SIGSEGV when using non-trivial thread_local! with -C target-cpu=haswell on macOS

[swolchok]

Here's a code sample, narrowed down a bit from my program:

extern crate fnv;
extern crate rayon;

use fnv::FnvHashMap;
use rayon::prelude::*;
use std::cell::RefCell;
use std::sync::Arc;

#[derive(Clone)]
struct Scratchpad {
    vals: FnvHashMap<u32, u32>,
}

fn main() {
    let per_thread_state = Scratchpad { vals: Default::default() };
    let per_thread_state = Arc::new(per_thread_state);

    thread_local! {
        static STATE : RefCell<Option<Scratchpad>> = RefCell::new(None);
    }

    {
        let pts = per_thread_state.clone();
        let configuration = rayon::Configuration::new().start_handler(move |_| {
            STATE.with(|current_value| {
                assert!(current_value.borrow().is_none());
                *current_value.borrow_mut() = Some((*pts).clone());
            });
        });
        rayon::initialize(configuration);
    }
    let sum: u32 = vec![0; 100].par_iter().map(|&item| item).sum();
    println!("Sum is {}", sum);
}

When built with RUSTFLAGS="-C target-cpu=native" cargo build --release and run, it gets SIGSEGV on my Mac. (I poked around a little bit with lldb and it looks like tlv_get_addr is returning something we can't dereference. I couldn't investigate thoroughly because it wasn't showing source line information for whatever reason.) Without the RUSTFLAGS, it doesn't segfault.

Here's an lldb session with some basic information about the crash:

rust-lldb target/release/threadlocalrepro
(lldb) command source -s 0 '/tmp/rust-lldb-commands.vC8eMe'
Executing commands in '/tmp/rust-lldb-commands.vC8eMe'.
(lldb) command script import "/usr/local/Cellar/rust/1.22.1/lib/rustlib/etc/lldb_rust_formatters.py"
(lldb) type summary add --no-value --python-function lldb_rust_formatters.print_val -x ".*" --category Rust
(lldb) type category enable Rust
(lldb) target create "target/release/threadlocalrepro"
Current executable set to 'target/release/threadlocalrepro' (x86_64).
(lldb) run
Process 53759 launched: '/Users/swolchok/threadlocalrepro/target/release/threadlocalrepro' (x86_64)
Process 53759 stopped
* thread #2, stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x00000001000042ae threadlocalrepro`threadlocalrepro::main::_$u7b$$u7b$closure$u7d$$u7d$::h3e975efef0e15fc4 + 302
threadlocalrepro`threadlocalrepro::main::_$u7b$$u7b$closure$u7d$$u7d$::h3e975efef0e15fc4:
->  0x1000042ae <+302>: vmovdqa (%rax), %ymm0
    0x1000042b2 <+306>: movl   $0x1, %ecx
    0x1000042b7 <+311>: vmovq  %rcx, %xmm1
    0x1000042bc <+316>: vmovdqa %ymm1, (%rax)
Target 0: (threadlocalrepro) stopped.
(lldb) register read
General Purpose Registers:
       rax = 0x0000000100202890
       rbx = 0x0000000100202890
       rcx = 0x0000000000000003
       rdx = 0x0000000100202890
       rdi = 0x000000010005db08  threadlocalrepro`threadlocalrepro::main::STATE::__getit::__KEY::h3fa22d7abc868d4a
       rsi = 0x0000000100200000
       rbp = 0x0000700004e80c50
       rsp = 0x0000700004e80bf0
        r8 = 0x0000000000000004
        r9 = 0x0000000000000000
       r10 = 0x0000000000000001
       r11 = 0x0000000000000005
       r12 = 0x0000000100624000
       r13 = 0x0000000100624090
       r14 = 0x0000000100617008
       r15 = 0x0000700004e80d08
       rip = 0x00000001000042ae  threadlocalrepro`threadlocalrepro::main::_$u7b$$u7b$closure$u7d$$u7d$::h3e975efef0e15fc4 + 302
    rflags = 0x0000000000010206
        cs = 0x000000000000002b
        fs = 0x0000000000000000
        gs = 0x0000000000000000

