Bug 163195

With debuginfo this time...

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 807476352 (LWP 10178)]
0x0ed7b120 in nsSegmentedBuffer::Empty (this=0x2c) at nsSegmentedBuffer.cpp:158
158         if (mSegmentArray) {
(gdb) bt
#0  0x0ed7b120 in nsSegmentedBuffer::Empty (this=0x2c)
    at nsSegmentedBuffer.cpp:158
#1  0x0ed7824c in ~nsSegmentedBuffer (this=0x2c) at nsSegmentedBuffer.h:54
#2  0x0de9c4c4 in ~FileImpl (this=Variable "this" is not available.
) at nsIFileStream.cpp:186
#3  0x0de9cbb0 in FileImpl::Release (this=0x106dd5d8) at nsIFileStream.cpp:122
#4  0x0edc0f00 in nsCOMPtr_base::~nsCOMPtr_base$base ()
   from /usr/lib/thunderbird-1.0.2/libxpcom.so
#5  0x0de9acf8 in ~nsCOMPtr (this=Variable "this" is not available.
) at nsFileStream.h:382
#6  0x0de9ad30 in ~nsRandomAccessStoreClient (this=Variable "this" is not available.
) at nsFileStream.h:388
#7  0x0de9ae4c in ~nsRandomAccessInputStream (this=0x106b2c80,
    __vtt_parm=0xde65968) at nsFileStream.h:522
#8  0x0de99394 in nsInputFileStream::~nsInputFileStream$base ()
    at ../../dist/include/string/nsTAString.h:395
#9  0x0db77654 in ~nsIOFileStream (this=0x106b2c80)
    at nsNntpIncomingServer.cpp:144
#10 0x0db75850 in nsMsgFilterService::OpenFilterList (this=0x1076a6d8,
    filterFile=0x1076a848, rootFolder=0x0, aMsgWindow=0x0,
    resultFilterList=0x1076a7bc) at nsMsgFilterService.cpp:99
#11 0x0dd762dc in nsMsgMailViewList::LoadMailViews (this=0x1076a7b0)
    at nsMsgMailViewList.cpp:260
#12 0x0dd76410 in nsMsgMailViewList (this=0x1076a7b0)
    at nsMsgMailViewList.cpp:110
#13 0x0daba364 in nsMsgMailViewListConstructor (aOuter=Variable "aOuter" is not
available.
)
---Type <return> to continue, or q <return> to quit---
    at nsMailModule.cpp:511
#14 0x0edc1adc in nsGenericFactory::CreateInstance (this=Variable "this" is not
available.
)
    at nsGenericFactory.cpp:82
#15 0x0ed8b2d0 in nsComponentManagerImpl::CreateInstance (this=0x10067488,
    aClass=Variable "aClass" is not available.
) at nsComponentManager.cpp:1918
#16 0x0ed8acdc in nsComponentManagerImpl::GetService (this=0x10067488,
    aClass=@0x106e3bec, aIID=@0x7fb905a0, result=0x7fb90594)
    at nsComponentManager.cpp:2120
#17 0x0ed92184 in nsServiceManager::GetService (aClass=Variable "aClass" is not
available.
)
    at nsServiceManagerObsolete.cpp:77
#18 0x0e98d740 in nsJSCID::GetService (this=0x106e3bd8, _retval=Variable
"_retval" is not available.
)
    at xpcjsid.cpp:882
#19 0x0edb3d98 in XPTC_InvokeByIndex ()
    at ../../../dist/include/string/nsTAString.h:406
#20 0x0e99fadc in XPCWrappedNative::CallMethod (ccx=@0x7fb908e8, mode=Variable
"mode" is not available.
)
    at xpcwrappednative.cpp:2034
#21 0x0e9a33e4 in XPC_WN_CallMethod (cx=0x101def78, obj=Variable "obj" is not
available.
)
    at xpcwrappednativejsops.cpp:1287
#22 0x0ff6b4bc in js_Invoke (cx=0x101def78, argc=1, flags=0) at jsinterp.c:949
#23 0x0ff683a4 in js_Interpret (cx=0x101def78, result=0x7fb90b18)
    at jsinterp.c:2992
#24 0x0ff6b50c in js_Invoke (cx=0x101def78, argc=1, flags=2) at jsinterp.c:966
#25 0x0e99ad68 in nsXPCWrappedJSClass::CallMethod (this=0x10408c28,
wrapper=Variable "wrapper" is not available.
)
---Type <return> to continue, or q <return> to quit---
    at xpcwrappedjsclass.cpp:1339
#26 0x0e995844 in nsXPCWrappedJS::CallMethod (this=Variable "this" is not available.
) at xpcwrappedjs.cpp:449
#27 0x0edb3c64 in PrepareAndDispatch (self=0x104dc878, methodIndex=Variable
"methodIndex" is not available.
)
    at xptcstubs_ppc_linux.cpp:176
#28 0x0edb3e10 in SharedStub ()
    at ../../../dist/include/string/nsTAString.h:406
#29 0x0e23521c in nsEventListenerManager::HandleEventSubType (this=0x1033d6a0,
    aListenerStruct=0x104dc770, aDOMEvent=0x10685ee0,
    aCurrentTarget=0x101deda8, aSubType=1, aPhaseFlags=Variable "aPhaseFlags" is
not available.
)
    at nsEventListenerManager.cpp:1436
#30 0x0e235970 in nsEventListenerManager::HandleEvent (this=0x1033d6a0,
    aPresContext=Variable "aPresContext" is not available.
) at nsEventListenerManager.cpp:1531
#31 0x0e39da08 in GlobalWindowImpl::HandleDOMEvent (this=0x101ded98,
    aPresContext=0x103a2f78, aEvent=0x7fb91230, aDOMEvent=0x7fb91178,
aFlags=Variable "aFlags" is not available.
)
    at nsGlobalWindow.cpp:926
