| Summary: | media-libs/libpng-1.2.19 causes frequent segfaults on amd64 due to mmx code | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | James Brown <Roguelazer> |
| Component: | [OLD] Library | Assignee: | Gentoo's Team for Core System packages <base-system> |
| Status: | RESOLVED FIXED | ||
| Severity: | critical | CC: | amd64, angelos, gentoo-bugzilla, martijn.berger, mbartoszkiewicz, plaes |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | AMD64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
Backtrace of first segfault
Backtrace of second segfault Backtrace of segfault with -Os -falign-functions Backtrace of segfault with -O0 |
||
|
Description
James Brown
2007-08-19 13:39:16 UTC
Created attachment 128587 [details]
Backtrace of first segfault
Created attachment 128588 [details]
Backtrace of second segfault
Err... Ignore the LDFLAGS="-Wl,-O1" part... For a second, I thought it was an LDFLAGS-induced problem, but it didn't turn out to be. so rebuild it with simple CFLAGS: -O0 -pipe Okay, more information: CFLAGS="-O0 -pipe" also does not work. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 47484115313040 (LWP 31697)] 0x00002b2fc00981fa in H�U�H�M�L�E�H�}� () from /usr/lib/libpng12.so.0 (gdb) bt #0 0x00002b2fc00981fa in H�U�H�M�L�E�H�}� () from /usr/lib/libpng12.so.0 Cannot access memory at address 0x11 Is this something to do with the NX bit on amd64 processors? That's just a stab in the dark, of course, but there is definitely something weird going on with memory access... I've tried several combinations of CFLAGS now, some seem to work, some don't, however this are the CFLAGS that do work (add -march=native -pipe everywhere): -O3 -O2 -O1 -O0 -fomit-frame-pointer -Os -falign-functions whereas the following do not work: -O0 -Os -Os -fomit-frame-pointer uhm, small correction, -Os -fomit-frame-pointer seems to work now, even though I'm pretty sure it didn't work on my first attempt - may be my broken brain though Created attachment 128698 [details]
Backtrace of segfault with -Os -falign-functions
The -Os -falign-functions version did not work for me. Nor did -Os with all of the -fblah flags that the gcc manpage said -Os removed from -O2. Which is sort of... odd... I'm attaching another backtrace (with gqview as the invoking program, if it matters), in case it is useful to anybody.
Hmm. Could this be related to bug #189433 ? It's interesting that there's another bug filed against the same version of libpng and with problems in the same file (pnggccrd.c)... Well yeah, my libpng compiled with -Os -fomit-frame-pointer stopped working a few minutes after I posted this too, so anything with -Os seems complete random, whereas -O2 seemed pretty stable over the last hour With -O2 it is stable enough for me, but in some cases, colors are messed up (perhaps related to libsdl?). Video driver is x11-drivers/nvidia-drivers-100.14.09 (as a base line, libpng-1.1.18-r1 is fine). (As a very quick check, compare the table in the foobillard game.) backtraces on optimized code is useless either build it with -g -ggdb -O0 w/out stripping or dont bother Created attachment 128708 [details]
Backtrace of segfault with -O0
...As you wish, SpanKY. As you can see, -O0 provides no more useful information, and the problem is with optimizations. But whatever, here it is...
I got the same problem although i cant reproduce it with compiles made with -O0 or -O2 for me it only segfaults with -Os. That is with gcc 4.1.2 and gcc 4.2.0. libpng versions prior to 1.2.19 are fine when compiles with -Os on my system Just out of curiosity, what binutils version are you using? binutils 2.17.50.0.18 someone post a .png that is causing a crash ... 1.2.19 + pngviewing works on my amd64 machine also, try doing: CPPFLAGS="-DPNG_NO_MMX_CODE" emerge libpng if that fails, you could also try 1.2.20rc1 posted here: http://sourceforge.net/project/showfiles.php?group_id=5624 How about images in libpng's self tests:
----
/bin/sh ./libtool --mode=link --tag=CC x86_64-pc-linux-gnu-gcc -Os -fomit-frame-pointer -march=native -pipe -Wl,-O1 -Wl,--as-needed -o pngtest pngtest.o libpng12.la -lz -lm
x86_64-pc-linux-gnu-gcc -Os -fomit-frame-pointer -march=native -pipe -Wl,-O1 -Wl,--as-needed -o .libs/pngtest pngtest.o ./.libs/libpng12.so -lz -lm
creating pngtest
make[1]: Leaving directory `/var/tmp/paludis/media-libs/libpng-1.2.19/work/libpng-1.2.19'
make check-TESTS
make[1]: Entering directory `/var/tmp/paludis/media-libs/libpng-1.2.19/work/libpng-1.2.19'
Testing libpng version 1.2.19
with zlib version 1.2.3
libpng version 1.2.19 - August 18, 2007
Copyright (c) 1998-2007 Glenn Randers-Pehrson
Copyright (c) 1996-1997 Andreas Dilger
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
library (10219): libpng version 1.2.19 - August 18, 2007
(PNGGCRD x86_64, PIC)
pngtest (10219): libpng version 1.2.19 - August 18, 2007
png_sizeof(png_struct)=1240, png_sizeof(png_info)=464
./test-pngtest.sh: line 3: 9826 Segmentation fault ./pngtest ${srcdir}/pngtest.png
FAIL: test-pngtest.sh
========================================================
1 of 1 tests failed
Please report to png-mng-implement@lists.sourceforge.net
========================================================
make[1]: *** [check-TESTS] Error 1
make[1]: Leaving directory `/var/tmp/paludis/media-libs/libpng-1.2.19/work/libpng-1.2.19'
make: *** [check-am] Error 2
----
passed tests on my machine ive added USE=mmx to the build which will do the CPPFLAGS="-DPNG_NO_MMX_CODE" automatically so people can work around this with USE=-mmx It crashes for me at: (gdb) bt #0 0x00002aaaaabf63f3 in sub_go () at pnggccrd.c:5137 Cannot access memory at address 0x13 Code around 0x00002aaaaabf63f3 is: 0x00002aaaaabf63ef <sub_go+10>: sub %edx,%ecx 0x00002aaaaabf63f1 <sub_go+12>: mov %ebp,%eax 0x00002aaaaabf63f3 <sub_go+14>: mov %ecx,0xffffffffffffffd4(%rbp) 0x00002aaaaabf63f6 <sub_go+17>: mov %rdi,0xffffffffffffffe8(%rbp) "mov %ebp,%eax" is the last line of the asm block in pnggccrd.c:5137-5187. The asm block clobbers the value of the %ebp register, which causes a segfault when gcc tries to load a variable from stack using it. The block contains _CLOBBER_ebp (which expands to ,"%ebp") in the clobber list, but gcc seems to ignore it. The solution would be to define SAVE_ebp and RESTORE_ebp on x86-64 (like it is used on x86). The MMX code has been removed from 1.2.20 version (due to the problems like these..) So this can be marked as a depending on bug 192119 should be fixed with libpng-1.2.20 |
