Zig: Compiler segfault in `copy_const_val`

Created on 21 Oct 2019 · 1Comment · Source: ziglang/zig

I'm sorry that I can't figure out a minified test case, my Zig knowledge isn't quite enough to do so. Tried with both release 0.5.0 and the latest version from master. The code failing is the following test in my project: https://github.com/Vurich/octahack/blob/master/src/main.zig#L362-L375

Running the version from master through gdb gives the following stack trace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff02c7823 in __memmove_avx_unaligned_erms () from /usr/lib/libc.so.6
(gdb) backtrace
#0  0x00007ffff02c7823 in __memmove_avx_unaligned_erms () from /usr/lib/libc.so.6
#1  0x0000555555aa6414 in copy_const_val (dest=0x555557165c70, src=0x0, same_global_refs=false)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:10577
#2  0x0000555555aa64d1 in copy_const_val (dest=0x555557165bd0, src=0x555557165b50, same_global_refs=false)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:10585
#3  0x0000555555ab5b79 in ir_analyze_instruction_decl_var (ira=0x555557164540, decl_var_instruction=0x555557155f60)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:14820
#4  0x0000555555ae0848 in ir_analyze_instruction_base (ira=0x555557164540, instruction=0x555557155f60)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:26038
#5  0x0000555555ae1767 in ir_analyze (codegen=0x5555566557a0, old_exec=0x5555571542b0, new_exec=0x555557164490, 
    expected_type=0x555557097160, expected_type_source_node=0x5555566de6b0)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:26351
#6  0x0000555555aa8093 in ir_eval_const_value (codegen=0x5555566557a0, scope=0x555557153450, node=0x5555566e23f0, 
    expected_type=0x555557097160, backward_branch_count=0x5555566fe2e8, backward_branch_quota=0x5555566fe2f0, 
    fn_entry=0x555557119890, c_import_buf=0x0, source_node=0x5555566e9920, exec_name=0x0, 
    parent_exec=0x5555566fe240, expected_type_source_node=0x5555566de6b0, undef_allowed=UndefOk)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:11136
#7  0x0000555555abac8e in ir_analyze_fn_call (ira=0x55555709e180, call_instruction=0x55555709d620, 
    fn_entry=0x555557119890, fn_type=0x555557124660, fn_ref=0x555557124d80, first_arg_ptr=0x5555571197d0, 
    comptime_fn_call=true, fn_inline=FnInlineAuto) at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:16256
#8  0x0000555555abcdec in ir_analyze_instruction_call (ira=0x55555709e180, call_instruction=0x55555709d620)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:16748
#9  0x0000555555ae08d8 in ir_analyze_instruction_base (ira=0x55555709e180, instruction=0x55555709d620)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:26050
#10 0x0000555555ae1767 in ir_analyze (codegen=0x5555566557a0, old_exec=0x5555566fe198, new_exec=0x5555566fe240, 
    expected_type=0x5555566fdb20, expected_type_source_node=0x0)
    at /home/jef/Documents/GitHub/Vurich/zig/src/ir.cpp:26351
#11 0x0000555555b31844 in analyze_fn_ir (g=0x5555566557a0, fn=0x5555566fe120, return_type_node=0x0)
    at /home/jef/Documents/GitHub/Vurich/zig/src/analyze.cpp:4517
#12 0x0000555555b31de5 in analyze_fn_body (g=0x5555566557a0, fn_table_entry=0x5555566fe120)
    at /home/jef/Documents/GitHub/Vurich/zig/src/analyze.cpp:4621
#13 0x0000555555b327ce in semantic_analyze (g=0x5555566557a0)
    at /home/jef/Documents/GitHub/Vurich/zig/src/analyze.cpp:4755
#14 0x0000555555a6b7ae in gen_root_source (g=0x5555566557a0)
    at /home/jef/Documents/GitHub/Vurich/zig/src/codegen.cpp:9365
#15 0x0000555555a6f503 in codegen_build_and_link (g=0x5555566557a0)
    at /home/jef/Documents/GitHub/Vurich/zig/src/codegen.cpp:10344
#16 0x0000555555a43142 in main (argc=3, argv=0x7fffffffdf38)
    at /home/jef/Documents/GitHub/Vurich/zig/src/main.cpp:1335

bug stage1

Source

Vurich

Most helpful comment

Easy peasy.

const_ptr_pointee_unchecked produces a constant Output initializer expression that has the fields set to nullptr because it's essentially zero-sized. Its size makes type_has_one_possible_value return OnePossibleValueYes and, as you can see, the generated ConstExprValue is essentially invalid as it breaks the type == struct => fields != nullptr invariant that's followed throughout the compiler.