Bug 917779 - g++ segfault on log(2.0)
Summary: g++ segfault on log(2.0)
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: gcc
Version: 18
Hardware: arm
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Jakub Jelinek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-03-04 18:26 UTC by Rob Clark
Modified: 2014-02-05 19:38 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-02-05 19:38:48 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
preproc output dumped by g++ (28.89 KB, application/octet-stream)
2013-03-04 19:21 UTC, Rob Clark
no flags Details

Description Rob Clark 2013-03-04 18:26:53 UTC
Description of problem:
g++ segfault compiling:

#include <math.h>

int main(int argc, char **argv)
{
  return log(2.0);
}


Version-Release number of selected component (if applicable):
gcc-c++-4.7.2-8.fc18.armv7hl

How reproducible:


Steps to Reproduce:
1. g++ test.c -lm
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Rob Clark 2013-03-04 19:11:12 UTC
Not sure if this helps..  those ldr offsets in the disassembly look quite strange..

[robclark@touchpad:~]$ gdb /usr/bin/g++
GNU gdb (GDB) Fedora (7.5.1-36.fc18)
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "armv7hl-redhat-linux-gnueabi".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/g++...Reading symbols from /usr/lib/debug/usr/bin/g++.debug...done.
done.
(gdb) set follow-fork-mode child
(gdb) run test-917779.c -lm
Starting program: /usr/bin/g++ test-917779.c -lm
[New process 22647]
process 22647 is executing new program: /usr/libexec/gcc/armv7hl-redhat-linux-gnueabi/4.7.2/cc1plus

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 22647]
0x4f65af14 in mpfr_set_prec () from /lib/libmpfr.so.4
Missing separate debuginfos, use: debuginfo-install gmp-5.0.5-3.fc18.armv7hl libmpc-0.9-3.fc18.2.armv7hl mpfr-3.1.1-1.fc18.armv7hl zlib-1.2.7-9.fc18.armv7hl
(gdb) bt
#0  0x4f65af14 in mpfr_set_prec () from /lib/libmpfr.so.4
#1  0x4f6745a0 in mpfr_cache () from /lib/libmpfr.so.4
#2  0x4f650e04 in mpfr_log () from /lib/libmpfr.so.4
#3  0x001c71c8 in do_mpfr_arg1 (arg=<optimized out>, arg@entry=0x2ae80bf0, type=type@entry=0x2acd4960, func=func@entry=0x84238, min=0xab6f40 <dconst0>, 
    max=max@entry=0x0, inclusive=inclusive@entry=0 '\000') at ../../gcc/builtins.c:13670
#4  0x001d7744 in fold_builtin_logarithm (loc=351894, fndecl=0x2ad0c300, arg=arg@entry=0x2ae80bf0, func=0x84238) at ../../gcc/builtins.c:8261
#5  0x001dc908 in fold_builtin_1 (loc=351894, fndecl=0x2ad0c300, arg0=0x2ae80bf0, ignore=ignore@entry=0 '\000') at ../../gcc/builtins.c:10514
#6  0x001d161c in fold_builtin_n (loc=loc@entry=351894, fndecl=fndecl@entry=0x2ad0c300, args=args@entry=0x2aead9d0, nargs=nargs@entry=1, 
    ignore=ignore@entry=0 '\000') at ../../gcc/builtins.c:11059
#7  0x001de568 in fold_call_expr (loc=351894, exp=exp@entry=0x2aead9b0, ignore=ignore@entry=0 '\000') at ../../gcc/builtins.c:11186
#8  0x002d74d8 in fold (expr=expr@entry=0x2aead9b0) at ../../gcc/fold-const.c:14117
#9  0x0015991c in fold_if_not_in_template (expr=expr@entry=0x2aead9b0) at ../../gcc/cp/tree.c:3485
#10 0x000916dc in build_cxx_call (fn=0x2aead9b0, nargs=nargs@entry=1, argarray=argarray@entry=0x7effedf8) at ../../gcc/cp/call.c:6805
#11 0x0009aea0 in build_over_call (cand=<optimized out>, flags=3, complain=complain@entry=3) at ../../gcc/cp/call.c:6777
#12 0x0009bbbc in build_new_function_call (fn=fn@entry=0x2ad0c300, args=args@entry=0x7effeef4, koenig_p=koenig_p@entry=1 '\001', complain=3, 
    complain@entry=10) at ../../gcc/cp/call.c:3894
#13 0x00148bdc in finish_call_expr (fn=fn@entry=0x2ad0c300, args=0x7effeef4, disallow_virtual=<optimized out>, koenig_p=<optimized out>, complain=3)
    at ../../gcc/cp/semantics.c:2165
#14 0x00108234 in cp_parser_postfix_expression (parser=parser@entry=0x2ae89038, address_p=address_p@entry=0 '\000', cast_p=cast_p@entry=0 '\000', 
    member_access_only_p=member_access_only_p@entry=0 '\000', pidk_return=pidk_return@entry=0x0) at ../../gcc/cp/parser.c:5760
#15 0x00104178 in cp_parser_unary_expression (parser=parser@entry=0x2ae89038, address_p=address_p@entry=0 '\000', cast_p=cast_p@entry=10 '\n', 
    pidk=pidk@entry=0x0) at ../../gcc/cp/parser.c:6598
#16 0x0010ac74 in cp_parser_cast_expression (parser=parser@entry=0x2ae89038, address_p=address_p@entry=0 '\000', cast_p=<optimized out>, pidk=pidk@entry=0x0)
    at ../../gcc/cp/parser.c:7179
#17 0x0010af68 in cp_parser_binary_expression (parser=parser@entry=0x2ae89038, cast_p=cast_p@entry=0 '\000', 
    no_toplevel_fold_p=no_toplevel_fold_p@entry=0 '\000', prec=5742424, prec@entry=PREC_NOT_OPERATOR, pidk=pidk@entry=0x0) at ../../gcc/cp/parser.c:7276
#18 0x0010b4fc in cp_parser_assignment_expression (parser=parser@entry=0x2ae89038, cast_p=cast_p@entry=0 '\000', pidk=pidk@entry=0x0)
