Test 8 crashes when built with gcc 7.1.1

[daveisfera]

The output is 8/11 Test #8: util-test ........................***Exception: SegFault 0.04 sec. Is there anything else I can provide to help diagnose the issue?

[vitaut]

Thanks for the bug report. What library version do you use and on what platform (OS version) does it happen?

[daveisfera]

Sorry, I should have included that originally. It's 3.0.2 on Fedora Rawhide (27).

[vitaut]

I tried reproducing on Fedora 26 with gcc 7.1.1-3 but the tests pass there. Do you use gcc 7.1.1-3 or another version?

Also could you run bin/util-test under gdb and then post the stack trace (bt) when it segfaults?

[daveisfera]

You're right, Fedora 26 is also using gcc 7.1.1 but Fedora Rawhide (27) has been updated to glibc 2.26, so maybe that's the source of the issue.

When I run bun/util-test directly, it doesn't segfault, but then when I run it using /usr/bin/ctest or with gdb, it segfaults. Here's the backtrace from gdb:

#0  0x00007ffff70d1844 in __memmove_sse2_unaligned_erms () from /lib64/libc.so.6
#1  0x00005555555b21ad in std::__copy_move<false, true, std::random_access_iterator_tag>::__copy_m<char> (__result=<optimized out>, __last=<optimized out>, 
    __first=<optimized out>) at /usr/include/c++/7/bits/stl_algobase.h:368
#2  std::__copy_move_a<false, char const*, char*> (__result=<optimized out>, __last=<optimized out>, __first=<optimized out>) at /usr/include/c++/7/bits/stl_algobase.h:386
#3  std::__copy_move_a2<false, char const*, char*> (__result=<optimized out>, __last=<optimized out>, __first=<optimized out>) at /usr/include/c++/7/bits/stl_algobase.h:424
#4  std::copy<char const*, char*> (__result=<optimized out>, __last=<optimized out>, __first=0x0) at /usr/include/c++/7/bits/stl_algobase.h:456
#5  std::__uninitialized_copy<true>::__uninit_copy<char const*, char*> (__result=<optimized out>, __last=<optimized out>, __first=0x0)
    at /usr/include/c++/7/bits/stl_uninitialized.h:101
#6  std::uninitialized_copy<char const*, char*> (__result=<optimized out>, __last=<optimized out>, __first=0x0) at /usr/include/c++/7/bits/stl_uninitialized.h:134
#7  fmt::Buffer<char>::append<char> (this=0x7fffffffd8a0, begin=0x0, end=<optimized out>) at /builddir/build/BUILD/fmt-3.0.2/fmt/format.h:706
#8  0x00007ffff79a4eff in fmt::BasicWriter<char>::operator<< (value=..., this=0x7fffffffd890) at /builddir/build/BUILD/fmt-3.0.2/fmt/format.h:2628
#9  fmt::internal::format_system_error (out=..., error_code=error_code@entry=33, message=...) at /builddir/build/BUILD/fmt-3.0.2/fmt/format.cc:616
#10 0x00005555555aa1a9 in UtilTest_FormatSystemError_Test::TestBody (this=<optimized out>) at /builddir/build/BUILD/fmt-3.0.2/test/util-test.cc:840
#11 0x00005555555f55ca in testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void> (location=0x5555555fc5e1 "the test body", method=<optimized out>, 
    object=0x5555558323b0) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3562
#12 testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void> (object=object@entry=0x5555558323b0, method=<optimized out>, 
    location=location@entry=0x5555555fc5e1 "the test body") at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3598
#13 0x00005555555eb43a in testing::Test::Run (this=this@entry=0x5555558323b0) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3634
#14 0x00005555555eb64d in testing::Test::Run (this=0x5555558323b0) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3626
#15 testing::TestInfo::Run (this=0x555555830b20) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3810
#16 0x00005555555eb78d in testing::TestInfo::Run (this=<optimized out>) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3785
#17 testing::TestCase::Run (this=0x55555582fae0) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3928
#18 0x00005555555ebd95 in testing::TestCase::Run (this=<optimized out>) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3914
#19 testing::internal::UnitTestImpl::RunAllTests (this=0x55555582df80) at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:5799
#20 0x00005555555f5a8a in testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> (
    location=0x5555555fb948 "auxiliary test code (environments or event listeners)", method=<optimized out>, object=0x55555582df80)
    at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3562
#21 testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> (object=0x55555582df80, method=<optimized out>, 
    location=location@entry=0x5555555fb948 "auxiliary test code (environments or event listeners)") at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:3598
#22 0x00005555555ebf66 in testing::UnitTest::Run (this=0x55555581b920 <testing::UnitTest::GetInstance()::instance>)
    at /builddir/build/BUILD/fmt-3.0.2/test/gmock-gtest-all.cc:5410
#23 0x00005555555950ff in RUN_ALL_TESTS () at /builddir/build/BUILD/fmt-3.0.2/test/./gtest/gtest.h:20062
#24 main (argc=<optimized out>, argv=<optimized out>) at /builddir/build/BUILD/fmt-3.0.2/test/test-main.cc:57

[abolz]

(I can't test on Linux right now, so I'm just guessing here... but maybe it helps to find the source of the problem...)

It seems like the StringRef constructed here https://github.com/fmtlib/fmt/blob/release-3.0/test/util-test.cc#L841 is invalid. In https://github.com/fmtlib/fmt/blob/release-3.0/fmt/format.h#L2628 this leads to nullptr + SIZE_MAX which is UB. Maybe gcc 7 can now take advantage of this?

NB: There was also a change in the memcpy implementation in glibc in 2.26
http://sourceware.org/git/?p=glibc.git;a=commit;h=5c3e322d3be3803636e38bcaf083fb59b3a34f0c

[vitaut]

@abolz, you are right regarding the problem with SIZE_MAX. The test was passing the large value intentionally to trigger an allocation failure but I guess something changed in the implementation and they started to treat SIZE_MAX specially.

Should be fixed in 6655e80. @daveisfera, do you want me to backport the fix to the release-3.0 branch? And thanks again for catching this.

[vitaut]

Fails on MSVC: https://ci.appveyor.com/project/vitaut/fmt/build/build%20730/job/1iwbh94tb5gy8q57

[daveisfera]

The patch makes the tests pass on Fedora Rawhide (27) so I'll run with that for now.

[daveisfera]

It still crashes on i686:
https://kojipkgs.fedoraproject.org//work/tasks/9966/21139966/build.log

[vitaut]

Should be fixed in 032c838. Now the problematic test is skipped if allocator is behaving funny.