Very interesting! It seems that a host function was called by the trampoline and it returned a “pc” that is not aligned. The C code that is executed (repeatedly in a loop) is:

pc = (((___label_struct*)(pc-1))->host)(___ps); /* where pc has type long */

So it would seem that the host function called just before that returned a “pc” that is a multiple of 4 (which is an error… it should be 1 more than a multiple of 4).

Anyway, could you continue debugging this to determine which host function returned a faulty pc? This can be done by only modifying the trampoline function in lib/setup.c so that it produces a trace of the host functions that are called (so you don’t have to wait another 28 hours!). See the code below.

This should catch the problem if it is due to faulty code generated outside of lib/setup.c . Of course if it is the code for the trampoline function that is faulty then modifying that function may cause clang to produce correct code…

Marc

___SCMOBJ ___find_global_var_bound_to ___P((___SCMOBJ val), (val) ___SCMOBJ val;) { ___SCMOBJ sym = ___NUL; int i;

for (i = ___INT(___VECTORLENGTH(___GSTATE->symbol_table)) - 1; i>0; i--) { sym = ___FIELD(___GSTATE->symbol_table,i);

while (sym != ___NUL) { ___glo_struct *g = ___GLOBALVARSTRUCT(sym);

if (g != 0 && (___PRMCELL(g->prm) == val || ___GLOCELL(g->val) == val)) { i = 0; break; }

sym = ___FIELD(sym,___SYMKEY_NEXT); } }

return sym; }

___HIDDEN void trampoline ___P((___processor_state ___ps), (___ps) ___processor_state ___ps;) { ___SCMOBJ ___pc = ___ps->pc;

for (;;) { ___WORD sym; ___WORD* body = ___BODY(___pc); ___WORD *start = &body[-1]; ___WORD *ptr = start; while (!___TESTHEADERTAG(*ptr,___sVECTOR)) ptr -= ___LS; ptr += ___LS; printf("control point %3d in ", (start-ptr)/___LS); if ((sym = ___find_global_var_bound_to (___TAG(ptr,___tSUBTYPED))) == ___NUL) printf("<unknown>"); else { int i; ___SCMOBJ str = ___FIELD(sym,___SYMKEY_NAME); for (i=0; i<___INT(___STRINGLENGTH(str)); i++) printf("%c", ___INT(___STRINGREF(str,___FIX(i)))); } printf("\n");

#define CALL_STEP ___pc = ___LABEL_HOST(___pc)(___ps)

CALL_STEP;

if (___TYP(___pc) != ___tSUBTYPED) { printf("*** incorrect ___pc was returned\n"); exit(1); } } }

On Apr 6, 2016, at 8:53 PM, Bradley Lucier lucier@math.purdue.edu wrote:

I configured gambit on my Ubuntu 15.10 box with

./configure '--enable-single-host' 'CC=clang -g -save-temps -fsanitize=address,undefined -Wno-parentheses-equality’ heine:~/programs/gambit/gambit> ~/clang+llvm-3.8.0-x86_64-linux-gnu-ubuntu-15.10/bin/clang -v clang version 3.8.0 (tags/RELEASE_380/final) Target: x86_64-unknown-linux-gnu Thread model: posix InstalledDir: /home/lucier/clang+llvm-3.8.0-x86_64-linux-gnu-ubuntu-15.10/bin Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/5.2.1 Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.9 Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.9.3 Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5.2.1 Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5.2.1 Candidate multilib: .;@m64 Candidate multilib: 32;@m32 Candidate multilib: x32;@mx32 Selected multilib: .;@m64

It had been compiling one of the files for 28 hours when I left for dinner tonight, but after dinner it had miraculously finished.

And this is all the information I got:

heine:~/programs/gambit/gambit> gdb gsi/gsi GNU gdb (Ubuntu 7.10-1ubuntu2) 7.10 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: http://www.gnu.org/software/gdb/bugs/. Find the GDB manual and other documentation resources online at: http://www.gnu.org/software/gdb/documentation/. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from gsi/gsi...done. (gdb) run Starting program: /home/lucier/programs/gambit/gambit/gsi/gsi [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". setup.c:2605:16: runtime error: load of misaligned address 0x000002a9f05f for type '___host' (aka 'long (*)(struct ___processor_state_struct *)'), which requires 8 byte alignment 0x000002a9f05f: note: pointer points here ff ff ff ff ff 61 a4 4b 01 00 00 00 00 71 ed 4f f4 ff 7f 00 00 81 3f 4b 01 00 00 00 00 20 00 00 ^ SUMMARY: AddressSanitizer: undefined-behavior setup.c:2605:16 in

Program received signal SIGSEGV, Segmentation fault. 0x000000014ba461ff in ?? () (gdb) help display Print value of expression EXP each time the program stops. /FMT may be used before EXP as in the "print" command. /FMT "i" or "s" or including a size-letter is allowed, as in the "x" command, and then EXP is used to get the address to examine and examining is done as in the "x" command.