    at ../../gcc/cp/parser.c:7498
#19 0x0010d3e8 in cp_parser_expression (parser=parser@entry=0x2ae89038, cast_p=cast_p@entry=0 '\000', pidk=pidk@entry=0x0) at ../../gcc/cp/parser.c:7644
#20 0x000ff22c in cp_parser_jump_statement (parser=0x2ae89038) at ../../gcc/cp/parser.c:9901
#21 cp_parser_statement (parser=parser@entry=0x2ae89038, in_statement_expr=0xa879ec <is_extern_c.45075>, in_statement_expr@entry=0x0, 
    in_compound=in_compound@entry=1 '\001', if_p=if_p@entry=0x0) at ../../gcc/cp/parser.c:8655
#22 0x000ff690 in cp_parser_statement_seq_opt (parser=0x2ae89038, in_statement_expr=in_statement_expr@entry=0x0) at ../../gcc/cp/parser.c:9001
#23 0x000ff7e4 in cp_parser_compound_statement (parser=parser@entry=0x2ae89038, in_statement_expr=0x0, in_statement_expr@entry=0xa879ec <is_extern_c.45075>, 
    in_try=in_try@entry=236 '\354', function_body=function_body@entry=1 '\001') at ../../gcc/cp/parser.c:8955
#24 0x001103dc in cp_parser_function_body (parser=0x2ae89038) at ../../gcc/cp/parser.c:17410
#25 cp_parser_ctor_initializer_opt_and_function_body (parser=0x2ae89038) at ../../gcc/cp/parser.c:17444
#26 0x001111d0 in cp_parser_function_definition_after_declarator (parser=parser@entry=0x2ae89038, inline_p=inline_p@entry=0 '\000')
    at ../../gcc/cp/parser.c:21054
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) disassemble 
Dump of assembler code for function mpfr_set_prec:
   0x4f65aed4 <+0>:	push	{r3, r4, r5, r6, r7, r8, r10, lr}
   0x4f65aed8 <+4>:	cmp	r1, #1
   0x4f65aedc <+8>:	ldr	r6, [pc, #7285624]	; 0x4f65af84 <mpfr_set_prec+176>
   0x4f65aee0 <+12>:	mov	r4, r1
   0x4f65aee4 <+16>:	mov	r5, r0
   0x4f65aee8 <+20>:	add	r6, pc, r6
   0x4f65aeec <+24>:	bgt	0x4f65af08 <mpfr_set_prec+52>
   0x4f65aef0 <+28>:	ldr	r0, [pc, #6568272]	; 0x4f65af88 <mpfr_set_prec+180>
   0x4f65aef4 <+32>:	mov	r1, #32
   0x4f65aef8 <+36>:	ldr	r2, [pc, #7471704]	; 0x4f65af8c <mpfr_set_prec+184>
   0x4f65aefc <+40>:	add	r0, pc, r0
   0x4f65af00 <+44>:	add	r2, pc, r2
   0x4f65af04 <+48>:	bl	0x4f647758
   0x4f65af08 <+52>:	subs	r7, r4, #1
   0x4f65af0c <+56>:	ldr	r3, [r5, #3283620]
   0x4f65af10 <+60>:	addmi	r7, r4, #30
=> 0x4f65af14 <+64>:	ldr	r8, [r3, #-3283620]
   0x4f65af18 <+68>:	asr	r7, r7, #5
   0x4f65af1c <+72>:	add	r7, r7, #1
   0x4f65af20 <+76>:	cmp	r7, r8
   0x4f65af24 <+80>:	ble	0x4f65af74 <mpfr_set_prec+160>
   0x4f65af28 <+84>:	ldr	r3, [pc, #7285624]	; 0x4f65af90 <mpfr_set_prec+188>
   0x4f65af2c <+88>:	ldr	r0, [r6, r3]
   0x4f65af30 <+92>:	ldr	r3, [pc, #6568272]	; 0x4f65af94 <mpfr_set_prec+192>
   0x4f65af34 <+96>:	ldr	r10, [r6, r3]
   0x4f65af38 <+100>:	ldr	r3, [pc, #7285712]	; 0x4f65af98 <mpfr_set_prec+196>
   0x4f65af3c <+104>:	mov	r1, r10
   0x4f65af40 <+108>:	ldr	r2, [r6, r3]
   0x4f65af44 <+112>:	bl	0x4f646d68
   0x4f65af48 <+116>:	ldr	r0, [r5, #3283620]
   0x4f65af4c <+120>:	add	r1, r8, #1
   0x4f65af50 <+124>:	add	r2, r7, #1
   0x4f65af54 <+128>:	ldr	r3, [r10]
   0x4f65af58 <+132>:	sub	r0, r0, #4
   0x4f65af5c <+136>:	lsl	r1, r1, #2
   0x4f65af60 <+140>:	lsl	r2, r2, #2
   0x4f65af64 <+144>:	blx	r3
   0x4f65af68 <+148>:	add	r3, r0, #4
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) 
(gdb) disassemble 
Dump of assembler code for function mpfr_set_prec:
