Skip to content

Segfault in keep_alive for Pipeline depth stencil create info #10

@hja3

Description

@hja3

Please see the supporting info from the coredump below.

The function camlVk__Types__Pipeline_depth_stencil_state_create_info.fun_1421 is the keep_alive code generated in aster/structured.ml:403, called from the construct function on lines 471-472. It maps Obj.refr over the fields of the struct places them into an array. I don't understand how Obj works exactly and am only prodding at it from the outside, but what is happening, I think, is that a number of the fields of Pipeline_depth_stencil_state_create_info are immediate values, not pointers, and when caml_make_array tries to dereference those values, it crashes. The crash may be reproduced easily with a subset of the depth stencil data

let a = [|Obj.repr 0.0; Obj.repr false|];;

which segfaults at the same instruction.

Coredump info for the application:

(gdb) where
#0  0x00000000006cbe33 in caml_make_array ()
#1  <signal handler called>
#2  0x0000000000583820 in camlVk__Types__Pipeline_depth_stencil_state_create_info.fun_1421 ()
#3  <signal handler called>
#4  0x00000000006d0cb8 in caml_callback_exn ()
#5  0x00000000006d8a20 in caml_final_do_calls_exn ()
#6  0x00000000006ed9d7 in caml_do_pending_actions_exn ()
#7  0x00000000006edaaf in caml_process_pending_actions_with_root_exn ()
#8  0x00000000006edad9 in caml_process_pending_actions_with_root ()
#9  <signal handler called>
#10 0x00000000006a49bd in camlStdlib__Format.advance_left_670 ()
#11 0x00000000006a53ad in camlStdlib__Format.pp_flush_queue_770 ()
#12 0x00000000006a5675 in camlStdlib__Format.pp_print_newline_929 ()
#13 0x00000000005294a6 in camlLve__First_app.run_2598 () at lib/first_app.ml:213
#14 0x0000000000694e9b in camlStdlib__Fun.protect_326 ()
#15 0x000000000051d1db in camlDune__exe__Main.entry () at bin/main.ml:6
#16 0x00000000005118e7 in caml_program ()
#17 <signal handler called>
#18 0x00000000006f443d in caml_startup_common ()
#19 0x00000000006f4489 in caml_startup ()
#20 0x000000000050f92c in main ()

(gdb) info registers
rax            0x20                32
rbx            0x7f091e14eed0      139677136121552
rcx            0x0                 0
rdx            0x1                 1
rsi            0x0                 0
rdi            0x0                 0
rbp            0x50                0x50
rsp            0x7ffe7e614450      0x7ffe7e614450
r8             0x0                 0
r9             0x0                 0
r10            0x27c72600          667362816
r11            0x7ffe7e614530      140731018724656
r12            0x27c61b70          667294576
r13            0x7ffe7e614660      140731018724960
r14            0x27c61b70          667294576
r15            0x7f091e14eec8      139677136121544
rip            0x6cbe33            0x6cbe33 <caml_make_array+355>
eflags         0x10206             [ PF IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

(gdb) disassemble
   0x00000000006cbe28 <+344>:   mov    0x8(%rsp),%rdx
   0x00000000006cbe2d <+349>:   add    %rax,%rdx
   0x00000000006cbe30 <+352>:   mov    (%rdx),%rdx
=> 0x00000000006cbe33 <+355>:   movsd  (%rdx),%xmm0
   0x00000000006cbe37 <+359>:   mov    0x18(%rsp),%rdx
   0x00000000006cbe3c <+364>:   movsd  %xmm0,(%rdx,%rax,1)
   0x00000000006cbe41 <+369>:   add    $0x8,%rax
   0x00000000006cbe45 <+373>:   cmp    %rax,%rbp
   0x00000000006cbe48 <+376>:   jne    0x6cbe28 <caml_make_array+344>

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions