Segfault in `jl_object_id__cold` when testing `CountdownNumbers`

[KristofferC]

The repo for this package seems to have been deleted so I hosted a fork here: https://github.com/KristofferC/CountdownNumbers.jl. The exact time it segfaults varies a bit. I did a very brief look into the source code and didn't immediately see anything strange.

     Testing Running tests...
[ Info: Running test case 1 of 10
[ Info: Running test case 2 of 10
[ Info: Running test case 3 of 10
┌ Warning: Could not find exact solution. Closest solution has L1 error 91
└ @ CountdownNumbers ~/JuliaPkgs/CountdownNumbers/src/public.jl:35
[ Info: Running test case 4 of 10
[ Info: Running test case 5 of 10

[43009] signal 11 (2): Segmentation fault: 11
in expression starting at /Users/kristoffercarlsson/JuliaPkgs/CountdownNumbers/test/runtests.jl:4
jl_object_id__cold at /Users/julia/.julia/scratchspaces/a66863c6-20e8-4ff4-8a62-49f30b1f605e/agent-cache/default-honeycrisp-XG3Q6T6R70.0/build/default-honeycrisp-XG3Q6T6R70-0/julialang/julia-master/src/builtins.c:441
ijl_object_id_ at /Users/julia/.julia/scratchspaces/a66863c6-20e8-4ff4-8a62-49f30b1f605e/agent-cache/default-honeycrisp-XG3Q6T6R70.0/build/default-honeycrisp-XG3Q6T6R70-0/julialang/julia-master/src/builtins.c:481 [inlined]
ijl_object_id at /Users/julia/.julia/scratchspaces/a66863c6-20e8-4ff4-8a62-49f30b1f605e/agent-cache/default-honeycrisp-XG3Q6T6R70.0/build/default-honeycrisp-XG3Q6T6R70-0/julialang/julia-master/src/builtins.c:487 [inlined]
immut_id_ at /Users/julia/.julia/scratchspaces/a66863c6-20e8-4ff4-8a62-49f30b1f605e/agent-cache/default-honeycrisp-XG3Q6T6R70.0/build/default-honeycrisp-XG3Q6T6R70-0/julialang/julia-master/src/builtins.c:413
objectid at ./runtime_internals.jl:847 [inlined]
hash at ./hashing.jl:36 [inlined]
hash at ./hashing.jl:28 [inlined]
hashindex at ./dict.jl:128 [inlined]
ht_keyindex2_shorthash! at ./dict.jl:269
setindex! at ./dict.jl:356
push! at ./set.jl:137
unknown function (ip: 0x11497411b) at (unknown file)
_all_formulas at /Users/kristoffercarlsson/JuliaPkgs/CountdownNumbers/src/generate_formulas.jl:15
unknown function (ip: 0x114a6d07f) at (unknown file)
_all_formulas at /Users/kristoffercarlsson/JuliaPkgs/CountdownNumbers/src/generate_formulas.jl:36 [inlined]
numbers at /Users/kristoffercarlsson/JuliaPkgs/CountdownNumbers/src/public.jl:19
unknown function (ip: 0x1148bbd67) at (unknown file)
macro expansion at /Users/kristoffercarlsson/JuliaPkgs/CountdownNumbers/test/runtests.jl:20 [inlined]

[vtjnash]

Agreed, there is nothing strange looking there (it is quite small), but crashes under rr for me as well

[vtjnash]

It is some sort of missing GC root. The value should have been CountdownNumbers.Add(x=3, y=CountdownNumbers.Add(x=25, y=100, isvalid=true, value=125), isvalid=true, value=128), but instead has been GC'd before getting passed as one of the fields in the jl_apply_generic call.

In code_llvm(CountdownNumbers._all_formulas, (CountdownNumbers.Add, CountdownNumbers.Add)),
The object was allocated here:

(rr) p (void) jl_gdblookup($rip)
Add at /home/vtjnash/.julia/dev/CountdownNumbers/src/types.jl:4 [inlined]
Add at /home/vtjnash/.julia/dev/CountdownNumbers/src/type_constructors.jl:0 [inlined]
_all_formulas at /home/vtjnash/.julia/dev/CountdownNumbers/src/generate_formulas.jl:8

And free'd here:

(rr) p (void) jl_gdblookup($pc)
Array at ./boot.jl:645 [inlined]
getindex at ./array.jl:405 [inlined]
vect at ./array.jl:185 [inlined]
_all_formulas at /home/vtjnash/.julia/dev/CountdownNumbers/src/generate_formulas.jl:8

Then attempted to be used here:

push! at ./set.jl:137                                                                                                                                                                                                            
unknown function (ip: 0x7f7e829504c8) at (unknown file)                                                                                                                                                                          
_jl_invoke at /home/vtjnash/julia1/src/gf.c:3475 [inlined]                                                                                                                                                                       
ijl_apply_generic at /home/vtjnash/julia1/src/gf.c:3675                                                                                                                                                                          
_all_formulas at /home/vtjnash/.julia/dev/CountdownNumbers/src/generate_formulas.jl:15                                                                                                                                           

Maybe related to something like this (only reproduces with raw=false):

define i64 @"julia_#65_6373"(i64 signext %"x::Int64") #0 {
top:
  %0 = alloca { ptr, i64 }, align 8
; ┌ @ Base.jl:12 within `Pair`
   %box_Int64 = call nonnull align 8 dereferenceable(8) ptr @ijl_box_int64(i64 signext %"x::Int64") #7
; └
; ┌ @ gcutils.jl:133 within `gc` @ gcutils.jl:133
   call void @jlplt_ijl_gc_collect_6376_got.jit(i32 1)
; └
; ┌ @ runtime_internals.jl:830 within `objectid`
   store ptr %box_Int64, ptr %0, align 8
   %1 = getelementptr inbounds i8, ptr %0, i64 8
   store i64 1, ptr %1, align 8
   %object_id = call i64 @ijl_object_id_(i64 ptrtoint (ptr @"+Core.Pair#6377.jit" to i64), ptr nonnull %0)
   ret i64 %object_id
; └
}

[vtjnash]

Two versions of the MWE: one caused by lowering, the other caused by inlining

julia> function _all_formulas(left)                       
           g = Base.getindex(Any, Some{Any}(left), f(left))
           Core.donotdelete(objectid(g[1]))                 
       end                                                  
_all_formulas (generic function with 1 method)   
                                                                                                                              
julia> @inline f(left) = (try; throw(); catch e; end; GC.gc(); Some{Any}(left))

julia> _all_formulas(Some{Any}(1))
[2209067] signal 11 (1): Segmentation fault                                                                                   

function _all_formulas(left)                                                                                                  
    a = Some{Any}(left)                                                                                                       
    candidate_formulas = Base.getindex(Any, a,                                                                                
        (try; throw(); catch e; end; GC.gc(); Some{Any}(left)))                                                                                                                                                                                             
    for f in candidate_formulas                                                                                                                                                                                                                             
        Core.donotdelete(objectid(f))                                                                                         
    end                                                                                                                                                                                                                                                     
end                                                                                                                                                                                                                                                         
for i = 1:2                                                                                                                   
    @noinline _all_formulas(Some{Any}(1))                                                                                     
end                                                                                                                           
[2273570] signal 6 (-6): Aborted

In both cases, we have SSA values inserted which survive across a try/catch. With our current codegen (which uses setjmp) which fails to model the edge here, having SSA values survive like this is not legal. Supposedly this should have failed our IR verifier (since the :leave should have a virtual parent of 0). Our current plan long term is to change codegen to emit invoke instead of call (unless our nothrow modeling proves it is safe to use call) and add a late pass which converts that to our setjmp/longjmp after most optimizations have run. Our current plan short term is to write a post-processing pass in inference which converts SSA values into PhiC nodes if their uses cross over any :leave (this is similar to slot2ssa)

[vtjnash]

@xal-0 also creduced it to come us with this beautiful example demonstrating how simply doing try/catch in a for-loop is invalid:

julia> a = 1; f() = for b = 1:a
           try
             throw()
           catch err
             GC.gc()
           end
       end; @code_typed f(); f()
[2418522] signal 11 (1): Segmentation fault