77f50 in je_jemalloc_prefork () from /usr/lib/libc.so.12
#1  0xfddead30 in fork () from /usr/lib/libc.so.12
#2  0x01845d6c in ?? ()
#3  0x01804618 in ?? ()
#4  0x018020a4 in ?? ()
#5  0xfdee1d24 in _rtld_start () from /usr/libexec/ld.elf_so
(gdb)

>Fix:
No idea.