Follow-up Comment #3, bug #68552 (group groff):

I reproduce it on Termux (32-bit arm) with clang 21.1.8.

Preparations:

1)

$ printf '.rr \\a\n' > in


2) Execute all environment variable commands from 'test-groff'.

First result: The issue comes from the object file src/roff/troff/input.o
being compiled with optimizations.

When I compile all object files with CFLAGS="-ggdb" and CXXFLAGS="-ggdb",
"./groff < in" prints a message 'error: expected identifier, got a
non-interpreted character node token; treated as missing', but no "Aborted".

When I compile all object files except src/roff/troff/input.o with
CFLAGS="-ggdb" and CXXFLAGS="-ggdb", and only src/roff/troff/input.o with
CFLAGS="-ggdb -O2" and CXXFLAGS="-ggdb -O2", "./groff < in" prints the same
message and then "groff: error: troff: Aborted".

Second result: stack trace from troff.


$ ./groff -V < in
troff -Tps | grops


Reproduce with 'troff' alone:


$ ./troff -Tps < in > out
./troff:<standard input>:1: error: expected identifier, got a non-interpreted
character node token; treated as missing
Aborted                    ./troff -Tps < in > out


The gdb session:


(gdb) run -Tps < in > out
(gdb) break abort
(gdb) break exit
(gdb) break _exit
(gdb) break error
(gdb) run -Tps < in > out

(gdb) where
#0  error (format=<optimized out>, arg1=..., arg2=..., arg3=...) at
../src/roff/troff/input.cpp:10978
#1  diagnose_missing_identifier (is_mandatory=<optimized out>) at
../src/roff/troff/input.cpp:3273
#2  0x0045b08c in read_input_until_terminator (want_diagnostic=false,
end_char=0 '\000', want_identifier=true) at ../src/roff/troff/input.cpp:3369
#3  0x004a0ca0 in remove_register_request () at ../src/roff/troff/reg.cpp:541
#4  0x0045c3e8 in interpolate_macro_or_invoke_request (nm=...,
do_not_want_next_token=false) at ../src/roff/troff/input.cpp:4755
#5  0x0045bd00 in process_input_stack () at ../src/roff/troff/input.cpp:3649
#6  0x004677c0 in process_input_file (name=<optimized out>) at
../src/roff/troff/input.cpp:9948
#7  0x00463c54 in main (argc=<optimized out>, argv=<optimized out>) at
../src/roff/troff/input.cpp:10319

(gdb) where
#0  0x0045aed0 in error (format=<optimized out>, arg1=..., arg2=..., arg3=...)
at ../src/roff/troff/input.cpp:10978
#1  0x0045aed0 in diagnose_missing_identifier (is_mandatory=<optimized out>)
#2  0x0045b08c in read_input_until_terminator (want_diagnostic=false,
end_char=0 '\000', want_identifier=true) at ../src/roff/troff/input.cpp:3369
#3  0x004a0ca0 in remove_register_request () at ../src/roff/troff/reg.cpp:541
#4  0x0045c3e8 in interpolate_macro_or_invoke_request (nm=...,
do_not_want_next_token=false) at ../src/roff/troff/input.cpp:4755
#5  0x0045bd00 in process_input_stack () at ../src/roff/troff/input.cpp:3649
#6  0x004677c0 in process_input_file (name=<optimized out>) at
../src/roff/troff/input.cpp:9948
#7  0x00463c54 in main (argc=<optimized out>, argv=<optimized out>) at
../src/roff/troff/input.cpp:10319

(gdb) where
#0  0xb6b07724 in exit () from /apex/com.android.runtime/lib/bionic/libc.so
#1  0x004338b0 in write_any_trailer_and_exit (exit_code=0) at
../src/roff/troff/div.cpp:668
#2  0x00432b08 in top_level_diversion::begin_page (this=0xb6280640, n=...) at
../src/roff/troff/div.cpp:680
#3  0x0043caac in environment::do_break (this=0xb5e030f0,
want_forced_adjustment=false) at ../src/roff/troff/env.cpp:2682
#4  0x004404c0 in environment::final_break (this=0xb5e030f0) at
../src/roff/troff/env.cpp:2541
#5  0x004679e0 in exit_troff () at ../src/roff/troff/input.cpp:3405
#6  0x00463c58 in main (argc=<optimized out>, argv=<optimized out>) at
../src/roff/troff/input.cpp:10320

