ext2fs crash

[Thomas Schwinge]

Hi!

Before preparing the next set of releases, I wanted to sort-of
sanity-check what we currently got (at least in terms of Debian
packages), so yesterday dist-upgraded my Debian GNU/Hurd system to the
latest packages, and started a GCC bootstrap build and testsuite run.
That one didn't complete successfully...

I can confirm that the
<http://news.gmane.org/find-root.php?message_id=%3C8737sjzp89.fsf%40kepler.schwinge.homeip.net%3E>
issue appears to be fixed -- yay, thanks!

The GCC testsuite got stuck on libstdc++'s
27_io/basic_filebuf/showmanyc/char/9533-1.cc.  That one compiles fine but
already before has been known to FAIL its execution testing with
"WARNING: program timed out" (probably the sort-of known frame unwinding
"deficiencies"?), but now, the whole testing harness seems to have gotten
stuck.  Manually SIGKILLing the 9533-1 process, testing continued, but
then got stuck on libstdc++'s 30_threads/async/forced_unwind.cc, which
also before has been known to FAIL its execution testing with "WARNING:
program timed out", but without making the testing harness get stuck.
Poking on forced_unwind.exe for a bit with GDB, I found the "standard"
two-threads process stuck in some pthread_cond_wait (lost the backtrace).
Eventually, ext2fs seems to have crashed ("resource lost" messages).
After rebooting, and compiling the 9533-1.cc test case with the system
compiler:

    $ g++-5 -Ilibstdc++-v3/testsuite/util 
libstdc++-v3/testsuite/27_io/basic_filebuf/showmanyc/char/9533-1.cc -g

... I got the following backtrace, which unfortunately is not helpful at
all:

    $ gdb -q ./a.out
    Reading symbols from ./a.out...done.
    (gdb) r
    Starting program: [...]/a.out
    [hangs]
    ^C[New Thread 1138.5]
    
    Program received signal SIGINT, Interrupt.
    0x01253a55 in _hurd_intr_rpc_msg_in_trap () at intr-msg.c:132
    132     intr-msg.c: No such file or directory.
    (gdb) info threads
      Id   Target Id         Frame
      5    Thread 1138.5     0x012374fc in mach_msg_trap () at 
/build/glibc-2.22/build-tree/hurd-i386-libc/mach/mach_msg_trap.S:2
    * 4    Thread 1138.4     0x01253a55 in _hurd_intr_rpc_msg_in_trap () at 
intr-msg.c:132
      3    bogus thread id 3 Can't fetch registers from thread bogus thread id 
3: No such thread
    (gdb) thread apply all bt
    
    Thread 5 (Thread 1138.5):
    #0  0x012374fc in mach_msg_trap () at 
/build/glibc-2.22/build-tree/hurd-i386-libc/mach/mach_msg_trap.S:2
    #1  0x01237c96 in __mach_msg (msg=0x145cf60, option=2, send_size=0, 
rcv_size=4096, rcv_name=11, timeout=0, notify=0) at msg.c:110
    #2  0x0123825b in __mach_msg_server_timeout (demux=0x1248330 
<msgport_server>, max_size=4096, rcv_name=11, option=0, timeout=0) at 
msgserver.c:100
    #3  0x01238384 in __mach_msg_server (demux=0x1248330 <msgport_server>, 
max_size=4096, rcv_name=11) at msgserver.c:195
    #4  0x0124841e in _hurd_msgport_receive () at msgportdemux.c:67
    #5  0x66688b92 in ?? ()
    
    Thread 4 (Thread 1138.4):
    #0  0x01253a55 in _hurd_intr_rpc_msg_in_trap () at intr-msg.c:132
    #1  0x00000036 in ?? ()

I then ran that once more, in hope for a better backtrace, and in
parallel copied the existing GCC test log files off of the Hurd system;
shortly after that (?), ext2fs crashed with the following on the console
(manually transcribed):

    /hurd/crash: /hurd/ext2fs /dev/hd2(423) crashed, signal {no:11, code:2, 
error:2}, exception {1, code:2, subcode:92671996}, PCs: {0x112a4fc, 0x112a4fc, 
0x112a4fc, 0x112a4fc, 0x112a4fc, 0x112a4fc, 0x112a4fc, 0x132868c, 0x112a4fc}, 
killing task.

I suppose we want to fix (or, at least understand) that problem before
making the releases?

I don't know if that's the actual problem, but building the attached
sources with:

    $ g++-5 -I. 9533-1.cc -g

..., and the running that executablerepeatedly, I see stuff like:

    $ while :; do echo -n .; ./a.out & p=$!; kill $p; done
    [...]
    .[1885] 5605
    [1884]   Terminated              ./a.out
    .[1886] 5609
    [1885]   Terminated              ./a.out
    *** Error in `./a.out': double free or corruption (!prev): 0x0804e4a8 ***
    .[1887] 5613
    [1886]   Terminated              ./a.out
    .[1888] 5617
    [1887]   Terminated              ./a.out

..., and on the console messages about "task /hurd/ext2fs(2090)
deallocating a bogus port [...]", repeating every once in a while.

Have to stop here, unfortunately.


Grüße
 Thomas


// { dg-require-fork "" }
// { dg-require-mkfifo "" }

// Copyright (C) 2003-2016 Free Software Foundation, Inc.
//
// This file is part of the GNU ISO C++ Library.  This library is free
// software; you can redistribute it and/or modify it under the
// terms of the GNU General Public License as published by the
// Free Software Foundation; either version 3, or (at your option)
// any later version.

// This library is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.

// You should have received a copy of the GNU General Public License along
// with this library; see the file COPYING3.  If not see
// <http://www.gnu.org/licenses/>.

// 27.8.1.4 Overridden virtual functions

#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fstream>
#include <cstdlib>
#include <testsuite_hooks.h>

// libstdc++/9533
void test_01()
{
  using namespace std;
  using namespace __gnu_test;
  bool test __attribute__((unused)) = true;
  const char* name = "tmp_fifo1";

  const int count = 10000;

  signal(SIGPIPE, SIG_IGN);
  unlink(name);
  
  if (0 != mkfifo(name, S_IRWXU))
    {
      VERIFY( false );
    }
  
  int fval = fork();
  if (fval == -1)
    {
      unlink(name);
      VERIFY( false );
    }
  else if (fval == 0)
    {
      filebuf ofbuf;
      ofbuf.open(name, ios_base::in|ios_base::out);
      VERIFY( ofbuf.is_open() );
      sleep(1);

      for (int i = 0; i < count; ++i)
        ofbuf.sputc(i % 100);

      ofbuf.pubsync();
      sleep(1);
      ofbuf.close();
      exit(0);
    }

  filebuf ifbuf;
  ifbuf.open(name, ios_base::in);
  VERIFY( ifbuf.is_open() );

  for (int j = 0; j < count; ++j)
    {
      filebuf::int_type c1 = ifbuf.sbumpc();
      VERIFY( c1 == j % 100 );
    }

  filebuf::int_type c6 = ifbuf.sbumpc();
  VERIFY( c6 == filebuf::traits_type::eof() );

  sleep(2);
  ifbuf.close();

  unlink(name);
}

int
main() 
{
  test_01();
  return 0;
}

// -*- C++ -*-
// Utility subroutines for the C++ library testsuite. 
//
// Copyright (C) 2000-2016 Free Software Foundation, Inc.
//
// This file is part of the GNU ISO C++ Library.  This library is free
// software; you can redistribute it and/or modify it under the
// terms of the GNU General Public License as published by the
// Free Software Foundation; either version 3, or (at your option)
// any later version.
//
// This library is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this library; see the file COPYING3.  If not see
// <http://www.gnu.org/licenses/>.
//

