clang/llvm 3.9.0 mysteriously zeroing variables?
Jakub Palider
jpa at semihalf.com
Tue Dec 20 10:55:29 UTC 2016
Hi,
do you still observe this behaviour? Which type of EC2 instances were
affected?
I tried to reproduce with kernel/tools from Dec 15 and did not manage to
crash the machine.
Jakub
On Sun, Dec 4, 2016 at 5:38 PM, Dimitry Andric <dim at freebsd.org> wrote:
> On 04 Dec 2016, at 10:52, Hans Petter Selasky <hps at selasky.org> wrote:
> >
> > On 12/04/16 01:04, Colin Percival wrote:
> >> Starting with r309124 (when clang/llvm 3.9.0 was imported) I'm seeing
> EC2
> >> instances panic on boot with a division-by-zero error; the code in
> question
> >> is in blkfront.c, printing out the size of disks:
> >>
> >>> device_printf(dev, "%juMB <%s> at %s",
> >>> (uintmax_t) sectors / (1048576 / sector_size),
> >>> device_get_desc(dev),
> >>> xenbus_get_node(dev));
> >>
> >> My first thought was that 'sector_size' must be either zero or very
> large...
> >> but no, when I add printf("sector_size = %ju\n",
> (uintmax_t)sector_size), it's
> >> entirely normal. What's more, adding that printf makes the
> division-by-zero
> >> panic go away.
> >>
> >> I'd think I was just hallucinating, but earlier today I heard that a
> similarly
> >> "impossible" panic had been observed in the NFS client code when
> compiled with
> >> clang/llvm 3.9.0.
> >>
> >> So... is anyone else seeing unexpected panics or other odd behaviour
> starting
> >> after clang/llvm 3.9.0 was imported?
> >>
> >
> > Hi,
> >
> > Can you look at the code with "objdump -Dx --source" and see what is
> going on there? Might it be the "sector" variable is shadowed?
>
> I don't see anything in the generated code for the call that can cause
> this, except for sector_size really being zero, or the result of
> 1048576/sector_size being zero.
>
> On i386, you get this:
>
> .loc 1 1349 19 # /usr/src/sys/dev/xen/blkfront/
> blkfront.c:1349:19
> movl -56(%ebp), %ecx # -56(%rbp) = sectors
> .Ltmp1148:
> #DEBUG_VALUE: xbd_connect:sectors <- %ECX
> .loc 1 1349 38 is_stmt 0 # /usr/src/sys/dev/xen/blkfront/
> blkfront.c:1349:38
> movl $1048576, %eax # imm = 0x100000
> xorl %edx, %edx
> divl -52(%ebp) # -52(%ebp) = sector_size
> movl %eax, %edi
> .loc 1 1349 27 # /usr/src/sys/dev/xen/blkfront/
> blkfront.c:1349:27
> xorl %edx, %edx
> movl %ecx, %eax
> divl %edi
> movl %eax, -32(%ebp) # 4-byte Spill
>
> On amd64, it looks pretty similar:
>
> .loc 1 1349 19 # /usr/src/sys/dev/xen/blkfront/
> blkfront.c:1349:19
> movq -112(%rbp), %rcx # -112(%rbp) = sectors
> .Ltmp1128:
> #DEBUG_VALUE: xbd_connect:sectors <- %RCX
> .loc 1 1349 38 is_stmt 0 # /usr/src/sys/dev/xen/blkfront/
> blkfront.c:1349:38
> movl $1048576, %eax # imm = 0x100000
> xorl %edx, %edx
> divq -88(%rbp) # -88(%rbp) = sector_size
> movq %rax, %rsi
> .loc 1 1349 27 # /usr/src/sys/dev/xen/blkfront/
> blkfront.c:1349:27
> xorl %edx, %edx
> movq %rcx, %rax
> divq %rsi
> movq %rax, %r15
>
> Colin, does it panic for you in the first or the second div?
>
> -Dimitry
>
>
More information about the freebsd-current
mailing list