With no argument, display all currently requested auto-display expressions. Use "undisplay" to cancel display requests previously made. (gdb) where full #0 0x000000014ba461ff in ?? () No symbol table info available. #1 0x0000000000574bf3 in trampoline (___ps=<optimized out>) at setup.c:2605 ___pc = <optimized out> #2 0x00000000005748e2 in ___call (nargs=<optimized out>, proc=<optimized out>, stack_marker=<optimized out>) at setup.c:2720 ___fp = <optimized out> ___r1 = <optimized out> ___r2 = <optimized out> ___r3 = <optimized out> ___err = <optimized out> #3 0x0000000000574e23 in ___run (thunk=<optimized out>) at setup.c:2754 ___jbuf = <optimized out> ___err = <optimized out> marker = 0 #4 0x0000000000575ff6 in ___setup (setup_params=0x7fffffffe5a0) at setup.c:4225 err = <optimized out> mol = <optimized out> ___vms = 0x2a9f020 <___gstate0> module_descrs = <optimized out> #5 0x0000000000601041 in ___main (linker=<optimized out>) at main.c:723 gambitdir_map = <optimized out> gambopt = <optimized out> argv = <optimized out> current_argv = <optimized out> rpc_server_addr = 0x0 remote_dbg_addr = 0x0 file_settings = <optimized out> debug_settings = 1089 standard_level = 1 live_percent = <optimized out> max_heap_len = <optimized out> min_heap_len = <optimized out> runtime_options = <optimized out> script_line = <optimized out> setup_params = {version = 408005, argv = 0x60200000eff0, min_heap = 0, max_heap = 0, live_percent = 0, adjust_heap_hook = 0x0, display_error = 0x0, fatal_error = 0x0, standard_level = 0, debug_settings = 1089, file_settings = 0, terminal_settings = 0, stdio_settings = 0, gambitdir = 0x0, gambitdir_map = 0x0, remote_dbg_addr = 0x0, rpc_server_addr = 0x0, linker = 0x571390 <____20___gsi__>, reset_argv0 = {0}, reset_argv = { 0x7fffffffe620, 0x0}} extra_arg_pos = 1 e = <optimized out> gambitdir = 0x0 options_source = 55 #6 0x00000000005b152f in ___main_char (argc=<optimized out>, argv=<optimized out>, linker=0x571390 <____20___gsi__>, script_line=0x0) at os_base.c:413 result = <optimized out> #7 0x00007ffff6ce3a40 in __libc_start_main (main=0x5713a0 <main>, argc=1, argv=0x7fffffffe938, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe928) at libc-start.c:289 result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -1221113361900606861, 4906816, 140737488349488, 0, 0, 1221115559143172723, 1221131092478552691}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x101dae0 <__libc_csu_init>, 0x7fffffffe938}, data = {prev = 0x0, cleanup = 0x0, canceltype = 16898784}}} not_first_call = <optimized out> #8 0x00000000004adf69 in _start () No symbol table info available. (gdb)

I suppose I could send any .i or .s files if you thought they would help.

Brad

Interesting… Control point 3 in “ _num” is this C code:

___DEF_SLBL(3,___L3__20___num) ___SET_GLO(341,___G__23__23_reciprocal_2d_cache,___R1) ___SET_R1(___FIXQUO(___GLO__23__23_bignum_2e_mdigit_2d_width,___FIX(2L))) ___SET_GLO(69,___G__23__23_bignum_2e_mdigit_2d_width_2f_2,___R1) ___SET_R1(___FIXMUL(___GLO__23__23_bignum_2e_mdigit_2d_base,___FIX(16L))) ___SET_GLO(59,___G__23__23_bignum_2e_mdigit_2d_base_2a_16,___R1) ___SET_GLO(389,___G_default_2d_random_2d_source,___FAL) ___SET_R0(___LBL(4)) ___JUMPINT(___SET_NARGS(0),___PRC(4200),___L__23__23_make_2d_random_2d_source_2d_mrg32k3a)

Which is the part of _num.scm that initializes the random number generator, near the end of _num.scm . So it shouldn’t be too long to single step the code starting at ___L3__20___num to see at which point the wrong pc is being generated.

Can you do this? Probably single stepping the machine code will give the most useful information.

Marc

On Apr 6, 2016, at 10:59 PM, Bradley Lucier lucier@math.purdue.edu wrote:

The result:

heine:~/programs/gambit/gambit> gdb gsi/gsi GNU gdb (Ubuntu 7.10-1ubuntu2) 7.10 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: http://www.gnu.org/software/gdb/bugs/. Find the GDB manual and other documentation resources online at: http://www.gnu.org/software/gdb/documentation/. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from gsi/gsi...done. (gdb) run Starting program: /home/lucier/programs/gambit/gambit/gsi/gsi [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". control point 0 in _kernel control point 0 in _system control point 6 in ##load-required-module-structs control point 0 in _num control point 0 in ##make-table control point 3 in _num *** incorrect ___pc was returned

It was compiled with ---enable-single-host, so I don’t know what you expected.

Brad

Hallo,

On 07/04/16 10:10, Alex Silva wrote:

On 07/04/16 03:40, Marc Feeley wrote:

...

Very interesting! It seems that a host function was called by the trampoline and it returned a “pc” that is not aligned. The C code that is executed (repeatedly in a loop) is:

According to the error message, the load of the host function itself was misaligned. From Bradley's email:

Sorry, after reading the code I realised what you meant.

Re:

On 04/06/2016 08:53 PM, Bradley Lucier wrote:

I configured gambit on my Ubuntu 15.10 box with

./configure '--enable-single-host' 'CC=clang -g -save-temps -fsanitize=address,undefined -Wno-parentheses-equality’

<snip>

It had been compiling one of the files for 28 hours when I left for dinner tonight, but after dinner it had miraculously finished.

Marc: I'm now building it without --enable-single-host to see whether I can localize which part is miscompiled, and clang's been working about 13 hours on _io.c so far.

If the larger functions in _io.scm could be broken up it would make this kind of work much more efficient.

Brad