Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jitting expression templates yeets a UD2 instruction #17

Open
JPenuchot opened this issue Jan 29, 2020 · 0 comments
Open

Jitting expression templates yeets a UD2 instruction #17

JPenuchot opened this issue Jan 29, 2020 · 0 comments

Comments

@JPenuchot
Copy link

Hi,

I don't really have any way to explain that bug honestly, what happens is that I simply JIT an expression template program to dynamically generate & evaluate expression templates, and the result is an illegal instruction that is triggered by either the JIT compiler or the code it runs.

I don't have enough RAM to even compile clang in debug mode so I can't really do any further investigation, but by debugging the executable it seems like the illegal instruction was purposely called to crash the program as it's a UD2 instruction.

Here's the program if you want to replicate that bug, it only requires Blaze which is a header only library:

#include <iostream>
#include <type_traits>

#include <blaze/Blaze.h>

template<unsigned int I, typename T1, typename T2>
inline auto add( T1 const& e1, T2 const& e2 )
  -> std::enable_if_t < !(I > 0), decltype(e1)> {
  return e1;
}

template<unsigned int I, typename T1, typename T2>
inline auto add( T1 const& e1, T2 const& e2 )
  -> std::enable_if_t < (I > 0), decltype(add<I-1>( e1 + e2, e2 ))> {
  return add<I-1>( e1 + e2, e2 );
}

template<unsigned int I, typename T1, typename T2>
[[clang::jit]]
blaze::DynamicVector<float> eval ( T1 const& e1, T2 const& e2 ) {
  blaze::DynamicVector<float> res = add<I>( e1,e2 );
  return res;
}

int main ()
{
  blaze::DynamicVector<float> a( 10,1.f ), b( 10,1.f );
  for( auto const i : { 1, 2, 3, 4 } )
    std::cout << eval<i>( a, b ) << '\n';
}

The code runs perfectly when I do the same without jitting eval, so the error is clearly related to the jit compiler or generated code execution.

Regards,
Jules

@JPenuchot JPenuchot changed the title Jitting expression templates yeets an illegal instruction Jitting expression templates yeets a UD2 instruction Mar 2, 2020
dutiona pushed a commit to dutiona/llvm-project-cxxjit that referenced this issue Dec 21, 2023
When `Target::GetEntryPointAddress()` calls `exe_module->GetObjectFile()->GetEntryPointAddress()`, and the returned
`entry_addr` is valid, it can immediately be returned.

However, just before that, an `llvm::Error` value has been setup, but in this case it is not consumed before returning, like is done further below in the function.

In https://bugs.freebsd.org/248745 we got a bug report for this, where a very simple test case aborts and dumps core:

```
* thread hfinkel#1, name = 'testcase', stop reason = breakpoint 1.1
    frame #0: 0x00000000002018d4 testcase`main(argc=1, argv=0x00007fffffffea18) at testcase.c:3:5
   1	int main(int argc, char *argv[])
   2	{
-> 3	    return 0;
   4	}
(lldb) p argc
Program aborted due to an unhandled Error:
Error value was Success. (Note: Success values must still be checked prior to being destroyed).

Thread 1 received signal SIGABRT, Aborted.
thr_kill () at thr_kill.S:3
3	thr_kill.S: No such file or directory.
(gdb) bt
#0  thr_kill () at thr_kill.S:3
hfinkel#1  0x00000008049a0004 in __raise (s=6) at /usr/src/lib/libc/gen/raise.c:52
hfinkel#2  0x0000000804916229 in abort () at /usr/src/lib/libc/stdlib/abort.c:67
hfinkel#3  0x000000000451b5f5 in fatalUncheckedError () at /usr/src/contrib/llvm-project/llvm/lib/Support/Error.cpp:112
hfinkel#4  0x00000000019cf008 in GetEntryPointAddress () at /usr/src/contrib/llvm-project/llvm/include/llvm/Support/Error.h:267
hfinkel#5  0x0000000001bccbd8 in ConstructorSetup () at /usr/src/contrib/llvm-project/lldb/source/Target/ThreadPlanCallFunction.cpp:67
hfinkel#6  0x0000000001bcd2c0 in ThreadPlanCallFunction () at /usr/src/contrib/llvm-project/lldb/source/Target/ThreadPlanCallFunction.cpp:114
hfinkel#7  0x00000000020076d4 in InferiorCallMmap () at /usr/src/contrib/llvm-project/lldb/source/Plugins/Process/Utility/InferiorCallPOSIX.cpp:97
hfinkel#8  0x0000000001f4be33 in DoAllocateMemory () at /usr/src/contrib/llvm-project/lldb/source/Plugins/Process/FreeBSD/ProcessFreeBSD.cpp:604
hfinkel#9  0x0000000001fe51b9 in AllocatePage () at /usr/src/contrib/llvm-project/lldb/source/Target/Memory.cpp:347
hfinkel#10 0x0000000001fe5385 in AllocateMemory () at /usr/src/contrib/llvm-project/lldb/source/Target/Memory.cpp:383
hfinkel#11 0x0000000001974da2 in AllocateMemory () at /usr/src/contrib/llvm-project/lldb/source/Target/Process.cpp:2301
hfinkel#12 CanJIT () at /usr/src/contrib/llvm-project/lldb/source/Target/Process.cpp:2331
hfinkel#13 0x0000000001a1bf3d in Evaluate () at /usr/src/contrib/llvm-project/lldb/source/Expression/UserExpression.cpp:190
hfinkel#14 0x00000000019ce7a2 in EvaluateExpression () at /usr/src/contrib/llvm-project/lldb/source/Target/Target.cpp:2372
hfinkel#15 0x0000000001ad784c in EvaluateExpression () at /usr/src/contrib/llvm-project/lldb/source/Commands/CommandObjectExpression.cpp:414
hfinkel#16 0x0000000001ad86ae in DoExecute () at /usr/src/contrib/llvm-project/lldb/source/Commands/CommandObjectExpression.cpp:646
hfinkel#17 0x0000000001a5e3ed in Execute () at /usr/src/contrib/llvm-project/lldb/source/Interpreter/CommandObject.cpp:1003
hfinkel#18 0x0000000001a6c4a3 in HandleCommand () at /usr/src/contrib/llvm-project/lldb/source/Interpreter/CommandInterpreter.cpp:1762
hfinkel#19 0x0000000001a6f98c in IOHandlerInputComplete () at /usr/src/contrib/llvm-project/lldb/source/Interpreter/CommandInterpreter.cpp:2760
hfinkel#20 0x0000000001a90b08 in Run () at /usr/src/contrib/llvm-project/lldb/source/Core/IOHandler.cpp:548
hfinkel#21 0x00000000019a6c6a in ExecuteIOHandlers () at /usr/src/contrib/llvm-project/lldb/source/Core/Debugger.cpp:903
hfinkel#22 0x0000000001a70337 in RunCommandInterpreter () at /usr/src/contrib/llvm-project/lldb/source/Interpreter/CommandInterpreter.cpp:2946
hfinkel#23 0x0000000001d9d812 in RunCommandInterpreter () at /usr/src/contrib/llvm-project/lldb/source/API/SBDebugger.cpp:1169
hfinkel#24 0x0000000001918be8 in MainLoop () at /usr/src/contrib/llvm-project/lldb/tools/driver/Driver.cpp:675
hfinkel#25 0x000000000191a114 in main () at /usr/src/contrib/llvm-project/lldb/tools/driver/Driver.cpp:890```

Fix the incorrect error catch by only instantiating an `Error` object if it is necessary.

Reviewed By: JDevlieghere

Differential Revision: https://reviews.llvm.org/D86355

(cherry picked from commit 1ce07cd)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant