Segfault on Decode

[maximelenoir]

Hello,

The following project structure leads to a segfault on Decode. Weirdly enough, swapping the structure fields or moving the structure inside src/main.rs does not segfault and only yield the expected error.

I'm using rustc 1.11.0-dev (366de839a 2016-06-28)

Cargo.toml

[package]
name = "test"
version = "0.1.0"

[dependencies]
rustc-serialize = "*"

[lib]
name = "test"
path = "src/lib.rs"

[[bin]]
name = "crash"
path = "src/main.rs"

src/lib.rs

extern crate rustc_serialize;

// This segfault on Decode
#[derive(RustcDecodable)]
pub struct Request {
    pub id: String,
    pub arg: String,
}

// This does not segfault
// #[derive(RustcDecodable)]
// pub struct Request {
//     pub arg: String,
//     pub id: String,
// }

src/main.rs

extern crate test;
extern crate rustc_serialize;

// This does not segfault.
// pub mod test {
//     #[derive(RustcDecodable)]
//     pub struct Request {
//         pub id: String,
//         pub arg: String,
//     }
// }

use rustc_serialize::{json, Decodable};
use test::Request;

fn main() {
    let mut buf = ::std::io::Cursor::new(r#"{"id":"foo"}"#);
    let js = json::Json::from_reader(&mut buf).unwrap();
    let mut dec = json::Decoder::new(js);
    Request::decode(&mut dec).unwrap();
}

Backtrace:

#0  0x00005555555ad5d0 in je_arena_sdalloc () at /home/l936950/rust/src/jemalloc/include/jemalloc/internal/arena.h:1439
#1  je_isdalloct () at include/jemalloc/internal/jemalloc_internal.h:1087
#2  je_isqalloc () at include/jemalloc/internal/jemalloc_internal.h:1097
#3  isfree () at /home/l936950/rust/src/jemalloc/src/jemalloc.c:1842
#4  sdallocx () at /home/l936950/rust/src/jemalloc/src/jemalloc.c:2532
#5  0x000055555555d575 in alloc::heap::deallocate (ptr=0x2 <error: Cannot access memory at address 0x2>, old_size=140737333284904, align=1)
    at /home/l936950/rust/src/liballoc/heap.rs:113
#6  0x000055555555d510 in alloc::raw_vec::{{impl}}::drop<u8> (self=0x7fffffffd730) at /home/l936950/rust/src/liballoc/raw_vec.rs:568
#7  0x000055555555d421 in alloc..raw_vec..RawVec$LT$u8$GT$::drop.8498::h393466ed9f9906fa ()
#8  0x000055555555d409 in std..vec..Vec$LT$u8$GT$::drop_contents.8495::hc385025b48378808 ()
#9  0x000055555555d20c in std..vec..Vec$LT$u8$GT$::drop.8434::hc385025b48378808 ()
#10 0x000055555555d1e9 in std..string..String::drop.8431::h78ebcc0d403d21b3 ()
#11 0x00005555555649a8 in _$LT$test..Request$u20$as$u20$rustc_serialize..serialize..Decodable$GT$::decode::_$u7b$$u7b$closure$u7d$$u7d$::h70433dab9dd06909 ()
#12 0x00005555555640ef in rustc_serialize::json::{{impl}}::read_struct<test::Request,closure> (self=0x7fffffffd910, _name="Request", _len=2, f=closure)
    at /home/l936950/.cargo/registry/src/github.com-88ac128001ac3a9a/rustc-serialize-0.3.19/src/json.rs:2222
#13 0x0000555555564074 in test::{{impl}}::decode<rustc_serialize::json::Decoder> (__arg_0=0x7fffffffd910) at /home/l936950/dev/rust/test/src/lib.rs:4
#14 0x000055555555cec6 in crash::main () at /home/l936950/dev/rust/test/src/main.rs:20
#15 0x00005555555995e9 in std::panicking::try::call::h23d0d9523f424720 ()
#16 0x00005555555a342c in __rust_try ()
#17 0x00005555555a33cf in __rust_maybe_catch_panic ()
#18 0x000055555559908f in std::rt::lang_start::h7023097bb9b24642 ()
#19 0x000055555556ec6a in main ()

Maxime

[alexcrichton]

Looks like this segfault happens on all platforms and is not specific to jemalloc, happens with the system allocator as well. When compiling with RUSTFLAGS=-Zorbit this segfault doesn't happen, so sounds like this may be an old-trans bug which is fixed with MIR translation. I'm not sure if this is already reported in rust-lang/rust (it may already be), so I'm going to...

cc @eddyb, @nagisa, @arielb1

[alexcrichton]

Ok, I've filed an upstream report here -- rust-lang/rust#34592

Thanks for the report @maximelenoir!