Red Hat Bugzilla – Bug 622775
segmentation fault when js engine is built with -Os && -fexceptions
Last modified: 2011-02-14 09:10:57 EST
Description of problem:
If mozilla (xulrunner/thunderbird) is built with "-Os -fexceptions" gcc flags, the built binary crashes with segmentation fault. Works if it's build with -O2 or w/o -fexceptions.
broken build (gcc-4.5.0-4.fc14):
correct build (gcc-4.4.4-8.fc14):
(the different package versions are not important, with gcc-4.5.0-4.fc14.i686 it fails to build all mozilla packages).
It happens on i686 only, x86_64 is okay.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. download thunderbird from git
2. fedpkg local
3. see the log
Note: We catch it in Thunderbird because it's built with -Os -fexceptions. Firefox is built with -O2 -fexceptions so it's fine.
Could you please narrow this down to say one particular .o file using binary search (mixing -O2 -fexceptions and -Os -fexceptions objects until you find what matters)? For miscompilations (which often could be just package bugs relying on undefined behavior etc.) I'd very much prefer something shorter than the whole thunderbird.
It seems to affect whole js engine. If I try to run trace test, some of them fails. Will try to find the affected .o file.
The another flag which has to be set is -fPIC. So it crashes when "-Os -fexceptions -fPIC" is set. I tried to identify the affected module but it even depends on module order during linking. When .o files are in some on g++ command line it does not crash.
Created attachment 439161 [details]
There's the tescase attached. Run it by _test shell script, it should assert. It affects i686. Look for JSString::unitStringTable in jsstr.cpp.
This is http://gcc.gnu.org/PR45112, which is fixed in gcc-4.5.1-1.fc14. Unfortunately it is stuck in testing for f14, you might give it karma points and mention how urgent it is...