Bug 507173

Summary: s390x: crash when constant folding is disabled
Product: [Developer tools] valgrind Reporter: Florian Krohm <flo2030>
Component: generalAssignee: Julian Seward <jseward>
Status: RESOLVED FIXED    
Severity: crash    
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description Florian Krohm 2025-07-17 22:13:24 UTC
Apply patch below. Then ./vg-in-place date
--->
==2946671==    by 0x800157009: vpanic (main_util.c:253)
==2946671==    by 0x800205E03: lookupHRegRemap (host_generic_regs.c:309)
==2946671==    by 0x8001ED1D7: s390_insn_map_regs (host_s390_defs.c:1138)
==2946671==    by 0x8001ED1D7: mapRegs_S390Instr (host_s390_defs.c:532)
==2946671==    by 0x8001DA3EB: doRegisterAllocation_v3 (host_generic_reg_alloc3.c:1320)
==2946671==    by 0x80015504D: libvex_BackEnd (main_main.c:1185)
==2946671==    by 0x80015504D: LibVEX_Translate (main_main.c:1288)
==2946671==    by 0x80005EAD7: vgPlain_translate (m_translate.c:1835)
==2946671==    by 0x8000A33A7: handle_tt_miss (scheduler.c:1144)
==2946671==    by 0x8000A33A7: vgPlain_scheduler (scheduler.c:1557)
==2946671==    by 0x80010A0D9: thread_wrapper (syswrap-linux.c:102)
==2946671==    by 0x80010A0D9: run_a_thread_NORETURN (syswrap-linux.c:155)

This is a symptom of a bug elsewhere... Seems specific to s390x. 
I regtested with the memcheck bucket: ppc is OK; x86-64 has a few additional memcheck complaints
but no crash.

I ran into this in the context of BZ 506211 when I want to check that the result computed by
constant folding is identical to the result when constants are not folded. To do that I need to
disable constant folding.

diff --git a/VEX/priv/ir_opt.c b/VEX/priv/ir_opt.c
index ebea8ba0e..c9a823d01 100644
--- a/VEX/priv/ir_opt.c
+++ b/VEX/priv/ir_opt.c
@@ -1464,7 +1464,7 @@ static IRExpr* fold_Expr_WRK ( IRExpr** env, IRExpr* e )
 {
    Int     shift;
    IRExpr* e2 = e; /* e2 is the result of folding e, if possible */
-
+   return e2;
    switch (e->tag) {
    case Iex_Unop:
       /* UNARY ops */
Comment 1 Florian Krohm 2025-07-20 10:07:58 UTC
Fixed in 1c9d639ecedbb

Here's the fallout of make regtest with folding disabled (other than the iropt-test bucket which requires folding):
- s390x:  one false positive for memcheck/tests/s390x/cli.c
- ppc: no fallout
- amd64: additional complaints for:
  - memcheck/tests/amd64/shr_edx
  - memcheck/tests/amd64/xor-undef-amd64
  - memcheck/tests/bug287260   
  - memcheck/tests/vbit-test/vbit-test  

The patch is good enough for the experiment I plan to do. So I won't be investigating
the fallout.