Segfault in debug mode does not exit

[lordwelch]

Zig Version

0.16.0-dev.234+32a1aabff

Steps to Reproduce and Observed Behavior

zig run ./test.zig

test.zig:

const std = @import("std");

pub fn main() !u8 {
 var a = std.heap.GeneralPurposeAllocator(.{}).init;
 const a_variable = "something";
 a.allocator().free(a_variable);
 return 0;
}

program never exits outputting the last three lines forever:

$ zig-aarch64-linux-0.16.0-dev.234+32a1aabff/zig run ./test.zig
Segmentation fault at address 0x100fe1a
/zig-aarch64-linux-0.16.0-dev.234+32a1aabff/lib/compiler_rt/memset.zig:19:14: 0x10f5934 in memset (compiler_rt)
 d[0] = c;
 ^
/zig-aarch64-linux-0.16.0-dev.234+32a1aabff/lib/std/mem/Allocator.zig:443:26: 0x10bddef in free__anon_22099 (test)
 @memset(non_const_ptr[0..bytes_len], undefined);
 ^
/zig-aarch64-linux-0.16.0-dev.234+32a1aabff/lib/std/mem/Allocator.zig:443:26: 0x10bddef in free__anon_22099 (test)
 @memset(non_const_ptr[0..bytes_len], undefined);
...

Expected Behavior

Segfault and exit similar to ReleaseSafe.

$ zig-aarch64-linux-0.16.0-dev.234+32a1aabff/zig run -O ReleaseSafe ./test.zig
Segmentation fault at address 0x1017020
/zig-aarch64-linux-0.16.0-dev.234+32a1aabff/lib/std/heap/debug_allocator.zig:875:23: 0x101aee8 in free (test)
 if (bucket.canary != config.canary) @panic("Invalid free");
 ^
/zig-aarch64-linux-0.16.0-dev.234+32a1aabff/lib/std/mem/Allocator.zig:160:25: 0x101acc7 in main (test)
 return a.vtable.free(a.ptr, memory, alignment, ret_addr);
 ^
/zig-aarch64-linux-0.16.0-dev.234+32a1aabff/lib/std/start.zig:627:37: 0x101abb7 in posixCallMainAndExit (test)
 const result = root.main() catch |err| {
 ^
???:?:?: 0x0 in ??? (???)
Aborted (core dumped)

[rootbeer]

Nice timing! This is fixed by PR #25227.

Seems to have been an aarch64-specific problem, the test fails cleanly on my x86 host. Without the #25227 fixes, I can repro the failure (on my linux x86_64 host) with qemu with:

$ zig run --test-cmd qemu-aarch64 --test-cmd-bin -target aarch64-linux test.zig
Segmentation fault at address 0x100fd45
/home/pat/projects/ziglang/zig/lib/compiler_rt/memset.zig:19:14: 0x10f6628 in memset (compiler_rt)
 d[0] = c;
 ^
/home/pat/projects/ziglang/zig/lib/std/mem/Allocator.zig:443:26: 0x10be10b in free__anon_22028 (test)
 @memset(non_const_ptr[0..bytes_len], undefined);
 ^
/home/pat/projects/ziglang/zig/lib/std/mem/Allocator.zig:443:26: 0x10be10b in free__anon_22028 (test)
 @memset(non_const_ptr[0..bytes_len], undefined);
... (repeats forever)

With the #25227 branch running via qemu I get:

$ zig run --test-cmd qemu-aarch64 --test-cmd-bin -target aarch64-linux test.zig
Segmentation fault at address 0x100f888
/home/pat/projects/ziglang/zig/lib/std/mem/Allocator.zig:443:26: 0x10d8a93 in free__anon_23057 (test)
 @memset(non_const_ptr[0..bytes_len], undefined);
 ^
/home/pat/projects/ziglang/playground/25243-endless-stack/test.zig:6:23: 0x10d8943 in main (test)
 a.allocator().free(a_variable);
 ^
/home/pat/projects/ziglang/zig/lib/std/start.zig:627:37: 0x10d889b in callMain (test)
 const result = root.main() catch |err| {
 ^
qemu: uncaught target signal 6 (Aborted) - core dumped
Aborted

[mlugg]

Also note that #25227 should make it impossible to get caught in a loop like this when the stack is unwound via frame pointers; we previously used next_fp >= fp as a sanity check (stopping the unwind if it wasn't the case), while that PR corrects the check to next_fp > fp (i.e. the frame pointer doesn't loop back on itself!).

[lordwelch]

I'm using a m1 macbook running asahi. Glad that there's a PR already in progress!