// This file provides the following:
//
// 1)  VERIFY(), via _GLIBCXX_ASSERT, from Brent Verner <brent@rcfile.org>.
//   This file is included in the various testsuite programs to provide
//   #define(able) assert() behavior for debugging/testing. It may be
//   a suitable location for other furry woodland creatures as well.
//
// 2)  set_memory_limits()
//   set_memory_limits() uses setrlimit() to restrict dynamic memory
//   allocation.  We provide a default memory limit if none is passed by the
//   calling application.  The argument to set_memory_limits() is the
//   limit in megabytes (a floating-point number).  If _GLIBCXX_RES_LIMITS is
//   not #defined before including this header, then no limiting is attempted.
//
// 3)  object_counter
//   This is a POD with a static data member, object_counter::count,
//   which starts at zero, increments on instance construction, and decrements
//   on instance destruction.  "assert_count(n)" can be called to VERIFY()
//   that the count equals N.
//
// 4)  copy_tracker, from Stephen M. Webb <stephen@bregmasoft.com>.
//   A class with nontrivial ctor/dtor that provides the ability to track the
//   number of copy ctors and dtors, and will throw on demand during copy.

#ifndef _GLIBCXX_TESTSUITE_HOOKS_H
#define _GLIBCXX_TESTSUITE_HOOKS_H

#include <bits/c++config.h>
#include <bits/functexcept.h>
#include <ctime>

#ifdef _GLIBCXX_HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif

#ifdef _GLIBCXX_ASSERT
# include <cassert>
# define VERIFY(fn) assert(fn)
#else
# define VERIFY(fn) test &= bool(fn)
#endif

#ifdef _GLIBCXX_HAVE_UNISTD_H
# include <unistd.h>
#else
# define unlink(x)
#endif

#if defined __FreeBSD__ || defined __DragonFly__ || defined __NetBSD__
# define ISO_8859(part,langTERR) #langTERR ".ISO8859-" #part
#else
# define ISO_8859(part,langTERR) ((part) == 15 ?\
         #langTERR ".ISO8859-" #part "@euro" : #langTERR ".ISO8859-" #part)
#endif

namespace __gnu_test
{
  // All macros are defined in GLIBCXX_CONFIGURE_TESTSUITE and imported
  // from c++config.h

  // Set memory limits if possible, if not set to 0.
#ifndef _GLIBCXX_RES_LIMITS
#  define MEMLIMIT_MB 0
#else
# ifndef MEMLIMIT_MB
#  define MEMLIMIT_MB 16.0
# endif
#endif
  extern void
  set_memory_limits(float __size = MEMLIMIT_MB);

  extern void
  set_file_limit(unsigned long __size);

  // Check mangled name demangles (using __cxa_demangle) as expected.
  void
  verify_demangle(const char* mangled, const char* wanted);

  // Simple callback structure for variable numbers of tests (all with
  // same signature).  Assume all unit tests are of the signature
  // void test01(); 
  class func_callback
  {
  public:
    typedef void (*test_type) (void);

  private:
    int         _M_size;
    test_type   _M_tests[15];

    func_callback&
    operator=(const func_callback&);

    func_callback(const func_callback&);

  public:
    func_callback(): _M_size(0) { }

    int
    size() const { return _M_size; }

    const test_type*
    tests() const { return _M_tests; }

    void
    push_back(test_type test)
    {
      _M_tests[_M_size] = test;
      ++_M_size;
    }
  };


  // Run select unit tests after setting global locale.
  void 
  run_tests_wrapped_locale(const char*, const func_callback&);

  // Run select unit tests after setting environment variables.
  void 
  run_tests_wrapped_env(const char*, const char*, const func_callback&);

  // Counting.
  struct object_counter
  {
    // Specifically and glaringly-obviously marked 'signed' so that
    // when COUNT mistakenly goes negative, we can track the patterns
    // of deletions more easily.
    typedef  signed int     size_type;
    static size_type   count;
    object_counter() { ++count; }
    object_counter (const object_counter&) { ++count; }
    ~object_counter() { --count; }
  };
  
#define assert_count(n)   VERIFY(__gnu_test::object_counter::count == n)
  
  // A (static) class for counting copy constructors and possibly throwing an
  // exception on a desired count.
  class copy_constructor
  {
  public:
    static unsigned int
    count() { return count_; }
    
    static void
    mark_call()
    {
      count_++;
      if (count_ == throw_on_)
        std::__throw_runtime_error("copy_constructor::mark_call");
    }
      
    static void
    reset()
    {
      count_ = 0;
      throw_on_ = 0;
    }
      
    static void
    throw_on(unsigned int count) { throw_on_ = count; }

  private:
    static unsigned int count_;
    static unsigned int throw_on_;
  };
  