   0x4f65aed4 <+0>:	push	{r3, r4, r5, r6, r7, r8, r10, lr}
   0x4f65aed8 <+4>:	cmp	r1, #1
   0x4f65aedc <+8>:	ldr	r6, [pc, #7285624]	; 0x4f65af84 <mpfr_set_prec+176>
   0x4f65aee0 <+12>:	mov	r4, r1
   0x4f65aee4 <+16>:	mov	r5, r0
   0x4f65aee8 <+20>:	add	r6, pc, r6
   0x4f65aeec <+24>:	bgt	0x4f65af08 <mpfr_set_prec+52>
   0x4f65aef0 <+28>:	ldr	r0, [pc, #6568272]	; 0x4f65af88 <mpfr_set_prec+180>
   0x4f65aef4 <+32>:	mov	r1, #32
   0x4f65aef8 <+36>:	ldr	r2, [pc, #7471704]	; 0x4f65af8c <mpfr_set_prec+184>
   0x4f65aefc <+40>:	add	r0, pc, r0
   0x4f65af00 <+44>:	add	r2, pc, r2
   0x4f65af04 <+48>:	bl	0x4f647758
   0x4f65af08 <+52>:	subs	r7, r4, #1
   0x4f65af0c <+56>:	ldr	r3, [r5, #3283620]
   0x4f65af10 <+60>:	addmi	r7, r4, #30
=> 0x4f65af14 <+64>:	ldr	r8, [r3, #-3283620]
   0x4f65af18 <+68>:	asr	r7, r7, #5
   0x4f65af1c <+72>:	add	r7, r7, #1
   0x4f65af20 <+76>:	cmp	r7, r8
   0x4f65af24 <+80>:	ble	0x4f65af74 <mpfr_set_prec+160>
   0x4f65af28 <+84>:	ldr	r3, [pc, #7285624]	; 0x4f65af90 <mpfr_set_prec+188>
   0x4f65af2c <+88>:	ldr	r0, [r6, r3]
   0x4f65af30 <+92>:	ldr	r3, [pc, #6568272]	; 0x4f65af94 <mpfr_set_prec+192>
   0x4f65af34 <+96>:	ldr	r10, [r6, r3]
   0x4f65af38 <+100>:	ldr	r3, [pc, #7285712]	; 0x4f65af98 <mpfr_set_prec+196>
   0x4f65af3c <+104>:	mov	r1, r10
   0x4f65af40 <+108>:	ldr	r2, [r6, r3]
   0x4f65af44 <+112>:	bl	0x4f646d68
   0x4f65af48 <+116>:	ldr	r0, [r5, #3283620]
   0x4f65af4c <+120>:	add	r1, r8, #1
   0x4f65af50 <+124>:	add	r2, r7, #1
   0x4f65af54 <+128>:	ldr	r3, [r10]
   0x4f65af58 <+132>:	sub	r0, r0, #4
   0x4f65af5c <+136>:	lsl	r1, r1, #2
   0x4f65af60 <+140>:	lsl	r2, r2, #2
   0x4f65af64 <+144>:	blx	r3
   0x4f65af68 <+148>:	add	r3, r0, #4
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) info registers 
r0             0x2aabfb18	715914008
r1             0x46	70
r2             0x2aabfad8	715913944
r3             0x0	0
r4             0x46	70
r5             0x2aabfb18	715914008
r6             0x4f697000	1332310016
r7             0x45	69
r8             0x0	0
r9             0x3fffffff	1073741823
r10            0xc0000001	3221225473
r11            0x1	1
r12            0x4f65aed4	1332063956
sp             0x7effea88	0x7effea88
lr             0x4f6745a0	1332168096
pc             0x4f65af14	0x4f65af14 <mpfr_set_prec+64>
cpsr           0x200f0010	537853968
(gdb) 
(gdb) x/xw $r5+3283620
0x2ade15bc:	0x00000000
(gdb)

Comment 2 Rob Clark 2013-03-04 19:21:14 UTC
Created attachment 705122 [details]
preproc output dumped by g++

Comment 3 Fedora End Of Life 2013-12-21 11:51:44 UTC
This message is a reminder that Fedora 18 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 18. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '18'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 18's end of life.

Thank you for reporting this issue and we are sorry that we may not be 
able to fix it before Fedora 18 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior to Fedora 18's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 4 Fedora End Of Life 2014-02-05 19:38:48 UTC
Fedora 18 changed to end-of-life (EOL) status on 2014-01-14. Fedora 18 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.