debug no-optimize OS X make check-fast exposes segfault in rustc

[pnkfelix]

Probably related to #9127 (or at least the stack traces look similar to me):

CFG_CONFIGURE_ARGS   := --enable-debug --disable-optimize --enable-ccache --enable-clang --prefix=~/opt/rust-dbg-nopt

% x86_64-apple-darwin/stage2/bin/rustc --cfg stage2   --cfg debug -Z no-debug-borrows --target=x86_64-apple-darwin  --lib -o x86_64-apple-darwin/stage2/lib/rustc/x86_64-apple-darwin/lib/librun_pass_stage2.dylib tmp/run_pass_stage2.rc
Bus error: 10

---

Update: Here is a isolated test case (importantly, it does not depend on pulling in libsyntax):

pub trait bomb { fn boom(@self, Ident); }
pub struct S;
impl bomb for S { fn boom(@self, _: Ident) { } }

pub struct Ident { name: uint }

// macro_rules! int3( () => ( unsafe { asm!( "int3" ); } ) )
macro_rules! int3( () => ( { } ) )

fn Ident_new() -> Ident {
    int3!();
    Ident {name: 0x6789ABCD }
}

pub fn light_fuse(fld: @bomb) {
    int3!();
    let f = || {
        int3!();
        fld.boom(Ident_new()); // *** 1
    };
    f();
}

fn main() {
    let b = @S as @bomb;
    light_fuse(b);
}

[pnkfelix]

Bisecting the contents of run_pass_stage2.rc, the problem down to one particular test:

% x86_64-apple-darwin/stage2/bin/rustc --cfg stage2   --cfg debug -Z no-debug-borrows \
  --target=x86_64-apple-darwin  --lib \
  -o x86_64-apple-darwin/stage2/lib/rustc/x86_64-apple-darwin/lib/librun_pass_stage2.dylib \
  ../src/test/run-pass/issue-2216.rs
Segmentation fault: 11

[pnkfelix]

Further narrowing reveals that the problem seems to be when we have either of labelled ExprBreak or ExprAgain statements:

% cat /tmp/issue-2216.rs
#[cfg(labelled_loop)]
pub fn main() { 'foo: loop { loop 'foo; } }

#[cfg(labelled_break)]
pub fn main() { 'foo: loop { break 'foo; } }
%  x86_64-apple-darwin/stage2/bin/rustc --cfg labelled_break  /tmp/issue-2216.rs
Bus error: 10
%  x86_64-apple-darwin/stage2/bin/rustc --cfg labelled_loop  /tmp/issue-2216.rs
Bus error: 10
% grep CONFIGURE_ARGS config.mk
CFG_CONFIGURE_ARGS   := --enable-debug --disable-optimize --enable-clang --prefix=~/opt/rust-dbg-nopt
% 

[huonw]

Is the segfault/bus error due to infinite recursion?

[pnkfelix]

@huonw no, I already considered that, but the stack isn't that large, especially once you try on one of the narrowed test cases.

My current hypothesis is that it has something to do with these bits of code, like:

(update; correction to below, I have cut-and-pasted some code into config.rs for instrumentation, but the origin of the code in question is fold.rs)
config.rs fold.rs says:

        ExprBreak(ref opt_ident) => {
            // FIXME #6993: add fold_name to fold.... then cut out the
            // bogus Name->Ident->Name conversion.
            ExprBreak(opt_ident.map_move(|x| fld.fold_ident(Ident::new(x)).name))
        }
        ExprAgain(ref opt_ident) => {
            // FIXME #6993: add fold_name to fold....
            ExprAgain(opt_ident.map_move(|x| fld.fold_ident(Ident::new(x)).name))
        }

but I have not figured out what is actually wrong there yet, if anything.

[pnkfelix]

Further discovery: the problem seems to be the subexpression Ident::new(x) as a direct argument to fold_indent. If I lift the expression out and bind it before the call, things work.

The cute thing here is that since I am seeing the same bug on both ExprBreak and on ExprAgain, I can quite directly illustrate the difference (with much the same test case that I used before):

% cat /tmp/issue-2216.rs

#[cfg(labelled_again)]
pub fn main() { 'foo: loop { loop 'foo; } }

#[cfg(labelled_break)]
pub fn main() { 'foo: loop { break 'foo; } }

#[cfg(labelled_for)]
pub fn main() { 'foo: for i in range(1,10) { } }

The relevant modification to the code in fold.rs (as well as anywhere else I happened to cut-and-paste that code):

        ExprBreak(ref opt_ident) => {
            debug!("fold ExprBreak input: %?", opt_ident);
            let ret = ExprBreak(opt_ident.map_move(|x| {
                        // let i1 = Ident::new(x);
                        let i2 = fld.fold_ident(Ident::new(x)); // *** 1
                        i2.name
                    }));
            debug!("fold ExprBreak output: %?", ret);
            ret
        }
        ExprAgain(ref opt_ident) => {
            debug!("fold ExprAgain input: %?", opt_ident);
            let ret = ExprAgain(opt_ident.map_move(|x| {
                        let i1 = Ident::new(x);
                        let i2 = fld.fold_ident(i1); // *** 2
                        i2.name
                    }));
            debug!("fold ExprAgain input: %?", ret);
            ret
        }

The first starred case, with ExprBreak, will break. The second starred case, with ExprAgain, will work:

%   x86_64-apple-darwin/stage2/bin/rustc --cfg labelled_break  /tmp/issue-2216.rs
Bus error: 10
%   x86_64-apple-darwin/stage2/bin/rustc --cfg labelled_again  /tmp/issue-2216.rs
warning: no debug symbols in executable (-arch x86_64)
% 

I'm guessing one next step would be to compare the generated code for the two different closures.

[pnkfelix]

cc @jbclements for the injection. cc @nikomatsakis for the potential bogosity in borrowck (right?)

[metajack]

This small program also causes a similar bus error, and @pnkfelix seemed to think it might be related:

fn main() {
    macro_rules! breakme(
        ($value: expr) => {
            break 'foo;
        }
    )

    breakme!("foo");
}

[jbclements]

@pnkfelix does this still occur for you on master? I just failed to duplicated it under OS X using 248765a, and I'm wondering if my fix for #9110 might also have fixed this bug.

[jbclements]

@metajack I can't reproduce your crash on 248765a ... in your case, I'm thinking maybe the next merge was the issue?

[pnkfelix]

@jbclements I'll check about master. Just to confirm, you did use the same set of CONFIGURE_ARGS that I had in the description, right? (Just double-checking.)

[metajack]

I think I am using only --enable-debug in my compiles.

[brson]

I also can't reproduce the problem with either @pnkfelix or @metajack's test cases, though I can reproduce the one in servo.