(lldb) bt
* thread #2, stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x00000001000042ae threadlocalrepro`threadlocalrepro::main::_$u7b$$u7b$closure$u7d$$u7d$::h3e975efef0e15fc4 + 302
    frame #1: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #2: 0x000000010000564b threadlocalrepro`std::sys_common::backtrace::__rust_begin_short_backtrace::h25c1221ba9601a19 + 475
    frame #3: 0x0000000100005e6d threadlocalrepro`std::panicking::try::do_call::habed391336ff94ed + 29
    frame #4: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #5: 0x000000010000750b threadlocalrepro`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hc3095b26e437282e + 171
    frame #6: 0x000000010001a97c threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:736 [opt]
    frame #7: 0x000000010001a979 threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:24 [opt]
    frame #8: 0x000000010001a8fe threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:90 [opt]
    frame #9: 0x00007fffe2c9993b libsystem_pthread.dylib`_pthread_body + 180
    frame #10: 0x00007fffe2c99887 libsystem_pthread.dylib`_pthread_start + 286
    frame #11: 0x00007fffe2c9908d libsystem_pthread.dylib`thread_start + 13
(lldb) bt all
  thread #1, queue = 'com.apple.main-thread'
    frame #0: 0x00007fffe2baebf2 libsystem_kernel.dylib`__psynch_cvwait + 10
    frame #1: 0x00007fffe2c9a7fa libsystem_pthread.dylib`_pthread_cond_wait + 712
    frame #2: 0x0000000100007993 threadlocalrepro`rayon_core::latch::LockLatch::wait::h1a0d2eb553df7e2a + 163
    frame #3: 0x000000010000a1cc threadlocalrepro`rayon_core::initialize::h33e8eefa046130dd + 348
    frame #4: 0x0000000100003e2b threadlocalrepro`threadlocalrepro::main::h5914660853824a52 + 379
    frame #5: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #6: 0x000000010001bc09 threadlocalrepro`std::rt::lang_start [inlined] std::panicking::try<(),closure> at panicking.rs:459 [opt]
    frame #7: 0x000000010001bbd6 threadlocalrepro`std::rt::lang_start [inlined] std::panic::catch_unwind<closure,()> at panic.rs:361 [opt]
    frame #8: 0x000000010001bbd6 threadlocalrepro`std::rt::lang_start at rt.rs:59 [opt]
    frame #9: 0x00007fffe2a80235 libdyld.dylib`start + 1
    frame #10: 0x00007fffe2a80235 libdyld.dylib`start + 1
* thread #2, stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x00000001000042ae threadlocalrepro`threadlocalrepro::main::_$u7b$$u7b$closure$u7d$$u7d$::h3e975efef0e15fc4 + 302
    frame #1: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #2: 0x000000010000564b threadlocalrepro`std::sys_common::backtrace::__rust_begin_short_backtrace::h25c1221ba9601a19 + 475
    frame #3: 0x0000000100005e6d threadlocalrepro`std::panicking::try::do_call::habed391336ff94ed + 29
    frame #4: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #5: 0x000000010000750b threadlocalrepro`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hc3095b26e437282e + 171
    frame #6: 0x000000010001a97c threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:736 [opt]
    frame #7: 0x000000010001a979 threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:24 [opt]
    frame #8: 0x000000010001a8fe threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:90 [opt]
    frame #9: 0x00007fffe2c9993b libsystem_pthread.dylib`_pthread_body + 180
    frame #10: 0x00007fffe2c99887 libsystem_pthread.dylib`_pthread_start + 286
    frame #11: 0x00007fffe2c9908d libsystem_pthread.dylib`thread_start + 13
  thread #3
    frame #0: 0x00007fffe2baebf2 libsystem_kernel.dylib`__psynch_cvwait + 10
    frame #1: 0x00007fffe2c9a7fa libsystem_pthread.dylib`_pthread_cond_wait + 712
    frame #2: 0x0000000100009df5 threadlocalrepro`rayon_core::sleep::Sleep::sleep::he476e9c9ebf0bba4 + 277
    frame #3: 0x0000000100009986 threadlocalrepro`rayon_core::registry::WorkerThread::wait_until::h438f955d0a4ae18c + 630
