[Bug c/21957] New: IA-64 register stack is not preserved after getcontext call

["akr at m17n dot org" <gcc-bugzilla at gcc dot gnu dot org>]

I found that following code causes SEGV on IA-64 Debian GNU/Linux (sarge) with gcc-4.0 -O1. The code uses getcontext and setcontext which is defined by Single Unix Specification.  rx1620% cat tst.i          typedef long unsigned int size_t;  struct ia64_fpreg {         union {                 unsigned long bits[2];                 long double __dummy;         } u; };  typedef struct sigaltstack   {     void * ss_sp;     int ss_flags;     size_t ss_size;   } stack_t;  struct sigcontext {   unsigned long int sc_flags;   unsigned long int sc_nat;   stack_t sc_stack;    unsigned long int sc_ip;   unsigned long int sc_cfm;   unsigned long int sc_um;   unsigned long int sc_ar_rsc;   unsigned long int sc_ar_bsp;   unsigned long int sc_ar_rnat;   unsigned long int sc_ar_ccv;   unsigned long int sc_ar_unat;   unsigned long int sc_ar_fpsr;   unsigned long int sc_ar_pfs;   unsigned long int sc_ar_lc;   unsigned long int sc_pr;   unsigned long int sc_br[8];   unsigned long int sc_gr[32];   struct ia64_fpreg sc_fr[128];   unsigned long int sc_rbs_base;   unsigned long int sc_loadrs;   unsigned long int sc_ar25;   unsigned long int sc_ar26;   unsigned long int sc_rsvd[12];    unsigned long int sc_mask; };  typedef struct sigcontext mcontext_t;  typedef struct ucontext   {     union       {         mcontext_t _mc;         struct           {             unsigned long _pad[(((char *) &((struct sigcontext *) 0)->sc_gr[0]) - (char *) 0)/8];             struct ucontext *_link;           }         _uc;       }     _u;   } ucontext_t;  extern int getcontext (ucontext_t *__ucp) ;  extern int setcontext (__const ucontext_t *__ucp) ;  int flag; ucontext_t cont;  static void f(void) {   flag = 1;   setcontext(&cont); }  static int g(void) {   int ret;    flag = 0;   getcontext(&cont);   ret = flag;   if (ret == 0) {     f();   }   return ret; }  int main(int argc, char **argv) {   g();   return 0; } rx1620% /home/src/gcc/4.0/bin/gcc -v -g -O1 tst.i Using built-in specs. Target: ia64-unknown-linux-gnu Configured with: ../gcc/configure --prefix=/home/src/gcc/4.0 --enable-languages=c Thread model: posix gcc version 4.0.1 20050607 (prerelease)  /home/src/gcc/4.0/libexec/gcc/ia64-unknown-linux-gnu/4.0.1/cc1 -fpreprocessed tst.i -quiet -dumpbase tst.i -auxbase tst -g -O1 -version -o /tmp/ccGs6ixv.s GNU C version 4.0.1 20050607 (prerelease) (ia64-unknown-linux-gnu)         compiled by GNU C version 4.0.1 20050607 (prerelease). GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072  as -x -o /tmp/ccgROVXU.o /tmp/ccGs6ixv.s  /home/src/gcc/4.0/libexec/gcc/ia64-unknown-linux-gnu/4.0.1/collect2 -dynamic-linker /lib/ld-linux-ia64.so.2 /usr/lib/crt1.o /usr/lib/crti.o /home/src/gcc/4.0/lib/gcc/ia64-unknown-linux-gnu/4.0.1/crtbegin.o -L/home/src/gcc/4.0/lib/gcc/ia64-unknown-linux-gnu/4.0.1 -L/home/src/gcc/4.0/lib/gcc/ia64-unknown-linux-gnu/4.0.1/../../.. /tmp/ccgROVXU.o -lgcc --as-needed -lgcc_s -lunwind --no-as-needed -lc -lgcc --as-needed -lgcc_s -lunwind --no-as-needed /home/src/gcc/4.0/lib/gcc/ia64-unknown-linux-gnu/4.0.1/crtend.o /usr/lib/crtn.o rx1620% ./a.out                                   zsh: segmentation fault (core dumped)  ./a.out rx1620% uname -a Linux rx1620 2.4.25-hpe-9-mckinley-smp #1 SMP Wed Aug 11 11:59:05 UTC 2004 ia64 GNU/Linux  ------------------------------------------------ The generated assembly code is follows.  | rx1620% /home/src/gcc/4.0/bin/gcc -O1 -S tst.i    | rx1620% cat tst.s                              |         .file   "tst.i" |         .pred.safe_across_calls p1-p5,p16-p63 |         .text |         .align 16 |         .proc f# | f: |         .prologue 12, 32 |         .save ar.pfs, r33 |         alloc r33 = ar.pfs, 0, 3, 1, 0 |         mov r34 = r1 |         .save rp, r32 |         mov r32 = b0 |         .body |         addl r15 = 1, r0 |         addl r14 = @ltoffx(flag#), r1 |         ;; |         ld8.mov r14 = [r14], flag# |         ;; |         st4 [r14] = r15 |         addl r35 = @ltoffx(cont#), r1 |         ;; |         ld8.mov r35 = [r35], cont# |         br.call.sptk.many b0 = setcontext# |         mov r1 = r34 |         ;; |         mov ar.pfs = r33 |         mov b0 = r32 |         br.ret.sptk.many b0 |         ;; |         .endp f# |         .align 16 |         .proc g# | g: |         .prologue 12, 33 |         .save ar.pfs, r34 |         alloc r34 = ar.pfs, 0, 4, 1, 0 |         mov r35 = r1 |         .save rp, r33 |         mov r33 = b0 |         .body |         addl r32 = @ltoffx(flag#), r1 |         ;; |         ld8.mov r32 = [r32], flag#  r32 is set.  |         ;; |         st4 [r32] = r0 |         addl r36 = @ltoffx(cont#), r1 |         ;; |         ld8.mov r36 = [r36], cont# |         br.call.sptk.many b0 = getcontext#  getcontext is called.  |         mov r1 = r35 |         ld4 r32 = [r32]  r32 is used. This means that the code expects r32 is preserved after getcontext returns.  |         ;; |         cmp4.ne p6, p7 = 0, r32 |         (p6) br.cond.dptk .L4 |         br.call.sptk.many b0 = f# |         mov r1 = r35 | .L4: |         mov r8 = r32 |         ;; |         mov ar.pfs = r34 |         mov b0 = r33 |         br.ret.sptk.many b0 |         ;; |         .endp g# |         .align 16 |         .global main# |         .proc main# | main: |         .prologue 12, 32 |         .save ar.pfs, r33 |         alloc r33 = ar.pfs, 0, 3, 0, 0 |         mov r34 = r1 |         .save rp, r32 |         mov r32 = b0 |         .body |         ;; |         br.call.sptk.many b0 = g# |         mov r1 = r34 |         mov r8 = r0 |         ;; |         mov ar.pfs = r33 |         mov b0 = r32 |         br.ret.sptk.many b0 |         ;; |         .endp main# |         .common flag#,4,4 |         .common cont#,2656,16 |         .ident  "GCC: (GNU) 4.0.1 20050607 (prerelease)" |    -------------------  The source code is follows.  | rx1620% cat tst.c | #include <ucontext.h> |  | int flag; | ucontext_t cont; |  | static void f(void) | { |   flag = 1; |   setcontext(&cont); | } |  | static int | g(void) | { |   int ret; |  |   flag = 0; |   getcontext(&cont); |   ret = flag; |   if (ret == 0) { |     f(); |   } |   return ret; | } |  | int main(int argc, char **argv) | { |   g(); |   return 0; | }  I investigated the problem as follows.  | rx1620% gdb a.out  | GNU gdb 6.3-debian | Copyright 2004 Free Software Foundation, Inc. | GDB is free software, covered by the GNU General Public License, and you are | welcome to change it and/or distribute copies of it under certain conditions. | Type "show copying" to see the conditions. | There is absolutely no warranty for GDB.  Type "show warranty" for details. | This GDB was configured as "ia64-linux"...Using host libthread_db library "/lib/libthread_db.so.1". |  | (gdb) display/i $pc | (gdb) run | Starting program: /home/akr/z/z/a.out  |  | Program received signal SIGSEGV, Segmentation fault. | g () at tst.i:85 | 85        ret = flag; | 1: x/i $pc  0x4000000000000901 <g+65>:              ld4 r32=[r32] | (gdb) p $r32 | $1 = 0  SEGV is caused because r32 is zero.  | (gdb) break *0x4000000000000901 | Breakpoint 1 at 0x4000000000000901: file tst.i, line 85.  The breakpoint is on the instruction to use r32.  | (gdb) disassemble  | Dump of assembler code for function g: | 0x40000000000008c0 <g+0>:       [MII]       alloc r34=ar.pfs,5,4,0 | 0x40000000000008c1 <g+1>:                   mov r35=r1 | 0x40000000000008c2 <g+2>:                   mov r33=b0 | 0x40000000000008d0 <g+16>:      [MMI]       addl r32=160,r1;; | 0x40000000000008d1 <g+17>:                  nop.m 0x0 | 0x40000000000008d2 <g+18>:                  nop.i 0x0;; | 0x40000000000008e0 <g+32>:      [MFI]       st4 [r32]=r0 | 0x40000000000008e1 <g+33>:                  nop.f 0x0 | 0x40000000000008e2 <g+34>:                  addl r36=184,r1;; | 0x40000000000008f0 <g+48>:      [MFB]       nop.m 0x0 | 0x40000000000008f1 <g+49>:                  nop.f 0x0 | 0x40000000000008f2 <g+50>:                  br.call.sptk.many b0=0x40000000000005c0 <_init+208> | 0x4000000000000900 <g+64>:      [MMI]       mov r1=r35 | 0x4000000000000901 <g+65>:                  ld4 r32=[r32] | 0x4000000000000902 <g+66>:                  nop.i 0x0;; | 0x4000000000000910 <g+80>:      [MBB]       cmp4.eq p7,p6=0,r32 | 0x4000000000000911 <g+81>:            (p06) br.cond.dptk.few 0x4000000000000930 <g+112> | 0x4000000000000912 <g+82>:                  br.call.sptk.many b0=0x4000000000000860 <f> | 0x4000000000000920 <g+96>:      [MFB]       mov r1=r35 | 0x4000000000000921 <g+97>:                  nop.f 0x0 | 0x4000000000000922 <g+98>:                  nop.b 0x0 | 0x4000000000000930 <g+112>:     [MMI]       mov r8=r32;; | 0x4000000000000931 <g+113>:                 nop.m 0x0 | 0x4000000000000932 <g+114>:                 mov.i ar.pfs=r34 | 0x4000000000000940 <g+128>:     [MIB]       nop.m 0x0 | 0x4000000000000941 <g+129>:                 mov b0=r33 | 0x4000000000000942 <g+130>:                 br.ret.sptk.many b0;; | End of assembler dump. | (gdb) break *0x40000000000008f2 | Breakpoint 2 at 0x40000000000008f2: file tst.i, line 84.  The breakpoint is on the instruction to call getcontext.  | (gdb) run | The program being debugged has been started already. | Start it from the beginning? (y or n) y | Starting program: /home/akr/z/z/a.out  |  | Breakpoint 2, g () at tst.i:84 | 84        getcontext(&cont); | 1: x/i $pc  0x40000000000008f2 <g+50>:              br.call.sptk.many b0=0x40000000000005c0 <_init+208> | (gdb) p $r32 | $2 = 6917529027641086280  r32 is not zero before getcontext call.  | (gdb) c | Continuing. |  | Breakpoint 1, g () at tst.i:85 | 85        ret = flag; | 1: x/i $pc  0x4000000000000901 <g+65>:              ld4 r32=[r32] | (gdb) p $r32 | $3 = 6917529027641086280  r32 is preserved after first getcontext return.  | (gdb) c | Continuing. |  | Breakpoint 1, g () at tst.i:85 | 85        ret = flag; | 1: x/i $pc  0x4000000000000901 <g+65>:              ld4 r32=[r32] | (gdb) p $r32 | $4 = 0  r32 is zero after second getcontext return. Note that this return is from setcontext, like longjmp to setjmp.  | (gdb) si |  | Program received signal SIGSEGV, Segmentation fault. | g () at tst.i:85 | 85        ret = flag; | 1: x/i $pc  0x4000000000000901 <g+65>:              ld4 r32=[r32]  I think the getcontext behavior is not a bug because setjmp behaves like so.  "Intel(R) Itanium(R) Software Conventions & Runtime Architecture Guide"'s section 10.3 describes setjmp may not preserve the contents of registers in  register stack (r32 to r127). http://www.intel.com/design/itanium/downloads/245358.htm  It seems that setjmp has no such problem because  gcc knows setjmp may return twice.  | rx1620% cd /home/src/gcc/4.0/gcc  | rx1620% grep -C8 '"setjmp"' gcc/calls.c |             tname += 2; |           else |             tname += 1; |         } |  |       if (tname[0] == 's') |         { |           if ((tname[1] == 'e' |                && (! strcmp (tname, "setjmp") |                    || ! strcmp (tname, "setjmp_syscall"))) |               || (tname[1] == 'i' |                   && ! strcmp (tname, "sigsetjmp")) |               || (tname[1] == 'a' |                   && ! strcmp (tname, "savectx"))) |             flags |= ECF_RETURNS_TWICE; |  |           if (tname[1] == 'i'  So I guess the problem can be fixed if gcc knows getcontext returns twice.

-- 
           Summary: IA-64 register stack is not preserved after getcontext
                    call
           Product: gcc
           Version: 4.0.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: akr at m17n dot org
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: ia64-unknown-linux-gnu
  GCC host triplet: ia64-unknown-linux-gnu
GCC target triplet: ia64-unknown-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21957