Binary crashes when statically linked with LTO turned on

[elast0ny]

I tried this code:

[profile.release]
lto = true

use std::process::Command;
fn main() {
    Command::new("ls").spawn();
}

Compiled with :
RUSTFLAGS="-C target-feature=+crt-static" cargo run --release

I expected to see this happen: Spawn & get output of child ls process

Instead, this happened: Program crashes with :

thread panicked while processing panic. aborting.
illegal hardware instruction (core dumped)

Disabling LTO or static linking removes the issue without any code changes.

Meta

rustc --version --verbose:

rustc --version --verbose
rustc 1.59.0 (9d1b2106e 2022-02-23)
binary: rustc
commit-hash: 9d1b2106e23b1abd32fce1f17267604a5102f57a
commit-date: 2022-02-23
host: x86_64-unknown-linux-gnu
release: 1.59.0
LLVM version: 13.0.0

Backtrace

#0  0x000000000043957f in std::panicking::rust_panic_with_hook ()
    at /rustc/9d1b2106e23b1abd32fce1f17267604a5102f57a/library/core/src/ptr/[mod.rs:188](http://mod.rs:188/)
#1  0x0000000000439046 in std::panicking::begin_panic_handler::{closure#0} () at library/std/src/[panicking.rs:500](http://panicking.rs:500/)
#2  0x0000000000438fe6 in std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::{closure#0}, !> () at library/std/src/sys_common/[backtrace.rs:139](http://backtrace.rs:139/)
#3  0x0000000000438fa2 in std::panicking::begin_panic_handler () at library/std/src/[panicking.rs:498](http://panicking.rs:498/)
#4  0x0000000000401230 in core::panicking::panic_fmt () at library/core/src/[panicking.rs:116](http://panicking.rs:116/)
#5  0x00000000004395d4 in std::sys::unix::rwlock::RWLock::read () at library/std/src/sys/unix/[rwlock.rs:49](http://rwlock.rs:49/)
#6  std::sys_common::rwlock::StaticRWLock::read () at library/std/src/sys_common/[rwlock.rs:23](http://rwlock.rs:23/)
#7  std::panicking::rust_panic_with_hook () at library/std/src/[panicking.rs:595](http://panicking.rs:595/)
#8  0x0000000000439046 in std::panicking::begin_panic_handler::{closure#0} () at library/std/src/[panicking.rs:500](http://panicking.rs:500/)
#9  0x0000000000438fe6 in std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::{closure#0}, !> () at library/std/src/sys_common/[backtrace.rs:139](http://backtrace.rs:139/)
#10 0x0000000000438fa2 in std::panicking::begin_panic_handler () at library/std/src/[panicking.rs:498](http://panicking.rs:498/)
#11 0x0000000000401230 in core::panicking::panic_fmt () at library/core/src/[panicking.rs:116](http://panicking.rs:116/)
--Type <RET> for more, q to quit, c to continue without paging--
#12 0x00000000004395d4 in std::sys::unix::rwlock::RWLock::read () at library/std/src/sys/unix/[rwlock.rs:49](http://rwlock.rs:49/)
#13 std::sys_common::rwlock::StaticRWLock::read () at library/std/src/sys_common/[rwlock.rs:23](http://rwlock.rs:23/)
#14 std::panicking::rust_panic_with_hook () at library/std/src/[panicking.rs:595](http://panicking.rs:595/)
#15 0x0000000000439046 in std::panicking::begin_panic_handler::{closure#0} () at library/std/src/[panicking.rs:500](http://panicking.rs:500/)
#16 0x0000000000438fe6 in std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::{closure#0}, !> () at library/std/src/sys_common/[backtrace.rs:139](http://backtrace.rs:139/)
#17 0x0000000000438fa2 in std::panicking::begin_panic_handler () at library/std/src/[panicking.rs:498](http://panicking.rs:498/)
#18 0x0000000000401230 in core::panicking::panic_fmt () at library/core/src/[panicking.rs:116](http://panicking.rs:116/)
#19 0x0000000000436687 in std::sys::unix::rwlock::RWLock::read () at library/std/src/sys/unix/[rwlock.rs:49](http://rwlock.rs:49/)
#20 std::sys_common::rwlock::StaticRWLock::read () at library/std/src/sys_common/[rwlock.rs:23](http://rwlock.rs:23/)
#21 std::sys::unix::os::env_read_lock () at library/std/src/sys/unix/[os.rs:490](http://os.rs:490/)
#22 std::sys::unix::process::process_common::Command::posix_spawn () at library/std/src/sys/unix/process/process_[unix.rs:529](http://unix.rs:529/)
#23 std::sys::unix::process::process_common::Command::spawn () at library/std/src/sys/unix/process/process_[unix.rs:55](http://unix.rs:55/)
#24 std::process::Command::spawn () at library/std/src/[process.rs:868](http://process.rs:868/)
#25 0x000000000043af8c in tester::main ()
--Type <RET> for more, q to quit, c to continue without paging--
#26 0x0000000000439da3 in std::sys_common::backtrace::__rust_begin_short_backtrace ()
#27 0x000000000043a29c in main ()

