Bug 179618 - 3.4.0 | ptrcheck crashed / exit prematurely
Summary: 3.4.0 | ptrcheck crashed / exit prematurely
Status: RESOLVED FIXED
Alias: None
Product: valgrind
Classification: Developer tools
Component: general (show other bugs)
Version: 3.4 SVN
Platform: Compiled Sources Linux
: NOR crash
Target Milestone: ---
Assignee: Julian Seward
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-01-04 15:04 UTC by Mor
Modified: 2009-02-24 15:28 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mor 2009-01-04 15:04:24 UTC
prematurely 
exp-ptrcheck: the 'impossible' happened:
   unhandled syscall
==3258==    at 0x3800E3CA: report_and_quit (m_libcassert.c:140)
==3258==    by 0x3800E59D: panic (m_libcassert.c:215)
==3258==    by 0x3800E5F6: vgPlain_tool_panic (m_libcassert.c:230)
==3258==    by 0x38003C28: h_post_syscall (h_main.c:2449)
==3258==    by 0x3802F760: vgPlain_post_syscall (syswrap-main.c:1178)
==3258==    by 0x3802F27E: vgPlain_client_syscall (syswrap-main.c:1090)
==3258==    by 0x3802DA39: handle_syscall (scheduler.c:824)
==3258==    by 0x3802DEF0: vgPlain_scheduler (scheduler.c:1018)
==3258==    by 0x38030544: thread_wrapper (syswrap-linux.c:89)
==3258==    by 0x38030621: run_a_thread_NORETURN (syswrap-linux.c:122)
==3258==    by 0xFFFFFFFF: ???

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==3258==    at 0x5C96A8A: chown@@GLIBC_2.1 (in /lib/tls/libc-2.3.2.so)
Comment 1 Julian Seward 2009-01-04 15:33:25 UTC
What is the output of this
      VG_(printf)("sysno == %u\n", sysno);
(h_main.c:2444) 
which should have been printed just before the "impossible happened"
line?

Also, what platform?  x86-linux, amd64-linux, or some other?

Comment 2 Michael Abshoff 2009-01-05 01:22:12 UTC
I have seen a similar crash on an x86-64 Linux box running

mabshoff@sage:~/build/linbox-testing/linbox-svn3066/tests/foo$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 8.04.1
Release:	8.04
Codename:	hardy

This might or might not be the same failure, but it looks close. The unhanded syscall in this case seems to be getrusage.

I am running parts of the test suite (test-gmp-rational) of LinBox (http://linalg.org/) using the 3.4.0 release build from sources. The failure in detail:

mabshoff@sage:~/build/linbox-testing/linbox-svn3066/tests/foo$ ~/build/eMPIRe/sage-3.2.3.final/local/bin/valgrind --tool=exp-ptrcheck  ./test-gmp-rational 
==29373== exp-ptrcheck, a heap, stack & global array overrun detector.
==29373== NOTE: This is an Experimental-Class Valgrind Tool.
==29373== Copyright (C) 2003-2008, and GNU GPL'd, by OpenWorks Ltd et al.
==29373== Using LibVEX rev 1878, a library for dynamic binary translation.
==29373== Copyright (C) 2004-2008, and GNU GPL'd, by OpenWorks LLP.
==29373== Using valgrind-3.4.0, a dynamic binary instrumentation framework.
==29373== Copyright (C) 2000-2008, and GNU GPL'd, by Julian Seward et al.
==29373== For more details, rerun with: -v
==29373== 
sysno == 98

