[Bug 246630] stable/11 regression: base.txz reproducibility depends on number of cpu cores

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=246630

--- Comment #16 from Dimitry Andric <dim at FreeBSD.org> ---
Okay, I can reproduce, and it appears to be something in
usr.bin/printf/printf.c, which gets built as part of sh. In particular, in the
printf_doformat function.

One version gives:

0000000000000440 <printf_doformat>:
     440:       55                      push   %rbp
     441:       48 89 e5                mov    %rsp,%rbp
     444:       41 57                   push   %r15
     446:       41 56                   push   %r14
     448:       41 55                   push   %r13
     44a:       41 54                   push   %r12
     44c:       53                      push   %rbx
     44d:       48 81 ec e8 00 00 00    sub    $0xe8,%rsp
     454:       49 89 f4                mov    %rsi,%r12
     457:       48 89 fb                mov    %rdi,%rbx
     45a:       48 8b 05 00 00 00 00    mov    0x0(%rip),%rax        # 461
<printf_doformat+0x21>
     461:       48 89 45 d0             mov    %rax,-0x30(%rbp)
     465:       e8 00 00 00 00          callq  46a <printf_doformat+0x2a>

another:

0000000000000440 <printf_doformat>:
     440:       55                      push   %rbp
     441:       48 89 e5                mov    %rsp,%rbp
     444:       41 57                   push   %r15
     446:       41 56                   push   %r14
     448:       41 55                   push   %r13
     44a:       41 54                   push   %r12
     44c:       53                      push   %rbx
     44d:       48 81 ec e8 00 00 00    sub    $0xe8,%rsp
     454:       49 89 f5                mov    %rsi,%r13
     457:       48 89 fb                mov    %rdi,%rbx
     45a:       48 8b 05 00 00 00 00    mov    0x0(%rip),%rax        # 461
<printf_doformat+0x21>
     461:       48 89 45 d0             mov    %rax,-0x30(%rbp)
     465:       e8 00 00 00 00          callq  46a <printf_doformat+0x2a>

The C function starts with:

static char *
printf_doformat(char *fmt, int *rval)
{
        static const char skip1[] = "#'-+ 0";
        int fieldwidth, haveprec, havewidth, mod_ldbl, precision;
        char convch, nextch;
        char start[strlen(fmt) + 1];
        char **fargv;
        char *dptr;
        int l;

and the starting piece of code corresponds to the dynamic array declaration,
char start[strlen(fmt) + 1].

As to why this is happening, no clue yet... I'm trying to build clang with
UBSan, to see if it hits something in particular.

-- 
You are receiving this mail because:
You are the assignee for the bug.