[Mono-dev] Segfault in JIT - How to fix?

[Rodrigo Kumpera]

On Wed, Jul 13, 2011 at 6:51 AM, Mirko Wischer <Mirko.Wischer at sma.de> wrote:

> Hi all,
>
> I'm running mono 2.10.2 on ARM with soft-float.
> During tests mono segfaults during JIT. After
> some code analysis I think I have an idea what went wrong.
> I wrote a bugreport at
> https://bugzilla.novell.com/show_bug.cgi?id=705186
>
> The following example-code segfaults on ARM with soft-float:
>
> public static void bad_soft_float_decompose(bool doEnter)
> {
>        float f = 1.3f;
>
>        if (doEnter)
>      {
>           Console.WriteLine("This nesting is needed to make mono segfault
> :-)");
>           if (f == 0.0)
>           {
>           }
>      }
>      Console.WriteLine("On ARM with soft-float we never get called because
> JIT has a segfault in decompose.c");
> }
>
>
> The float compare and the empty block will be converted (JIT) to
>
> OP_FCOMPARE XXX
> OP_BXX
>
> After optimization this becomes
>
> OP_FCOMPARE
> OP_NOP
>
> And finally just OP_FCOMPARE as last instruction in bb (verified in gdb)
>
> Now the ARM specific soft-float decompose in mono/mini/decompose.c tries
> to replace OP_FCOMPARE + next instruction with some soft-float ARM code.
> But the next ins pointer is null so line 1588 in decompose.c segfaults.
>
> I think there are two ways of fixing this bug:
> - First checking in soft-float-decompose if ins->next is null and handling
> this case.
> - Second not only NOPing/removing the branch in optimization also NOPing
> the FCOMPARE.
>
> What would be the preferred way of fixing this?
>
>
The code on soft-float decomposition should handle this case.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.ximian.com/pipermail/mono-devel-list/attachments/20110721/12775e62/attachment.html