#32 0x0e1c09b4 in DocumentViewerImpl::LoadComplete (this=0x103a2690,
aStatus=Variable "aStatus" is not available.
)
    at nsDocumentViewer.cpp:917
#33 0x0e5f3748 in nsDocShell::EndPageLoad (this=0x101dd408, aProgress=Variable
"aProgress" is not available.
)
    at nsDocShell.cpp:4601
#34 0x0e6053f4 in nsWebShell::EndPageLoad (this=0x101dd408,
    aProgress=0x101dd5ac, channel=0x101e6fe0, aStatus=0) at nsWebShell.cpp:750
#35 0x0e5f2978 in nsDocShell::OnStateChange (this=0x101dd408,
    aProgress=0x101dd5ac, aRequest=0x101e6fe0, aStateFlags=Variable
"aStateFlags" is not available.
)
---Type <return> to continue, or q <return> to quit---
    at nsDocShell.cpp:4533
#36 0x0e613eb0 in nsDocLoaderImpl::FireOnStateChange (this=0x101dd598,
    aProgress=0x101dd5ac, aRequest=0x101e6fe0, aStateFlags=131088, aStatus=0)
    at nsDocLoader.cpp:1268
#37 0x0e6140cc in nsDocLoaderImpl::doStopDocumentLoad (this=0x101dd598,
    request=0x101e6fe0, aStatus=0) at nsDocLoader.cpp:862
#38 0x0e6141d8 in nsDocLoaderImpl::DocLoaderIsEmpty (this=0x101dd598)
    at nsDocLoader.cpp:769
#39 0x0e614600 in nsDocLoaderImpl::OnStopRequest (this=0x101dd598,
    aRequest=0x106f5128, aCtxt=Variable "aCtxt" is not available.
) at nsDocLoader.cpp:698
#40 0x0e805274 in nsLoadGroup::RemoveRequest (this=0x101dd798,
    request=0x106f5128, ctxt=0x0, aStatus=0) at nsLoadGroup.cpp:695
#41 0x0df3fff8 in imgRequestProxy::RemoveFromLoadGroup (this=0x106f5128)
    at imgRequestProxy.cpp:157
#42 0x0df40050 in imgRequestProxy::OnStopRequest (this=Variable "this" is not
available.
)
    at imgRequestProxy.cpp:447
#43 0x0df3e4a8 in imgRequest::OnStopRequest (this=Variable "this" is not available.
) at imgRequest.cpp:697
#44 0x0df39a28 in ProxyListener::OnStopRequest (this=Variable "this" is not
available.
) at imgLoader.cpp:851
#45 0x0e878b9c in nsJARChannel::OnStopRequest (this=0x106f5468, req=Variable
"req" is not available.
)
    at nsJARChannel.cpp:671
#46 0x0e7fe094 in nsInputStreamPump::OnStateStop (this=0x106f5740)
    at nsInputStreamPump.cpp:498
#47 0x0e7fe434 in nsInputStreamPump::OnInputStreamReady (this=0x106f5740,
---Type <return> to continue, or q <return> to quit---
    stream=0x0) at nsInputStreamPump.cpp:339
#48 0x0ed7a080 in nsInputStreamReadyEvent::EventHandler (plevent=Variable
"plevent" is not available.
)
    at nsStreamUtils.cpp:118
#49 0x0ed939ac in PL_HandleEvent (self=0x106f7a8c) at plevent.c:673
#50 0x0ed93fac in PL_ProcessPendingEvents (self=0x100be638) at plevent.c:608
#51 0x0ed95978 in nsEventQueueImpl::ProcessPendingEvents (this=0x100be610)
    at nsEventQueue.cpp:398
#52 0x0ea670c4 in event_processor_callback (source=Variable "source" is not
available.
) at nsAppShell.cpp:67
#53 0x0f7e42f4 in g_io_unix_dispatch (source=0x102afd70,
    callback=0xea6709c <event_processor_callback>, user_data=0x100be610)
    at giounix.c:162
#54 0x0f7b08d4 in IA__g_main_context_dispatch (context=0x1004dd98)
    at gmain.c:1933
#55 0x28004444 in ?? ()
#56 0x0f7b4bac in g_main_context_iterate (context=0x1004dd98, block=1,
    dispatch=1, self=Variable "self" is not available.
) at gmain.c:2564
#57 0x28000484 in ?? ()
#58 0x0f7b5004 in IA__g_main_loop_run (loop=0x101ee378) at gmain.c:2768
#59 0x0ef88918 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#60 0x0ea67684 in nsAppShell::Run (this=0x1009f500) at nsAppShell.cpp:142
#61 0x0eb452a8 in nsAppShellService::Run (this=Variable "this" is not
available.) at nsAppShellService.cpp:494
#62 0x10009a2c in xre_main (argc=Variable "argc" is not available.
) at nsAppRunner.cpp:1907
#63 0x10005a2c in main (argc=Variable "argc" is not available.
) at nsMailApp.cpp:58
---Type <return> to continue, or q <return> to quit---
#64 0x300cd8cc in generic_start_main () from /lib/libc.so.6
#65 0x300cda64 in __libc_start_main () from /lib/libc.so.6
#66 0x300cda64 in __libc_start_main () from /lib/libc.so.6
(gdb) list *$pc
0xed7b120 is in nsSegmentedBuffer::Empty() (nsSegmentedBuffer.cpp:158).
153     }
154
155     void
156     nsSegmentedBuffer::Empty()
157     {
158         if (mSegmentArray) {
159             for (PRUint32 i = 0; i < mSegmentArrayCount; i++) {
160                 if (mSegmentArray[i])
161                     mSegAllocator->Free(mSegmentArray[i]);
162             }
(gdb) p mSegmentArray
Cannot access memory at address 0x38