[bjorn3]

I can reproduce this issue.

[saethlin]

I've kind of been hoping someone else will ask this: Are you sure this is a soundness bug? At a glance, this looks to me like a logic bug in an unfortunate location that double-panics.

[bjorn3]

It shouldn't panic, so I would expect the panic is caused by corruption. Also if it was a double panic there should at least be a panic message for the first panic.

[hkratz]

Reproducable with 1.59.0, 1.60.0-beta.2 and current nightly (c274e49 2022-03-05).

Stacktrace with current nightly:

(lldb) bt
* thread #1, name = 'ltocrash', stop reason = signal SIGABRT
  * frame #0: 0x00007ffff7f1682b ltocrash`gsignal + 203
    frame #1: 0x00007ffff7ecbe1e ltocrash`abort + 299
    frame #2: 0x00007ffff7edf127 ltocrash`std::sys::unix::abort_internal::hcaf26b2b5da2de51 at mod.rs:259:14
    frame #3: 0x00007ffff7f052ae ltocrash`std::panicking::rust_panic_with_hook::hfa6a9afb1a6b2eff at panicking.rs:682:9
    frame #4: 0x00007ffff7f04ebb ltocrash`std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h6b37cfd8e0c1dd8a at panicking.rs:586:13
    frame #5: 0x00007ffff7f04e56 ltocrash`std::sys_common::backtrace::__rust_end_short_backtrace::hc59fb3f99f6cb43f at backtrace.rs:138:18
    frame #6: 0x00007ffff7f04e12 ltocrash`rust_begin_unwind at panicking.rs:584:5
    frame #7: 0x00007ffff7eca392 ltocrash`core::panicking::panic_fmt::h7275fb82410a6b0a at panicking.rs:143:14
    frame #8: 0x00007ffff7f05301 ltocrash`std::panicking::rust_panic_with_hook::hfa6a9afb1a6b2eff [inlined] std::sys::unix::rwlock::RWLock::read::hb91739d041bece46 at rwlock.rs:0
    frame #9: 0x00007ffff7f052b0 ltocrash`std::panicking::rust_panic_with_hook::hfa6a9afb1a6b2eff [inlined] std::sys_common::rwlock::StaticRWLock::read::hb0a5647500e474ee at rwlock.rs:23
    frame #10: 0x00007ffff7f052b0 ltocrash`std::panicking::rust_panic_with_hook::hfa6a9afb1a6b2eff at panicking.rs:687
    frame #11: 0x00007ffff7f04ebb ltocrash`std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h6b37cfd8e0c1dd8a at panicking.rs:586:13
    frame #12: 0x00007ffff7f04e56 ltocrash`std::sys_common::backtrace::__rust_end_short_backtrace::hc59fb3f99f6cb43f at backtrace.rs:138:18
    frame #13: 0x00007ffff7f04e12 ltocrash`rust_begin_unwind at panicking.rs:584:5
    frame #14: 0x00007ffff7eca392 ltocrash`core::panicking::panic_fmt::h7275fb82410a6b0a at panicking.rs:143:14
    frame #15: 0x00007ffff7f05301 ltocrash`std::panicking::rust_panic_with_hook::hfa6a9afb1a6b2eff [inlined] std::sys::unix::rwlock::RWLock::read::hb91739d041bece46 at rwlock.rs:0
    frame #16: 0x00007ffff7f052b0 ltocrash`std::panicking::rust_panic_with_hook::hfa6a9afb1a6b2eff [inlined] std::sys_common::rwlock::StaticRWLock::read::hb0a5647500e474ee at rwlock.rs:23
    frame #17: 0x00007ffff7f052b0 ltocrash`std::panicking::rust_panic_with_hook::hfa6a9afb1a6b2eff at panicking.rs:687
    frame #18: 0x00007ffff7f04ebb ltocrash`std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h6b37cfd8e0c1dd8a at panicking.rs:586:13
    frame #19: 0x00007ffff7f04e56 ltocrash`std::sys_common::backtrace::__rust_end_short_backtrace::hc59fb3f99f6cb43f at backtrace.rs:138:18
    frame #20: 0x00007ffff7f04e12 ltocrash`rust_begin_unwind at panicking.rs:584:5
    frame #21: 0x00007ffff7eca392 ltocrash`core::panicking::panic_fmt::h7275fb82410a6b0a at panicking.rs:143:14
    frame #22: 0x00007ffff7f0258b ltocrash`std::process::Command::spawn::h9eaebc0e504e67be [inlined] std::sys::unix::rwlock::RWLock::read::hb91739d041bece46 at rwlock.rs:49:13
    frame #23: 0x00007ffff7f02528 ltocrash`std::process::Command::spawn::h9eaebc0e504e67be [inlined] std::sys_common::rwlock::StaticRWLock::read::hb0a5647500e474ee at rwlock.rs:23
    frame #24: 0x00007ffff7f02528 ltocrash`std::process::Command::spawn::h9eaebc0e504e67be [inlined] std::sys::unix::os::env_read_lock::hb7ce90cb70e0dd99 at os.rs:487
    frame #25: 0x00007ffff7f02528 ltocrash`std::process::Command::spawn::h9eaebc0e504e67be [inlined] std::sys::unix::process::process_inner::_$LT$impl$u20$std..sys..unix..process..process_common..Command$GT$::posix_spawn::hf188deaf768f5228 at process_unix.rs:526
    frame #26: 0x00007ffff7f02528 ltocrash`std::process::Command::spawn::h9eaebc0e504e67be [inlined] std::sys::unix::process::process_inner::_$LT$impl$u20$std..sys..unix..process..process_common..Command$GT$::spawn::h27d6f54ab4e33566 at process_unix.rs:55
    frame #27: 0x00007ffff7f00af2 ltocrash`std::process::Command::spawn::h9eaebc0e504e67be at process.rs:868
    frame #28: 0x00007ffff7ecd03c ltocrash`ltocrash::main::h1695d9afc4b3cdf2 + 604
    frame #29: 0x00007ffff7ed4543 ltocrash`std::sys_common::backtrace::__rust_begin_short_backtrace::hf29c11af97155265 + 3
    frame #30: 0x00007ffff7ecd730 ltocrash`main + 1296
    frame #31: 0x00007ffff7f095b0 ltocrash`__libc_start_main + 1168
    frame #32: 0x00007ffff7ecc72e ltocrash`_start + 46

