{"action":"created","issue":{"url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/164","repository_url":"https://api.github.com/repos/LuaJIT/LuaJIT","labels_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/164/labels{/name}","comments_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/164/comments","events_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/164/events","html_url":"https://github.com/LuaJIT/LuaJIT/issues/164","id":150793399,"number":164,"title":"Random failures in compiled code","user":{"login":"iehrlich","id":3672821,"avatar_url":"https://avatars.githubusercontent.com/u/3672821?v=3","gravatar_id":"","url":"https://api.github.com/users/iehrlich","html_url":"https://github.com/iehrlich","followers_url":"https://api.github.com/users/iehrlich/followers","following_url":"https://api.github.com/users/iehrlich/following{/other_user}","gists_url":"https://api.github.com/users/iehrlich/gists{/gist_id}","starred_url":"https://api.github.com/users/iehrlich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iehrlich/subscriptions","organizations_url":"https://api.github.com/users/iehrlich/orgs","repos_url":"https://api.github.com/users/iehrlich/repos","events_url":"https://api.github.com/users/iehrlich/events{/privacy}","received_events_url":"https://api.github.com/users/iehrlich/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-04-25T08:58:32Z","updated_at":"2016-04-25T09:53:04Z","closed_at":"2016-04-25T09:53:04Z","body":"Cross-posting here from the mailing list.\r\n\r\nDear all,\r\n\r\nduring the investigation of random core dumps in LuaJIT 2.0.4, I found an issue that's present in both master and 2.1 branches, which may lead to random failures with arbitrary symptoms on x86 and x86_64. The issue affects x86 and x86_64 targets, GNU/Linux confirmed, other OSes are most probably affected too. Such failures are extremely hard to reproduce, so I'll just dump the results of the investigation below.\r\n\r\nFirst of all, during the compilation of a trace emitter produces the following mcode:\r\n```\r\n0xfa98b57: jne 0x1efbca7b\r\n   # 0f 85 1e 3f 52 0f\r\n0xfa98b5d: cmp DWORD PTR [rdx+0x274],0xfffffffb\r\n   # 83 ba 74 02 00 00 fb\r\n```\r\nFTR, these are the last instruction of HREFK and the first instruction of HLOAD with \"str\" output type. Everything works fine until the compiler generates a side trace for this trace and starts patching the parent. The function lj_asm_patchexit scans parent trace byte-by-byte and eventually comes to the address 0xfa98b5c in attempt to find a six-byte side exit jcc pattern. As you may see, this is not an address of any particular valid instruction. The six-byte pattern here overlaps the last byte of jne and five bytes of cmp, looking like \"0f 83 ba 74 02 00\". Patcher tries to interpret this as a jcc instruction, and it __succeeds__, as \"0f 83\" works for it as an opcode and 0x274ba is the __exact relative offset__ from 0xfa98b5c to the stub of the side exit being patched (plus-minus 6, hope you get the idea).\r\n\r\nAs a result of this misinterpretation, bytes 0xfa98b5c through 0xfa98b5f are patched with the offset to the newly created side trace, resulting in...\r\n```\r\n0xfa98b57:  jne 0x1efbca7b\r\n   # 0f 85 1e 3f 52 0f\r\n0xfa98b5d:  and DWORD PTR [rsi],0x1b\r\n   # 83 26 1b\r\n0xfa98b60:  rex.WX (bad)\r\n   # 00\r\n0xfa98b63:  sti\r\n   # fb\r\n```\r\n...and the application segfaults on 0xfa98b5d. Actually, that's the point where the investigation was started.\r\n\r\nAs it was said earlier, technically, you can get virtually any error here. This might be a SIGSEGV, or SIGILL. If you are lucky enough to encounter such an unlikely issue, you might even get no error with an unpredictable outcome.\r\n\r\nBest regards,\r\nIgor A. Ehrlich"},"comment":{"url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/comments/214240708","html_url":"https://github.com/LuaJIT/LuaJIT/issues/164#issuecomment-214240708","issue_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/164","id":214240708,"user":{"login":"iehrlich","id":3672821,"avatar_url":"https://avatars.githubusercontent.com/u/3672821?v=3","gravatar_id":"","url":"https://api.github.com/users/iehrlich","html_url":"https://github.com/iehrlich","followers_url":"https://api.github.com/users/iehrlich/followers","following_url":"https://api.github.com/users/iehrlich/following{/other_user}","gists_url":"https://api.github.com/users/iehrlich/gists{/gist_id}","starred_url":"https://api.github.com/users/iehrlich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iehrlich/subscriptions","organizations_url":"https://api.github.com/users/iehrlich/orgs","repos_url":"https://api.github.com/users/iehrlich/repos","events_url":"https://api.github.com/users/iehrlich/events{/privacy}","received_events_url":"https://api.github.com/users/iehrlich/received_events","type":"User","site_admin":false},"created_at":"2016-04-25T09:53:04Z","updated_at":"2016-04-25T09:53:04Z","body":"Fixed, closing."}}