Does it still crash with new 1.0.6 version?

yes.

On both rawhide and FC4.

Works fine, however, when I rebuild on a ppc32 host (rawhide). Will rebuild (for
ppc32) on a ppc64 and double-check that it fails -- that it's not some other
characteristic of the build system which caused the failure.

I suspect the distinction isn't really between ppc32 and ppc64 hosts. My ppc32
host didn't have redhat-rpm-config installed and hence wasn't adding
-fexceptions to CFLAGS. Having -fexceptions in the flags for
xpcom/obsolete/nsIFileStream.cpp causes this failure. Adding -fno-exceptions for
that one file fixes it.

Created attachment 117572 [details]
Offending source file

Compiling this with these options works...

c++ -o nsIFileStream.o -c -fPIC -fno-exceptions -Os nsIFileStream.ii
c++ -o nsIFileStream.o -c -fPIC -fexceptions -O1 nsIFileStream.ii
c++ -o nsIFileStream.o -c -fPIC -fexceptions -O2 nsIFileStream.ii

Only with '-fexceptions -Os' does it fail.

Created attachment 117573 [details]
workaround patch for thunderbird

Self-contained testcase:
extern "C" void abort ();

struct A
{
  virtual int a () {}
};
struct B : public A
{
  virtual int b () {}
};
struct C : public A
{
  virtual int c () {}
};
struct D
{
  D () { d = 64; }
  ~D ();
  int d;
};

int x;
D::~D ()
{
  x |= 1;
  if (d != 64)
    abort ();
}

struct E : public B, public C
{
  E () {}
  virtual int c ();
  ~E ();
  D dv;
};

E::~E ()
{
  int r = c ();
}

int
E::c ()
{
  if (x > 10)
    throw 1;
  x |= 2;
}

int
main (void)
{
  {
    E e;
  }
  if (x != 3)
    abort ();
}

Fails on ppc32 as well as ppc64 with -Os, succeeds with -O{0,1,2,3}.
Will check vanilla gcc-4_0-branch and gcc HEAD now.

*** Bug 166075 has been marked as a duplicate of this bug. ***

Applied patch, 88 minutes of compiling later, and it seems to work just fine.  

Reopening. This is still happening in FC4 and was filed against FC4.

This is still failing with gcc-4.0.1-4.fc4

But gcc-4.0.1-4.fc4 is older than 4.0.1-8 this bug says it was fixed in.
Latest FC4 update is 4.0.2-8.fc4.

David, does a rebuild against new gcc fix this for you in FC4?  If so, I'll push
out updates in FC4.

I'm fairly sure it should, yes. I'm on an analogue modem in Australia at the
moment... not particularly easy to confirm. If you put it into updates-testing
or even just put it somewhere and advertise its presence on
fedora-ppc.org, then I'm sure you'll get independent confirmation.

ping