(gdb) where
#0  0xb6ac178a in abort () from /apex/com.android.runtime/lib/bionic/libc.so
#1  0xb6ab73ce in scudo::die() () from
/apex/com.android.runtime/lib/bionic/libc.so
#2  0xb6ab77bc in scudo::ScopedErrorReport::~ScopedErrorReport() () from
/apex/com.android.runtime/lib/bionic/libc.so
#3  0xb6ab798a in scudo::reportMisalignedPointer(scudo::AllocatorAction,
void*) () from /apex/com.android.runtime/lib/bionic/libc.so
#4  0xb6ab8604 in scudo::Allocator<scudo::AndroidConfig,
&scudo_malloc_postinit>::deallocate(void*, scudo::Chunk::Origin, unsigned
long, unsigned long) ()
   from /apex/com.android.runtime/lib/bionic/libc.so
#5  0xb6ab8512 in scudo_free () from
/apex/com.android.runtime/lib/bionic/libc.so
#6  0x00478608 in std::__ndk1::__libcpp_operator_delete[abi:ne210000]<bool*,
unsigned int>(bool*, unsigned int) (__args=4096, __args=4096)
    at
/data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:46
#7
std::__ndk1::__libcpp_deallocate[abi:ne210000]<bool>(std::__ndk1::__type_identity<bool>::type*,
std::__ndk1::__element_count, unsigned int) (__ptr=0xbeffe8b0, __n=4096, 
    __align=1) at
/data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__new/allocate.h:86
#8  std::__ndk1::allocator<bool>::deallocate[abi:ne210000](bool*, unsigned
int) (this=0x4ccb44 <want_att_compat_stack+20>, __p=0xbeffe8b0, __n=4096)
    at
/data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocator.h:120
#9  std::__ndk1::allocator_traits<std::__ndk1::allocator<bool>
>::deallocate[abi:ne210000](std::__ndk1::allocator<bool>&, bool*, unsigned
int) (__a=..., __p=0xbeffe8b0, __n=4096)
    at
/data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/__memory/allocator_traits.h:302
#10 std::__ndk1::deque<bool, std::__ndk1::allocator<bool> >::clear
(this=0x4ccb30 <want_att_compat_stack>)
    at
/data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/deque:2531
#11 std::__ndk1::deque<bool, std::__ndk1::allocator<bool>
>::~deque[abi:ne210000]() (this=0x4ccb30 <want_att_compat_stack>)
    at /data/data/com.termux/files/usr/bin/../../usr/include/c++/v1/deque:614
#12 0xb6b0c03a in __cxa_finalize () from
/apex/com.android.runtime/lib/bionic/libc.so
#13 0xb6b0772e in exit () from /apex/com.android.runtime/lib/bionic/libc.so
#14 0x004338b0 in write_any_trailer_and_exit (exit_code=0) at
../src/roff/troff/div.cpp:668
#15 0x00432b08 in top_level_diversion::begin_page (this=0xb6280640, n=...) at
../src/roff/troff/div.cpp:680
#16 0x0043caac in environment::do_break (this=0xb5e030f0,
want_forced_adjustment=false) at ../src/roff/troff/env.cpp:2682
#17 0x004404c0 in environment::final_break (this=0xb5e030f0) at
../src/roff/troff/env.cpp:2541
#18 0x004679e0 in exit_troff () at ../src/roff/troff/input.cpp:3405
#19 0x00463c58 in main (argc=<optimized out>, argv=<optimized out>) at
../src/roff/troff/input.cpp:10320


So it looks like __cxa_finalize() got into trouble because the memory
management data structures were inconsistent, leading to a misaligned pointer
somewhere.

Together with the first result, it smells a memory overrun error somewhere
(anywhere!). The best tool for diagnosing this is valgrind; ASAN is good but
only of limited usefulness.

So, if I were you, I would

1) try ASAN on that platform (Termux),

2) if not successful, run the entire 'troff' test suite under valgrind. Gnulib
documentation:
https://www.gnu.org/software/gnulib/manual/html_node/Running-self_002dtests-under-valgrind.html
.

3) If that is not enough to highlight a problem, extend the 'troff' test suite
with more test cases.



    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?68552>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/

Attachment: signature.asc
Description: PGP signature

Reply via email to