[hkratz]

It seems that static RWLocks are not working properly for some reason leading to the double panic, because RWLock are also used in the central panic dispatcher. For the first panic there is no message displayed because the actual panic handler is never called.

Minimum rustc invocation to trigger it: rustc src/main.rs -C opt-level=1 -C lto=thin -C target-feature=+crt-static

It was working with Rust 1.51, regressed in nightly-2021-02-14.

found 7 bors merge commits in the specified range
commit[0] 2021-02-12UTC: Auto merge of #81744 - rylev:overlapping-early-exit2, r=lcnr
commit[1] 2021-02-13UTC: Auto merge of #82045 - Dylan-DPC:rollup-244l0sb, r=Dylan-DPC
commit[2] 2021-02-13UTC: Auto merge of #82053 - JohnTitor:rollup-ymi9q0g, r=JohnTitor
commit[3] 2021-02-13UTC: Auto merge of #81854 - the8472:specialize-clone-slice, r=Mark-Simulacrum
commit[4] 2021-02-13UTC: Auto merge of #81666 - hyd-dev:miri-windows-test-fail, r=Mark-Simulacrum
commit[5] 2021-02-13UTC: Auto merge of #81494 - cuviper:btree-node-init, r=Mark-Simulacrum
commit[6] 2021-02-13UTC: Auto merge of #81238 - RalfJung:copy-intrinsics, r=m-ou-se

[hkratz]

@rustbot label regression-from-stable-to-stable O-linux

[apiraino]

Assigning priority as discussed in the Zulip thread of the Prioritization Working Group.

@rustbot label -I-prioritize +P-critical