  // A (static) class for counting assignment operator calls and
  // possibly throwing an exception on a desired count.
  class assignment_operator
  {
  public:
    static unsigned int
    count() { return count_; }
    
    static void
    mark_call()
    {
      count_++;
      if (count_ == throw_on_)
        std::__throw_runtime_error("assignment_operator::mark_call");
    }

    static void
    reset()
    {
      count_ = 0;
      throw_on_ = 0;
    }

    static void
    throw_on(unsigned int count) { throw_on_ = count; }

  private:
    static unsigned int count_;
    static unsigned int throw_on_;
  };
  
  // A (static) class for tracking calls to an object's destructor.
  class destructor
  {
  public:
    static unsigned int
    count() { return _M_count; }
    
    static void
    mark_call() { _M_count++; }

    static void
    reset() { _M_count = 0; }

  private:
    static unsigned int _M_count;
  };
  
  // An class of objects that can be used for validating various
  // behaviours and guarantees of containers and algorithms defined in
  // the standard library.
  class copy_tracker
  {
  public:
    // Creates a copy-tracking object with the given ID number.  If
    // "throw_on_copy" is set, an exception will be thrown if an
    // attempt is made to copy this object.
    copy_tracker(int id = next_id_--, bool throw_on_copy = false)
    : id_(id) , throw_on_copy_(throw_on_copy) { }

    // Copy-constructs the object, marking a call to the copy
    // constructor and forcing an exception if indicated.
    copy_tracker(const copy_tracker& rhs)
    : id_(rhs.id()), throw_on_copy_(rhs.throw_on_copy_)
    {
      if (throw_on_copy_)
        copy_constructor::throw_on(copy_constructor::count() + 1);
      copy_constructor::mark_call();
    }

    // Assigns the value of another object to this one, tracking the
    // number of times this member function has been called and if the
    // other object is supposed to throw an exception when it is
    // copied, well, make it so.
    copy_tracker&
    operator=(const copy_tracker& rhs)
    { 
      id_ = rhs.id();
      if (rhs.throw_on_copy_)
        assignment_operator::throw_on(assignment_operator::count() + 1);
      assignment_operator::mark_call();
      return *this;
    }

    ~copy_tracker()
    { destructor::mark_call(); }

    int
    id() const { return id_; }

    static void
    reset()
    {
      copy_constructor::reset();
      assignment_operator::reset();
      destructor::reset();
    }

  private:
    int   id_;
    const bool  throw_on_copy_;
    static int next_id_;
  };

  inline bool
  operator==(const copy_tracker& lhs, const copy_tracker& rhs)
  { return lhs.id() == rhs.id(); }

  inline bool
  operator<(const copy_tracker& lhs, const copy_tracker& rhs)
  { return lhs.id() < rhs.id(); }

  // Class for checking required type conversions, implicit and
  // explicit for given library data structures. 
  template<typename _Container>
    struct conversion
    {
      typedef typename _Container::const_iterator const_iterator;
      
      // Implicit conversion iterator to const_iterator.
      static const_iterator
      iterator_to_const_iterator()
      {
        _Container v;
        const_iterator it = v.begin();
        const_iterator end = v.end();
        return it == end ? v.end() : it;
      }
    };

  // A binary semaphore for use across multiple processes.
  class semaphore 
  {
  public:
    // Creates a binary semaphore.  The semaphore is initially in the
    // unsignaled state. 
    semaphore();

    // Destroy the semaphore.
    ~semaphore();

    // Signal the semaphore.  If there are processes blocked in
    // "wait", exactly one will be permitted to proceed.
    void signal();

    // Wait until the semaphore is signaled.
    void wait();

  private:
    int sem_set_;

    pid_t pid_;
  };

  // For use in 22_locale/time_get and time_put.
  std::tm test_tm(int sec, int min, int hour, int mday, int mon,
                  int year, int wday, int yday, int isdst);

} // namespace __gnu_test

#endif // _GLIBCXX_TESTSUITE_HOOKS_H

signature.asc
Description: PGP signature