Fun with __int128

[Nils Goroll]

Just dropping this because I find it interesting: I am playing with __int128 as 
a sanity check for the changes for #4646, and I get interesting effects with a 
simple explanation.

Don't worry, I will not use any __int128 for real.

configure:3485: clang-19 --version >&5
Debian clang version 19.1.7 (3~deb12u1)

got this:

#6  0x000055d69d28ca6e in child_signal_handler (s=11, si=0x7fde6f5cc5b0, 
c=0x7fde6f5cc480) at cache/cache_main.c:344
#7  <signal handler called>
#8  0x000055d69d2e5c15 in v1f_chunked_pull (vc=0x7fde4007db00, 
vfe=0x7fde4007dd08, ptr=0x7fde28000da0, lp=0x7fde6d288110)
     at http1/cache_http1_vfp.c:703
#9  0x000055d69d279264 in VFP_Suck (vc=0x7fde4007db00, p=0x7fde28000da0, 
lp=0x7fde6d288110) at cache/cache_fetch_proc.c:188

(gdb) fr 8
#8  0x000055d69d2e5c15 in v1f_chunked_pull (vc=0x7fde4007db00, 
vfe=0x7fde4007dd08, ptr=0x7fde28000da0, lp=0x7fde6d288110)
     at http1/cache_http1_vfp.c:703
703		if (vfe->priv2 == -1) {

(gdb) ptype vfe->priv2
type = __int128

So how can this instruction cause a segfault?

The reason: Wrong alignment, because our workspace alignment is 8 bytes.

(gdb) p (uintptr_t)&vfe->priv2 % 16
$4 = 8

The instruction is Move Aligned Packed Single Precision Floating-Point Values:

=> 0x000055dc810eac15 <+485>: movaps 0x20(%rax),%xmm0

With alignment hacked up to 16 bytes, this goes away:

diff --git a/bin/vinyld/cache/cache_fetch_proc.c 
b/bin/vinyld/cache/cache_fetch_proc.c
index 6319fb78e..46ce6d936 100644
--- a/bin/vinyld/cache/cache_fetch_proc.c
+++ b/bin/vinyld/cache/cache_fetch_proc.c
@@ -217,11 +217,12 @@ VFP_Push(struct vfp_ctx *vc, const struct vfp *vfp)
         CHECK_OBJ_NOTNULL(vc, VFP_CTX_MAGIC);
         CHECK_OBJ_NOTNULL(vc->resp, HTTP_MAGIC);

-       vfe = WS_Alloc(vc->resp->ws, sizeof *vfe);
+       vfe = WS_Alloc(vc->resp->ws, sizeof *vfe + 8);
         if (vfe == NULL) {
                 (void)VFP_Error(vc, "Workspace overflow");
                 return (NULL);
         }
+       vfe = (void *)(((uintptr_t)vfe + 8) & ~0xf);

         INIT_OBJ(vfe, VFP_ENTRY_MAGIC);
         vfe->vfp = vfp;

Same thing elsewhere with htc

-- 

Nils Goroll (he/him)

** * * UPLEX - Nils Goroll Systemoptimierung

Scheffelstraße 32
22301 Hamburg

tel +49 40 28805731
mob +49 170 2723133
fax +49 40 42949753

xmpp://slink@jabber.int.uplex.de/

http://uplex.de/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://vinyl-cache.org/lists/pipermail/vinyl-dev/attachments/20261112/b04ead60/attachment-0001.bin>