    frame #4: 0x0000000100005701 threadlocalrepro`std::sys_common::backtrace::__rust_begin_short_backtrace::h25c1221ba9601a19 + 657
    frame #5: 0x0000000100005e6d threadlocalrepro`std::panicking::try::do_call::habed391336ff94ed + 29
    frame #6: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #7: 0x000000010000750b threadlocalrepro`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hc3095b26e437282e + 171
    frame #8: 0x000000010001a97c threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:736 [opt]
    frame #9: 0x000000010001a979 threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:24 [opt]
    frame #10: 0x000000010001a8fe threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:90 [opt]
    frame #11: 0x00007fffe2c9993b libsystem_pthread.dylib`_pthread_body + 180
    frame #12: 0x00007fffe2c99887 libsystem_pthread.dylib`_pthread_start + 286
    frame #13: 0x00007fffe2c9908d libsystem_pthread.dylib`thread_start + 13
  thread #4
    frame #0: 0x00007fffe2bb0246 libsystem_kernel.dylib`read + 10
    frame #1: 0x0000000100011637 threadlocalrepro`std::fs::{{impl}}::read [inlined] std::sys::imp::fd::{{impl}}::read at fd.rs:58 [opt]
    frame #2: 0x000000010001161a threadlocalrepro`std::fs::{{impl}}::read [inlined] std::sys::imp::fs::{{impl}}::read at fs.rs:496 [opt]
    frame #3: 0x000000010001161a threadlocalrepro`std::fs::{{impl}}::read at fs.rs:449 [opt]
    frame #4: 0x000000010000af71 threadlocalrepro`_$LT$rand..os..imp..OsRng$u20$as$u20$rand..Rng$GT$::fill_bytes::h8532113fd6db4404 + 65
    frame #5: 0x000000010000b1b1 threadlocalrepro`rand::StdRng::new::hcd2107c72b382959 + 337
    frame #6: 0x000000010000b9c2 threadlocalrepro`rand::thread_rng::THREAD_RNG_KEY::__init::he04c67a54866e26e + 34
    frame #7: 0x000000010000b91d threadlocalrepro`rand::thread_rng::h5fb42a8cb8008a3e + 93
    frame #8: 0x000000010000b26a threadlocalrepro`rand::weak_rng::h1e1cad0723c27821 + 26
    frame #9: 0x00000001000054ae threadlocalrepro`std::sys_common::backtrace::__rust_begin_short_backtrace::h25c1221ba9601a19 + 62
    frame #10: 0x0000000100005e6d threadlocalrepro`std::panicking::try::do_call::habed391336ff94ed + 29
    frame #11: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #12: 0x000000010000750b threadlocalrepro`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hc3095b26e437282e + 171
    frame #13: 0x000000010001a97c threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:736 [opt]
    frame #14: 0x000000010001a979 threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:24 [opt]
    frame #15: 0x000000010001a8fe threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:90 [opt]
    frame #16: 0x00007fffe2c9993b libsystem_pthread.dylib`_pthread_body + 180
    frame #17: 0x00007fffe2c99887 libsystem_pthread.dylib`_pthread_start + 286
    frame #18: 0x00007fffe2c9908d libsystem_pthread.dylib`thread_start + 13
  thread #5
    frame #0: 0x00007fffe2bb0246 libsystem_kernel.dylib`read + 10
    frame #1: 0x0000000100011637 threadlocalrepro`std::fs::{{impl}}::read [inlined] std::sys::imp::fd::{{impl}}::read at fd.rs:58 [opt]
    frame #2: 0x000000010001161a threadlocalrepro`std::fs::{{impl}}::read [inlined] std::sys::imp::fs::{{impl}}::read at fs.rs:496 [opt]
    frame #3: 0x000000010001161a threadlocalrepro`std::fs::{{impl}}::read at fs.rs:449 [opt]
    frame #4: 0x000000010000af71 threadlocalrepro`_$LT$rand..os..imp..OsRng$u20$as$u20$rand..Rng$GT$::fill_bytes::h8532113fd6db4404 + 65
    frame #5: 0x000000010000b1b1 threadlocalrepro`rand::StdRng::new::hcd2107c72b382959 + 337
    frame #6: 0x000000010000b9c2 threadlocalrepro`rand::thread_rng::THREAD_RNG_KEY::__init::he04c67a54866e26e + 34
    frame #7: 0x000000010000b91d threadlocalrepro`rand::thread_rng::h5fb42a8cb8008a3e + 93