exp-ptrcheck: the 'impossible' happened:
   unhandled syscall
==29373==    at 0x3801069C: report_and_quit (m_libcassert.c:140)
==29373==    by 0x380107B4: panic (m_libcassert.c:215)
==29373==    by 0x380107F9: vgPlain_tool_panic (m_libcassert.c:230)
==29373==    by 0x3800368D: h_post_syscall (h_main.c:2449)
==29373==    by 0x38035A82: vgPlain_post_syscall (syswrap-main.c:1178)
==29373==    by 0x38036471: vgPlain_client_syscall (syswrap-main.c:1090)
==29373==    by 0x38033802: handle_syscall (scheduler.c:824)
==29373==    by 0x3803483E: vgPlain_scheduler (scheduler.c:1018)
==29373==    by 0x380461F3: run_a_thread_NORETURN (syswrap-linux.c:89)
==29373==    by 0xFFFFFFFFFFFFFFFF: ???
==29373==    by 0xDEADBEEFDEADBEEE: ???
==29373==    by 0x38094474: unsafeIRDirty_0_N (irdefs.c:2711)
==29373==    by 0x385A86B0: ???
==29373==    by 0x402001150: ???
==29373==    by 0x2: ???
==29373==    by 0x383FB808: ???
==29373==    by 0x402001150: ???
==29373==    by 0x2: ???
==29373==    by 0x385A9898: ???
==29373==    by 0x1: ???
==29373==    by 0x403BFB980: ???
==29373==    by 0x385A99D8: ???
==29373==    by 0x385A9538: ???
==29373==    by 0x3813D446: ado_treebuild_BB (iropt.c:4158)
==29373==    by 0x1385A8B38: ???
==29373==    by 0x403BFBB68: ???
==29373==    by 0x402001150: ???
==29373==    by 0x3FFFE8: ???
==29373==    by 0x403BFBA80: ???
==29373==    by 0x403BFBA81: ???
==29373==    by 0x403BFB998: ???
==29373==    by 0x380924C3: typeOfIRExpr (irdefs.c:1933)
==29373==    by 0x5000000250000000: ???
==29373==    by 0x381421AE: (within /home/mabshoff/build/eMPIRe/sage-3.2.3.final/local/lib/valgrind/amd64-linux/exp-ptrcheck)
==29373==    by 0x11: ???
==29373==    by 0x3807C040: myvprintf_str (m_debuglog.c:467)
==29373==    by 0x2: ???
==29373==    by 0x7C23B: ???
==29373==    by 0x8000000400000011: ???

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==29373==    at 0x6B7DE17: getrusage (in /lib/libc-2.7.so)
==29373==    by 0x409224: LinBox::UserTimer::start() (timer.C:100)
==29373==    by 0x409A09: LinBox::Timer::start() (timer.C:147)
==29373==    by 0x409B98: LinBox::Commentator::start(char const*, char const*, unsigned long) (commentator.C:135)
==29373==    by 0x409D0F: main (test-gmp-rational.C:41)


Note: see also the FAQ.txt in the source distribution.
It contains workarounds to several common problems.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what Linux distro you are using.  Thanks.
[end quote]

Cheers,

Michael
Comment 3 Michael Abshoff 2009-01-05 01:36:42 UTC
Mmmh, looking at the orginal report: The original problem seems to be with the chown syscall. The following on the same box as the above illustrates the problem:

mabshoff@sage:~/build/linbox-testing/linbox-svn3066/tests/foo$ ~/build/eMPIRe/sage-3.2.3.final/local/bin/valgrind --tool=exp-ptrcheck  chown mabshoff:mabshoff TODO 
==2132== exp-ptrcheck, a heap, stack & global array overrun detector.
==2132== NOTE: This is an Experimental-Class Valgrind Tool.
==2132== Copyright (C) 2003-2008, and GNU GPL'd, by OpenWorks Ltd et al.
==2132== Using LibVEX rev 1878, a library for dynamic binary translation.
==2132== Copyright (C) 2004-2008, and GNU GPL'd, by OpenWorks LLP.
==2132== Using valgrind-3.4.0, a dynamic binary instrumentation framework.
==2132== Copyright (C) 2000-2008, and GNU GPL'd, by Julian Seward et al.
==2132== For more details, rerun with: -v
==2132== 
sysno == 262

