Rust: SIGSEGV compiling num-integer for asmjs-unknown-emscripten

[cuviper]

On current num-integer master (commit f0e329af1195), rustc nightly and beta both crash when targeting asmjs-unknown-emscripten. Stable is fine.

   stable-x86_64-unknown-linux-gnu - rustc 1.39.0 (4560ea788 2019-11-04)
     beta-x86_64-unknown-linux-gnu - rustc 1.40.0-beta.1 (76b40532a 2019-11-05)
  nightly-x86_64-unknown-linux-gnu - rustc 1.40.0-nightly (3fc30d884 2019-11-10)

$ cargo +stable build --target asmjs-unknown-emscripten
   Compiling autocfg v0.1.7
   Compiling num-traits v0.2.8
   Compiling num-integer v0.1.41 (/home/jistone/rust/num/integer)
    Finished dev [unoptimized + debuginfo] target(s) in 2.60s

$ cargo +beta build --target asmjs-unknown-emscripten
   Compiling num-integer v0.1.41 (/home/jistone/rust/num/integer)
warning: `#[inline]` is ignored on function prototypes
   --> src/lib.rs:260:5
    |
260 |     #[inline]
    |     ^^^^^^^^^
    |
    = note: `#[warn(unused_attributes)]` on by default

Referencing function in another module!
  call void <badref>(i8* %40), !dbg !50
; ModuleID = '39eosbi6n9pwhhcp'
void (i8*)* <badref>
; ModuleID = '
error: could not compile `num-integer`.

Caused by:
  process didn't exit successfully: `rustc --crate-name num_integer src/lib.rs --error-format=json --json=diagnostic-rendered-ansi --crate-type lib --emit=dep-info,metadata,link -C debuginfo=2 --cfg 'feature="default"' --cfg 'feature="std"' -C metadata=795c310a63594098 -C extra-filename=-795c310a63594098 --out-dir /home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/deps --target asmjs-unknown-emscripten -C incremental=/home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/incremental -L dependency=/home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/deps -L dependency=/home/jistone/rust/num/integer/target/debug/deps --extern num_traits=/home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/deps/libnum_traits-2f98a4660a35fd13.rmeta --cfg has_i128` (signal: 11, SIGSEGV: invalid memory reference)

$ cargo +nightly build --target asmjs-unknown-emscripten
   Compiling num-integer v0.1.41 (/home/jistone/rust/num/integer)
warning: `#[inline]` is ignored on function prototypes
   --> src/lib.rs:260:5
    |
260 |     #[inline]
    |     ^^^^^^^^^
    |
    = note: `#[warn(unused_attributes)]` on by default

Referencing function in another module!
  call void <badref>(i8* %40), !dbg !50
; ModuleID = '4z4jvx7urdbbg8j3'
void (i8*)* <badref>
; ModuleID = '
error: could not compile `num-integer`.

Caused by:
  process didn't exit successfully: `rustc --crate-name num_integer src/lib.rs --error-format=json --json=diagnostic-rendered-ansi --crate-type lib --emit=dep-info,metadata,link -C debuginfo=2 --cfg 'feature="default"' --cfg 'feature="std"' -C metadata=947cae8a7fd914b6 -C extra-filename=-947cae8a7fd914b6 --out-dir /home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/deps --target asmjs-unknown-emscripten -C incremental=/home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/incremental -L dependency=/home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/deps -L dependency=/home/jistone/rust/num/integer/target/debug/deps --extern num_traits=/home/jistone/rust/num/integer/target/asmjs-unknown-emscripten/debug/deps/libnum_traits-1f95a1b3834a3c5f.rmeta --cfg has_i128` (signal: 11, SIGSEGV: invalid memory reference)

(The inline attribute warning is irrelevant to success/failure, but I'll clean that up separately.)

cc @mashedcode rust-num/num-integer#28

[cuviper]

GDB backtrace of the SIGSEGV thread on nightly:

(gdb) bt
#0  0x00007fffeee66962 in void llvm::VerifierSupport::WriteTs<llvm::Function*, llvm::Module*>(llvm::Function* const&, llvm::Module* const&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#1  0x00007fffeee70d93 in (anonymous namespace)::Verifier::visitInstruction(llvm::Instruction&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#2  0x00007fffeee7d93c in (anonymous namespace)::Verifier::visitCallInst(llvm::CallInst&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#3  0x00007fffeee584e8 in (anonymous namespace)::Verifier::verify(llvm::Function const&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#4  0x00007fffeee7eff3 in (anonymous namespace)::VerifierLegacyPass::runOnFunction(llvm::Function&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#5  0x00007fffeee0242f in llvm::FPPassManager::runOnFunction(llvm::Function&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#6  0x00007fffeee02893 in llvm::FPPassManager::runOnModule(llvm::Module&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#7  0x00007fffeee03030 in llvm::legacy::PassManagerImpl::run(llvm::Module&) ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/../lib/libLLVM-9-rust-1.40.0-nightly.so
#8  0x00007ffff18791bf in LLVMRustWriteOutputFile ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#9  0x00007ffff182478c in rustc_codegen_llvm::back::write::write_output_file ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#10 0x00007ffff17179e6 in rustc_codegen_llvm::back::write::codegen::{{closure}} ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#11 0x00007ffff17139f1 in rustc::util::common::time_ext ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#12 0x00007ffff1834221 in <rustc_codegen_llvm::LlvmCodegenBackend as rustc_codegen_ssa::traits::write::WriteBackendMethods>::codegen ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#13 0x00007ffff174a294 in std::sys_common::backtrace::__rust_begin_short_backtrace ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#14 0x00007ffff174bcb6 in std::panicking::try::do_call ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#15 0x00007ffff511eeea in __rust_maybe_catch_panic () at src/libpanic_unwind/lib.rs:79
#16 0x00007ffff1726706 in core::ops::function::FnOnce::call_once{{vtable-shim}} ()
   from /home/jistone/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
#17 0x00007ffff50efc8f in <alloc::boxed::Box<F> as core::ops::function::FnOnce<A>>::call_once ()
    at /rustc/3fc30d884ae0c988d98452a06737705cfe34806a/src/liballoc/boxed.rs:942
#18 0x00007ffff511d910 in <alloc::boxed::Box<F> as core::ops::function::FnOnce<A>>::call_once ()
    at /rustc/3fc30d884ae0c988d98452a06737705cfe34806a/src/liballoc/boxed.rs:942
#19 std::sys_common::thread::start_thread () at src/libstd/sys_common/thread.rs:13
#20 std::sys::unix::thread::Thread::new::thread_start () at src/libstd/sys/unix/thread.rs:79
#21 0x00007ffff505d4e2 in start_thread () from /lib64/libpthread.so.0
#22 0x00007ffff4f7a643 in clone () from /lib64/libc.so.6

[mashedcode]

Thanks @cuviper. Minimal reproducible test case:

pub fn foo() {
    (0..0).rev().next();
}

[pnkfelix]

triage: P-high for now. (but this is a Tier-2 target, so it may get downgraded to P-medium after a few weeks. We will see.)

[cuviper]

cc #65251 @tlively @alexcrichton -- the versions correspond to the LLVM change for emscripten.

[tlively]

This looks like an error in the LLVM verifier, so there is something wrong with the generated LLVM IR. I think we can rule out a bug in the WebAssembly LLVM backend.

[alexcrichton]

Sorry I'm not sure where this would be coming from either.. It's likely due to the upgrade of LLVM for the emscripten target for sure though

[michalbe]

Hello,
Is there an ETA for the fix? Or maybe someone more familiar with the issue could guide me on where/how this can be fixed, so I can try on my own if it's not part of the roadmap yet?

[tlively]

This is on my backlog of things to look into, but I don't know when I will be able to get to it. I don't know of anyone else planning to look into it.

[tlively]

It looks like this affects wasm32-unknown-emscripten as well: https://github.com/Rust-SDL2/rust-sdl2/issues/884#issuecomment-570291357.

[bsurmanski]

tested the minimum test case (above) on wasm32-unknown-emscripten using stable (1.40.0 2019-12-16) and nightly (1.42.0 - 2020-01-01) with the same result:
Called function must be a pointer! call addrspace(4711381) void <badref>(i8* %40), !dbg !52 in function _ZN4core4iter5range116_$LT$impl$u20$core..iter..traits..double_ended..DoubleEndedIterator$u20$for$u20$core..ops..range..Range$LT$A$GT$$GT$9next_back17h9348d20e8f4fe0bcE LLVM ERROR: Broken function found, compilation aborted!

[tlively]

I started looking into this and I can successfully reproduce the crash. On some runs I get additional errors LLVM ERROR: "<junk string>" pass is not registered where the junk string is nondeterministic. Sometimes I also get the message free(): corrupted unsorted chunks. Clearly there is a memory corruption issue. Is there a way to build rustc and its LLVM with AddressSanitizer enabled?

[tlively]

It looks like this is a use-after-free when LLVM is built in release mode. It is caught earlier by an assertion with a debug build of LLVM, and from the backtrace there it looks like there is indeed a previously-unknown issue with the Emscripten exception lowering pass. We are investigating further now.

[tlively]

Fix in LLVM incoming: https://reviews.llvm.org/D72308. Once it merges upstream, I will handle getting it merged to Rust's LLVM fork and from there to rustc.

[tmandry]

Should be fixed by https://github.com/rust-lang/rust/pull/68030.

[cuviper]

Were you able to verify that? I can still reproduce it with rustc 1.42.0-nightly (b5a3341f1 2020-01-20).

[tmandry]

No, I just checked that the patch had landed. Reopening.

[tlively]

I thought it had been fixed because the regression test I had locally for it passes. But it turns out the test runner uses -C opt-level=2 by default and the crash now needs -C opt-level=0 to be triggered. I will continue looking into this.

[cuviper]

Confirmed, thanks!