Open Radar

 
22-Aug-2012 01:32 PM Daniel Jalkut:
Tracking down a crash report from a customer on 10.6.8, I traced it, with the help of friends Mark Dalrymple and Mike Ash, to a compiler behavior with clang, having to do with its treatment of the $rax register, specifically %al, before calling through to a varargs method.

From http://www.x86-64.org/documentation/abi.pdf:

"For calls that may call functions that use varargs or stdargs (prototype-less calls or calls to functions containing ellipsis (. . . ) in the declaration) %al16 is used as hidden argument to specify the number of vector registers used."

The attached source file "PunkItUp.m" contains a succinct example of code that, when compiled with -Os optimization using clang, presents a scenario where -[NSString stringWithFormat:] is called without initializing %al to 0.

As it happens, the failure to do this causes a predictable crash on 10.6.8, where apparently the implementation of stringWithFormat: makes unfortunate use of this uninitialized value.

I was able to confirm that breaking in the debugger on 10.6.8, just before the msgSend, and setting $rax to 0 before continuing with the method call does work around the crash.

I confirmed this bug still exists in clang built from SVN as of today's revision #162362.


22-Aug-2012 01:32 PM Daniel Jalkut:
'PunkItUp.m' was successfully uploaded

[PunkItUp.m source pasted below]


#import <Foundation/Foundation.h>

//
// This code was collaboratively written by Daniel Jalkut and Mark Dalrymple.
// The root cause of the bug was opined by Mike Ash.
//
// Demonstrates an x86_64 ABI violation wherein a method that calls the
// vararg -[NSString stringWithFormat:] does not specify as ZERO the number
// of vector registers being used.
//
// Runs fine everywhere:
// clang -g -Wall -framework Foundation -o PunkItUp PunkItUp.m
//
// Crashes on 10.6.8, runs on 10.7+:
// clang -Os -Wall -framework Foundation -o PunkItUp PunkItUp.m
//
// The source of this particular crash seems to be peculiar to the implementation
// of stringWithFormat: on 10.6.8, but the problematic uninitialization of %al could
// have implications on other frameworks in 10.7+.
//

@interface PunkItUp : NSObject
@end

@implementation PunkItUp

- (NSString*) formattedTimeStringForSeconds:(NSTimeInterval)timeInSeconds
{
    NSUInteger integralTime = (NSUInteger)timeInSeconds;
    NSUInteger HOURS = 3600;
    NSUInteger MINUTES = 60;

    NSUInteger hours = (integralTime / HOURS);
    NSUInteger minutes = (integralTime % HOURS) / MINUTES;
    NSUInteger seconds = (integralTime % HOURS) % MINUTES;

    return [NSString stringWithFormat:@"%lu:%lu:%lu", hours, minutes, seconds];
}

- (id) init
{
    if (self = [super init])
	{
        NSTimeInterval ook = 1.0;
        NSString *blah = [self formattedTimeStringForSeconds: ook];
        NSLog (@"blah: %@", blah);
    }
    return self;

}

@end

int main (void)
{
    [[NSAutoreleasePool alloc] init];

	(void) [[PunkItUp alloc] init];
	
    return 0;
}