exp-ptrcheck: the 'impossible' happened:
   unhandled syscall
==2132==    at 0x3801069C: report_and_quit (m_libcassert.c:140)
==2132==    by 0x380107B4: panic (m_libcassert.c:215)
==2132==    by 0x380107F9: vgPlain_tool_panic (m_libcassert.c:230)
==2132==    by 0x3800368D: h_post_syscall (h_main.c:2449)
==2132==    by 0x38035A82: vgPlain_post_syscall (syswrap-main.c:1178)
==2132==    by 0x38036471: vgPlain_client_syscall (syswrap-main.c:1090)
==2132==    by 0x38033802: handle_syscall (scheduler.c:824)
==2132==    by 0x3803483E: vgPlain_scheduler (scheduler.c:1018)
==2132==    by 0x380461F3: run_a_thread_NORETURN (syswrap-linux.c:89)
==2132==    by 0xFFFFFFFFFFFFFFFF: ???
==2132==    by 0xDEADBEEFDEADBEEE: ???
==2132==    by 0x51000017: ???
==2132==    by 0x385AB948: ???
==2132==    by 0x385AB4B0: ???
==2132==    by 0x403ADB980: ???
==2132==    by 0x385AB4E0: ???
==2132==    by 0x403ADBA70: ???
==2132==    by 0x3813AEF4: atbSubst_Expr (iropt.c:3884)
==2132==    by 0x385AB3B0: ???
==2132==    by 0x1: ???
==2132==    by 0x403ADB980: ???
==2132==    by 0x385AB8D8: ???
==2132==    by 0x385AAF48: ???
==2132==    by 0x380B14DD: addInstr (isel.c:174)
==2132==    by 0x11004: ???
==2132==    by 0x380B199A: iselIntExpr_R (isel.c:1679)
==2132==    by 0x40201B9F8: ???
==2132==    by 0x385ABAD8: ???
==2132==    by 0x403ADBA80: ???
==2132==    by 0x403ADBA81: ???
==2132==    by 0x403ADB998: ???
==2132==    by 0x380924C3: typeOfIRExpr (irdefs.c:1933)
==2132==    by 0x5000000250000000: ???
==2132==    by 0x381421AE: (within /home/mabshoff/build/eMPIRe/sage-3.2.3.final/local/lib/valgrind/amd64-linux/exp-ptrcheck)
==2132==    by 0x11: ???
==2132==    by 0x3807C040: myvprintf_str (m_debuglog.c:467)
==2132==    by 0x3: ???
==2132==    by 0x7C23B: ???
==2132==    by 0x8000000400000011: ???

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==2132==    at 0x4EEDD6E: __fxstatat (in /lib/libc-2.7.so)
==2132==    by 0x403361: (within /bin/chown)
==2132==    by 0x40396A: fts_open (in /bin/chown)
==2132==    by 0x407503: (within /bin/chown)
==2132==    by 0x40225E: (within /bin/chown)
==2132==    by 0x40201D: (within /bin/chown)
==2132==    by 0x4E431C3: (below main) (in /lib/libc-2.7.so)


Note: see also the FAQ.txt in the source distribution.
It contains workarounds to several common problems.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what Linux distro you are using.  Thanks.
[end quote]

Cheers,

Michael
Comment 4 Michael Abshoff 2009-01-05 03:48:44 UTC
Ok, I hit another one on linux-amd64:

