[GHC] #9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow)
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Keywords: | Operating System: Architecture: Unknown/Multiple | Unknown/Multiple Difficulty: Easy (less than 1 | Type of failure: hour) | None/Unknown Blocked By: | Test Case: Related Tickets: | Blocking: | Differential Revisions: -------------------------------------+------------------------------------- Found by ./validate: '''testsuite/tests/rts/overflow1.hs''' SIGSEGVs due to integer overflow somewhere around [https://git.haskell.org/ghc.git/blob/c88559b3304cc5e142ab9c2655d48e570f81afe... shouldInlinePrimOp] {{{#!hs ... shouldInlinePrimOp dflags NewByteArrayOp_Char [(CmmLit (CmmInt n _))] | fromInteger n <= maxInlineAllocSize dflags = ... }}} '''maxInlineAllocSize''' has ''':: Int''' type: {{{#!hs fromInteger (2^64 - 10) < (128 :: Int) True }}} -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: | -------------------------------------+------------------------------------- Changes (by slyfox): * owner: => tibbe -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:1> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: | -------------------------------------+------------------------------------- Comment (by tibbe): I'm working on it. Turns out that trying to fix this exposes all of ours sins i.e. all the places where we use `Int` where we should have used `Word`, for example in `wordsToBytes` and perhaps `ByteOff`. -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:2> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: | -------------------------------------+------------------------------------- Comment (by tibbe): It looks like the overflow isn't in `shouldInlinePrimOp` (although that function should be fixed too) but in the code that create the `CmmInt` literal. Adding this tracing {{{ shouldInlinePrimOp dflags NewByteArrayOp_Char [(CmmLit (CmmInt n _))] | n <= fromIntegral (maxInlineAllocSize dflags) = trace ("matches " ++ show n) $ }}} shows that `n` is -40, even thought it's an Integer, suggesting that the wrap-around happened elsewhere. -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:3> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: | -------------------------------------+------------------------------------- Comment (by tibbe): The core confirms my suspicions: {{{ case GHC.Prim.newByteArray# @ GHC.Prim.RealWorld (-40) s1_a1Cc }}} The only workaround I can think of is quite unpleasant. We need to cast the `Integer` in the `CmmInt` to a `Word`(and then perhaps back to an `Integer`) to get rid of the 2-complement interpretation of the value. The real fix is to change `newByteArray#` to take the size as a `Word#`. I don't see how the overflow1 test ever passed. -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:4> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: | -------------------------------------+------------------------------------- Comment (by tibbe): If we disable `shouldInlinePrimOp` altogether we get this Cmm: {{{ R1 = (-40); Sp = Sp - 8; call stg_newByteArray#(R1) returns to c3Nu, args: 8, res: 8, upd: 8; }}} Presumably `stg_newByteArrayzh` interprets its argument as an unsigned quantity and thus the test passes without `shouldInlinePrimOp`. -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:5> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: patch Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: D128 | -------------------------------------+------------------------------------- Changes (by tibbe): * status: new => patch * differential: => D128 -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:6> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: patch Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: D128 | -------------------------------------+------------------------------------- Comment (by carter): is the Int/word issue related to https://ghc.haskell.org/trac/ghc/ticket/8299 ? (ie because we don't have the richer distinction between how we use ints and words for address manipulation?) -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:7> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: patch Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: D128 | -------------------------------------+------------------------------------- Comment (by Johan Tibell <johan.tibell@…>): In [changeset:"6f862dfae20afdcd671133f3534b1bf5c25bbd9b/ghc"]: {{{ #!CommitTicketReference repository="ghc" revision="6f862dfae20afdcd671133f3534b1bf5c25bbd9b" shouldInlinePrimOp: Fix Int overflow There were two overflow issues in shouldInlinePrimOp. The first one is due to a negative CmmInt literal being created if the array size was given as larger than 2^63-1 (on a 64-bit platform.) This meant that large array sizes could compare as being smaller than maxInlineAllocSize. The second issue is that we casted the Integer to an Int in the comparison, which again meant that large array sizes could compare as being smaller than maxInlineAllocSize. The attempt to allocate a large array inline then caused a segfault. Fixes #9416. }}} -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:8> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
#9416: newArray# incorrectly inlines big arrays (overflow1.hs SIGSEGVS on ./validate --slow) -------------------------------------+------------------------------------- Reporter: slyfox | Owner: tibbe Type: bug | Status: closed Priority: normal | Milestone: Component: Compiler | Version: 7.8.3 Resolution: fixed | Keywords: Operating System: | Architecture: Unknown/Multiple Unknown/Multiple | Difficulty: Easy (less than 1 Type of failure: | hour) None/Unknown | Blocked By: Test Case: | Related Tickets: Blocking: | Differential Revisions: D128 | -------------------------------------+------------------------------------- Changes (by tibbe): * status: patch => closed * resolution: => fixed -- Ticket URL: <http://ghc.haskell.org/trac/ghc/ticket/9416#comment:9> GHC <http://www.haskell.org/ghc/> The Glasgow Haskell Compiler
participants (1)
-
GHC