Re: port-hppa/56118: sporadic app crashes in HPPA -current

[Nick Hudson <nick.hudson%gmx.co.uk@localhost>]

The following reply was made to PR port-hppa/56118; it has been noted by GNATS.

From: Nick Hudson <nick.hudson%gmx.co.uk@localhost>
To: gnats-bugs%netbsd.org@localhost, port-hppa-maintainer%netbsd.org@localhost,
 gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Cc: 
Subject: Re: port-hppa/56118: sporadic app crashes in HPPA -current
Date: Sun, 11 Jul 2021 06:50:40 +0100

 On 20/04/2021 17:35, chris%groessler.org@localhost wrote:
 
 >
 > Thread 1 "" received signal SIGSEGV, Segmentation fault.
 > 0x00035228 in __canonicalize_funcptr_for_compare ()
 > (gdb) bt
 > #0  0x00035228 in __canonicalize_funcptr_for_compare ()
 > #1  0x00013650 in mdoc_parse_Sh (n=3D<optimized out>, rec=3D0xb0001708) =
 at /data/home/chris/tmp/netbsd/src/usr.sbin/makemandb/makemandb.c:1082
 > #2  0x00013670 in mdoc_parse_Sh (n=3D<optimized out>, rec=3D0xb0001708) =
 at /data/home/chris/tmp/netbsd/src/usr.sbin/makemandb/makemandb.c:1098
 > #3  0x00012bac in proff_node (n=3D<optimized out>, rec=3D0xb0001708, rof=
 f=3D0xafe97060, func=3D0x38248 <mdocs>) at /data/home/chris/tmp/netbsd/src=
 /usr.sbin/makemandb/makemandb.c:1171
 > #4  0x00036ac8 in begin_parse (fd=3D4, rec=3D0xb0001708, mp=3D0xafe9a000=
 , file=3D0xaf952bb0 "/usr/share/man/man9lua/systm.9lua") at /data/home/chr=
 is/tmp/netbsd/src/usr.sbin/makemandb/makemandb.c:892
 > #5  update_db (rec=3D0xb0001708, mp=3D0xafe9a000, db=3D0xafeab208) at /d=
 ata/home/chris/tmp/netbsd/src/usr.sbin/makemandb/makemandb.c:825
 > #6  main (argc=3D<optimized out>, argv=3D<optimized out>) at /data/home/=
 chris/tmp/netbsd/src/usr.sbin/makemandb/makemandb.c:434
 > (gdb) x/4i $pc
 > =3D> 0x35228 <__canonicalize_funcptr_for_compare+48>: probei,r (r3),3,r2=
 0
 >     0x3522c <__canonicalize_funcptr_for_compare+52>: cmpiclr,<> 0,r20,r0
 >     0x35230 <__canonicalize_funcptr_for_compare+56>: b,l,n 0x3527c <__ca=
 nonicalize_funcptr_for_compare+132>,r0
 >     0x35234 <__canonicalize_funcptr_for_compare+60>: ldw 0(r3),r20
 > (gdb) inf reg r3 r20
 > r3             0x6c696e68          1818848872#
 
 This looks more like 'h' 'n' 'i' l' than an userland address.
 
 It'd be good to see the assembly before to see where r3 is coming from.
 
 [snip]
 
 > Starting program: /usr/pkg/bin/bash
 >
 > Program received signal SIGSEGV, Segmentation fault.
 > 0x000799fc in hash_search ()
 > (gdb) bt
 > #0  0x000799fc in hash_search ()
 > #1  0x0004e8a0 in find_tempenv_variable ()
 > #2  0x000c17b4 in ?? ()
 > #3  0xaf12c168 in jemalloc_secure_getenv (name=3D0xaf1d9624 "MALLOC_CONF=
 ") at /data/home/chris/tmp/netbsd/src/external/bsd/jemalloc/lib/../dist/sr=
 c/jemalloc.c:744
 > #4  malloc_conf_init () at /data/home/chris/tmp/netbsd/src/external/bsd/=
 jemalloc/lib/../dist/src/jemalloc.c:970
 > #5  0xaf12d3ac in malloc_init_hard_a0_locked () at /data/home/chris/tmp/=
 netbsd/src/external/bsd/jemalloc/lib/../dist/src/jemalloc.c:1318
 > #6  0xaf12db20 in malloc_init_hard () at /data/home/chris/tmp/netbsd/src=
 /external/bsd/jemalloc/lib/../dist/src/jemalloc.c:1554
 > #7  0xaf1cc1d0 in je_prof_thread_name_set () from /usr/lib/libc.so.12
 > #8  0xaf03fe0c in ?? () from /usr/lib/libc.so.12
 > Backtrace stopped: previous frame identical to this frame (corrupt stack=
 ?)
 > (gdb) x/4i $pc
 > =3D> 0x799fc <hash_search+496>:       ldw 8(r5),ret0
 >     0x79a00 <hash_search+500>:       cmpib,<>,n 0,ret0,0x7984c <hash_sea=
 rch+64>
 >     0x79a04 <hash_search+504>:       ldb 0(r6),r8
 >     0x79a08 <hash_search+508>:       b,l 0x7990c <hash_search+256>,r0
 > (gdb) inf reg r5
 > r5             0xe84f1304          3897496324
 > (gdb)
 
 hmm, general heap corruption? I'll try locally.
 
 
 Nick