sysno == 186

exp-ptrcheck: the 'impossible' happened:
   unhandled syscall
==15965==    at 0x380106BC: report_and_quit (m_libcassert.c:140)
==15965==    by 0x380107D4: panic (m_libcassert.c:215)
==15965==    by 0x38010819: vgPlain_tool_panic (m_libcassert.c:230)
==15965==    by 0x380036AD: h_post_syscall (h_main.c:2450)
==15965==    by 0x38035AA2: vgPlain_post_syscall (syswrap-main.c:1178)
==15965==    by 0x38036491: vgPlain_client_syscall (syswrap-main.c:1090)
==15965==    by 0x38033822: handle_syscall (scheduler.c:824)
==15965==    by 0x3803485E: vgPlain_scheduler (scheduler.c:1018)
==15965==    by 0x38046213: run_a_thread_NORETURN (syswrap-linux.c:89)
==15965==    by 0xFFFFFFFFFFFFFFFF: ???
==15965==    by 0xDEADBEEFDEADBEEE: ???
==15965==    by 0x51000038: ???
==15965==    by 0x385B0F30: ???
==15965==    by 0x402001150: ???
==15965==    by 0x2: ???
==15965==    by 0x383FB828: ???
==15965==    by 0x402001150: ???
==15965==    by 0x2: ???
==15965==    by 0x385A98B8: ???
==15965==    by 0x1: ???
==15965==    by 0x403BFB980: ???
==15965==    by 0x385A99F8: ???
==15965==    by 0x385A9558: ???
==15965==    by 0x3813D466: ado_treebuild_BB (iropt.c:4158)
==15965==    by 0x1385A8B58: ???
==15965==    by 0x403BFBB68: ???
==15965==    by 0x402001150: ???
==15965==    by 0x3FFFE8: ???
==15965==    by 0x403BFBA80: ???
==15965==    by 0x403BFBA81: ???
==15965==    by 0x403BFB998: ???
==15965==    by 0x380924E3: typeOfIRExpr (irdefs.c:1933)
==15965==    by 0x5000000250000000: ???
==15965==    by 0x381421CE: (within /home/mabshoff/build/eMPIRe/sage-3.2.3.final/local/lib/valgrind/amd64-linux/exp-ptrcheck)
==15965==    by 0x11: ???
==15965==    by 0x3807C060: myvprintf_str (m_debuglog.c:467)
==15965==    by 0x3: ???
==15965==    by 0x7C25B: ???
==15965==    by 0x8000000400000011: ???

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==15965==    at 0x6AE007B: raise (in /lib/libc-2.7.so)
==15965==    by 0x6AE1AEF: abort (in /lib/libc-2.7.so)
==15965==    by 0x63DA0E3: __gnu_cxx::__verbose_terminate_handler() (in /usr/lib/libstdc++.so.6.0.9)
==15965==    by 0x63D8075: (within /usr/lib/libstdc++.so.6.0.9)
==15965==    by 0x63D80A2: std::terminate() (in /usr/lib/libstdc++.so.6.0.9)
==15965==    by 0x63D8189: __cxa_throw (in /usr/lib/libstdc++.so.6.0.9)
==15965==    by 0x415206: LinBox::MatrixStream<LinBox::UnparametricField<Integer> >::MatrixStream(LinBox::UnparametricField<Integer> const&, std::istream&) (matrix-stream.inl:183)
==15965==    by 0x40B4F4: testMatrixStream(std::string const&) (test-matrix-stream.C:57)
==15965==    by 0x40C3E3: main (test-matrix-stream.C:247)

Cheers,

Michael
Comment 5 Mor 2009-01-05 09:19:23 UTC
Hi,
sorry for the delay with the feedback, in order to reduce spam I do not use my main email account.

anyway, the syscall number is:
sysno == 212
and the platform is linux-x86

this might be helpful (from the log):
--3258-- Contents of /proc/version:
--3258--   Linux version 2.6.18-92 (builder@valley) (gcc version 4.1.1 20061011 (Red Hat 4.1.1-30)) #1 SMP Tue Dec 30 08:57:06 IST 2008
--3258-- Arch and hwcaps: X86, x86-sse1-sse2
--3258-- Page sizes: currently 4096, max supported 4096
Comment 6 Tom Truscott 2009-01-16 17:47:11 UTC
A couple more crashes of this type:

amd64 sysno 131 (sigaltstack)
amd64 sysno 53 (socketpair)

Adding them to the table worked (I had to ifdef the one for socketpair)


Comment 7 Julian Seward 2009-01-24 11:53:59 UTC
I committed fixes for all syscalls reported missing in this
bug report, in r9056 (on the trunk).  Also, recently on the
trunk have been committed a number of fixes for the debug info
reader, and these fixes are important for Ptrcheck.  So it would
be good if you could check out and try the trunk.
Comment 8 Julian Seward 2009-02-24 15:28:03 UTC
Fixed in 3.4.1.