    frame #8: 0x000000010000b26a threadlocalrepro`rand::weak_rng::h1e1cad0723c27821 + 26
    frame #9: 0x00000001000054ae threadlocalrepro`std::sys_common::backtrace::__rust_begin_short_backtrace::h25c1221ba9601a19 + 62
    frame #10: 0x0000000100005e6d threadlocalrepro`std::panicking::try::do_call::habed391336ff94ed + 29
    frame #11: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #12: 0x000000010000750b threadlocalrepro`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hc3095b26e437282e + 171
    frame #13: 0x000000010001a97c threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:736 [opt]
    frame #14: 0x000000010001a979 threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:24 [opt]
    frame #15: 0x000000010001a8fe threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:90 [opt]
    frame #16: 0x00007fffe2c9993b libsystem_pthread.dylib`_pthread_body + 180
    frame #17: 0x00007fffe2c99887 libsystem_pthread.dylib`_pthread_start + 286
    frame #18: 0x00007fffe2c9908d libsystem_pthread.dylib`thread_start + 13
  thread #6
    frame #0: 0x00007fffe2baebf2 libsystem_kernel.dylib`__psynch_cvwait + 10
    frame #1: 0x00007fffe2c9a7fa libsystem_pthread.dylib`_pthread_cond_wait + 712
    frame #2: 0x0000000100009df5 threadlocalrepro`rayon_core::sleep::Sleep::sleep::he476e9c9ebf0bba4 + 277
    frame #3: 0x0000000100009986 threadlocalrepro`rayon_core::registry::WorkerThread::wait_until::h438f955d0a4ae18c + 630
    frame #4: 0x0000000100005701 threadlocalrepro`std::sys_common::backtrace::__rust_begin_short_backtrace::h25c1221ba9601a19 + 657
    frame #5: 0x0000000100005e6d threadlocalrepro`std::panicking::try::do_call::habed391336ff94ed + 29
    frame #6: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #7: 0x000000010000750b threadlocalrepro`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hc3095b26e437282e + 171
    frame #8: 0x000000010001a97c threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:736 [opt]
    frame #9: 0x000000010001a979 threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:24 [opt]
    frame #10: 0x000000010001a8fe threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:90 [opt]
    frame #11: 0x00007fffe2c9993b libsystem_pthread.dylib`_pthread_body + 180
    frame #12: 0x00007fffe2c99887 libsystem_pthread.dylib`_pthread_start + 286
    frame #13: 0x00007fffe2c9908d libsystem_pthread.dylib`thread_start + 13
  thread #7
    frame #0: 0x00007fffe2baebf2 libsystem_kernel.dylib`__psynch_cvwait + 10
    frame #1: 0x00007fffe2c9a7fa libsystem_pthread.dylib`_pthread_cond_wait + 712
    frame #2: 0x0000000100009df5 threadlocalrepro`rayon_core::sleep::Sleep::sleep::he476e9c9ebf0bba4 + 277
    frame #3: 0x0000000100009986 threadlocalrepro`rayon_core::registry::WorkerThread::wait_until::h438f955d0a4ae18c + 630
    frame #4: 0x0000000100005701 threadlocalrepro`std::sys_common::backtrace::__rust_begin_short_backtrace::h25c1221ba9601a19 + 657
    frame #5: 0x0000000100005e6d threadlocalrepro`std::panicking::try::do_call::habed391336ff94ed + 29
    frame #6: 0x00000001000221fd threadlocalrepro`panic_unwind::__rust_maybe_catch_panic at lib.rs:99 [opt]
    frame #7: 0x000000010000750b threadlocalrepro`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hc3095b26e437282e + 171
    frame #8: 0x000000010001a97c threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:736 [opt]
    frame #9: 0x000000010001a979 threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:24 [opt]
    frame #10: 0x000000010001a8fe threadlocalrepro`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:90 [opt]
    frame #11: 0x00007fffe2c9993b libsystem_pthread.dylib`_pthread_body + 180
    frame #12: 0x00007fffe2c99887 libsystem_pthread.dylib`_pthread_start + 286
    frame #13: 0x00007fffe2c9908d libsystem_pthread.dylib`thread_start + 13
(lldb)

rustc --version --verbose
rustc 1.22.1
binary: rustc
commit-hash: unknown
commit-date: unknown
host: x86_64-apple-darwin
release: 1.22.1
LLVM version: 4.0

I'm on macOS 10.12.6. target-cpu=native on my machine seems to mean haswell, according to rustc --print target-cpus.

[jethrogb]

Seems to be macOS-specific, can't reproduce this on Linux.

[tcr]

I can repro on my Mac. Early 2015 Macbook Pro, running macOS Sierra.

$ sysctl -n machdep.cpu.brand_string
Intel(R) Core(TM) i7-5557U CPU @ 3.10GHz

It did not crash on my 1.18.0 install; first starts crashing on 1.20.0 installed via rustup:

rustc --version --verbose
rustc 1.20.0 (f3d6973f4 2017-08-27)
binary: rustc
commit-hash: f3d6973f41a7d1fb83029c9c0ceaf0f5d4fd7208
commit-date: 2017-08-27
host: x86_64-apple-darwin
release: 1.20.0
LLVM version: 4.0

[alexcrichton]

This may be #44056 which was diagnosed as an LLVM bug.

[nikomatsakis]

triage: P-medium

Seems likely to be an LLVM bug. If more data or dups turn up, we can re-evaluate.

[josephDunne]

I am experiencing something similar to this when compiling native on OSX.

thread #2, stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x0000000100196852 nap`std::sys_common::thread_info::set::h958c88701b41d520 + 114
nap`std::sys_common::thread_info::set::h958c88701b41d520:
->  0x100196852 <+114>: vmovaps (%rax), %ymm0
    0x100196856 <+118>: vmovaps 0x60302(%rip), %ymm1
    0x10019685e <+126>: vmovaps %ymm1, (%rax)
    0x100196862 <+130>: movq   0x20(%rax), %rax

OSX

sysctl -n machdep.cpu.brand_string
Intel(R) Xeon(R) CPU E5-1650 v2 @ 3.50GHz

rustc --version --verbose
rustc 1.25.0-nightly (4d2d3fc5d 2018-02-13)
binary: rustc
commit-hash: 4d2d3fc5dadf894a8ad709a5860a549f2c0b1032
commit-date: 2018-02-13
host: x86_64-apple-darwin
release: 1.25.0-nightly
LLVM version: 6.0

[Edit] problem does not exists in nightly v 1.24. So perhaps a regression in LLVM 6.0?

rustc 1.24.0-nightly (9389e23a8 2017-12-31)
binary: rustc
commit-hash: 9389e23a8a754097e233c7bf3ea1bb404ccf1075
commit-date: 2017-12-31
host: x86_64-apple-darwin
release: 1.24.0-nightly
LLVM version: 4.0