Re: [Vala] A seemingly impossible segfault.

[Darren Warner <vala-list dazwin com>]

Hi Michael,

I think this is the same problem I was experiencing (though I get it
with vala 0.7.6 as well, so I'm not sure why this was previously working
for you).

The problem is that bad code being generated by vala - 'self' is being
used before it is being initialized. The following simplified code will
reproduce the problem:

public class Bar : GLib.Object {
    private ThreadedSocketService m_service;
    private uint16 m_max_connections;

    public Bar() {
        m_service = new ThreadedSocketService(10);
        m_service.max_threads = m_max_connections;
    }
}

Compiling with 'valac -C bar.vala --pkg=gio-2.0' will produce the following:

Bar* bar_construct (GType object_type) {
        GParameter * __params;
        GParameter * __params_it;
        GThreadedSocketService* _tmp0_;
        Bar * self;
        __params = g_new0 (GParameter, 1);
        __params_it = __params;
        self->priv->m_service = (_tmp0_ = (GThreadedSocketService*)
g_threaded_socket_service_new (10), _g_object_unref0
(self->priv->m_service), _tmp0_);
        ...
        self = g_object_newv (object_type, __params_it - __params, __params);


I don't know what it is about ThreadedSocketService, but I cannot
reproduce the problem if I use a simple 'Foo' class instead, even if it
is derived from GLib.Object. Bar does need to be constructed from
GLib.Object - the bug is related to some kind of readahead optimization
maybe?

I was going to raise a bug about this, but wanted to check if you were
having the same problem as well - seems you are.

-Darren

Michael Trausch wrote:
> I'm not entirely sure *where* in the stack the issue is.  I'm using
> Vala 0.7.7, and when I compile the libvfcgi project I am receiving a
> segfault at line 56 of http://is.gd/5mlyT -- however, a segfault there
> should not be possible, as I understand it.  So, either I'm doing
> something horribly wrong that I cannot see, or there's something
> horribly wrong somewhere else that I cannot see.  Can anyone perhaps
> tell me what I've done wrong?
>
> The change that introduced the crash was the one wherein I initialized
> and created the new object:
>
>   http://bazaar.launchpad.net/~mtrausch/libvfcgi/trunk/revision/21/libvfcgi/server.vala
>
> The thing I don't get is *why* that would crash at all.  GDB says:
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff7bd73e6 in fast_cgi_server_construct (object_type=6330480,
> error=0x7fffffffe1a0) at server.c:208
> 208             self->priv->m_mainloop = (_tmp0_ = g_main_loop_new (NULL, FALSE),
> _g_main_loop_unref0 (self->priv->m_mainloop), _tmp0_);
>
> Of course the problem there is that there are multiple statements and
> I know not which one is actually crashing.  Looking at the
> disassembly, I get:
>
> 000000000000d391 <fast_cgi_server_construct>:
>     d391:       55                      push   %rbp
>     d392:       48 89 e5                mov    %rsp,%rbp
>     d395:       41 54                   push   %r12
>     d397:       53                      push   %rbx
>     d398:       48 81 ec b0 00 00 00    sub    $0xb0,%rsp
>     d39f:       48 89 bd 58 ff ff ff    mov    %rdi,-0xa8(%rbp)
>     d3a6:       48 89 b5 50 ff ff ff    mov    %rsi,-0xb0(%rbp)
>     d3ad:       48 c7 45 e8 00 00 00    movq   $0x0,-0x18(%rbp)
>     d3b4:       00
>     d3b5:       bf 20 00 00 00          mov    $0x20,%edi
>     d3ba:       e8 69 8d ff ff          callq  6128 <g_malloc0 plt>
>     d3bf:       48 89 45 e0             mov    %rax,-0x20(%rbp)
>     d3c3:       48 8b 45 e0             mov    -0x20(%rbp),%rax
>     d3c7:       48 89 45 d8             mov    %rax,-0x28(%rbp)
>     d3cb:       be 00 00 00 00          mov    $0x0,%esi
>     d3d0:       bf 00 00 00 00          mov    $0x0,%edi
>     d3d5:       e8 de 87 ff ff          callq  5bb8 <g_main_loop_new plt>
>     d3da:       48 89 45 d0             mov    %rax,-0x30(%rbp)
>     d3de:       48 8b 45 b8             mov    -0x48(%rbp),%rax
>     d3e2:       48 8b 40 18             mov    0x18(%rax),%rax
>     d3e6:       48 8b 00                mov    (%rax),%rax
>
> 0xd3e6 is the line that is causing it to crash, according to the backtrace.
>
> I haven't the slightest how to follow it from there, so I am hoping
> that someone here can see my error or provide some insight as to what
> might be being done wrong.
>
>     --- Mike
> _______________________________________________
> Vala-list mailing list
> Vala-list gnome org
> http://mail.gnome.org/mailman/listinfo/vala-list