[fpc-devel] Possible problem with RTTI?

[Thorsten Otto]

Hi,

while working on some atari specific support in ExecuteProcess, i'm now 
encountering some crash that seems to happen in fpc_dynarray_setlength:

FPC_DYNARR_SETLENGTH:
[00006c94] 4e56 ffcc                 link       a6,#-52
[00006c98] 48ee 3cfc ffcc            movem.l    d2-d7/a2-a5,-52(a6)
[00006c9e] 2d48 fff4                 move.l     a0,-12(a6)
[00006ca2] 2449                      movea.l    a1,a2
[00006ca4] 2400                      move.l     d0,d2
[00006ca6] 206e 0008                 movea.l    8(a6),a0
[00006caa] 4a90                      tst.l      (a0)
[00006cac] 6c14                      bge.s      $00006CC2
[00006cae] 4eb9 0000 0fcc            jsr        SYSTEM_$$_GET_PC_ADDR$$POINTER
[00006cb4] 2040                      movea.l    d0,a0
[00006cb6] 224e                      movea.l    a6,a1
[00006cb8] 7036                      moveq.l    #54,d0
[00006cba] 4600                      not.b      d0
[00006cbc] 4eb9 0000 843c            jsr        SYSTEM_$
$_HANDLEERRORADDRFRAMEIND$LONGINT$POINTER$POINTER
[00006cc2] 204a                      movea.l    a2,a0
[00006cc4] 5488                      addq.l     #2,a0
[00006cc6] 7000                      moveq.l    #0,d0
[00006cc8] 102a 0001                 move.b     1(a2),d0
[00006ccc] d1c0                      adda.l     d0,a0
[00006cce] 7203                      moveq.l    #3,d1
[00006cd0] 2008                      move.l     a0,d0
[00006cd2] d081                      add.l      d1,d0
[00006cd4] 2601                      move.l     d1,d3
[00006cd6] c6bc 0000 0004            and.l      #$00000004,d3
[00006cdc] 4a83                      tst.l      d3
[00006cde] 660a                      bne.s      $00006CEA
[00006ce0] 4681                      not.l      d1
[00006ce2] 2600                      move.l     d0,d3
[00006ce4] c681                      and.l      d1,d3
[00006ce6] 2243                      movea.l    d3,a1
[00006ce8] 600c                      bra.s      $00006CF6
[00006cea] 2200                      move.l     d0,d1
[00006cec] c2bc 0000 0003            and.l      #$00000003,d1
[00006cf2] 9081                      sub.l      d1,d0
[00006cf4] 2240                      movea.l    d0,a1
[00006cf6] 2629 0004                 move.l     4(a1),d3
[00006cfa] 2069 0008                 movea.l    8(a1),a0
[00006cfe] 2850                      movea.l    (a0),a4
[00006d00] 4aa9 0010                 tst.l      16(a1)
[00006d04] 6708                      beq.s      $00006D0E
[00006d06] 2069 0010                 movea.l    16(a1),a0
[00006d0a] 2650                      movea.l    (a0),a3
[00006d0c] 6002                      bra.s      $00006D10
[00006d0e] 97cb                      suba.l     a3,a3
[00006d10] 206e 0008                 movea.l    8(a6),a0
[00006d14] 2210                      move.l     (a0),d1
[00006d16] 2003                      move.l     d3,d0
[00006d18] 4eb9 0000 28ec            jsr        FPC_MUL_LONGINT
[00006d1e] 2800                      move.l     d0,d4
[00006d20] 5084                      addq.l     #8,d4
[00006d22] 7a00                      moveq.l    #0,d5
[00006d24] 206e fff4                 movea.l    -12(a6),a0
[00006d28] 4a90                      tst.l      (a0)
[00006d2a] 664a                      bne.s      $00006D76
[00006d2c] 206e 0008                 movea.l    8(a6),a0
[00006d30] 4a90                      tst.l      (a0)
[00006d32] 6700 0306                 beq        $0000703A
[00006d36] 2004                      move.l     d4,d0
[00006d38] 4eb9 0000 87a8            jsr        SYSTEM_$$_ALLOCMEM$LONGWORD$
$POINTER
[00006d3e] 2040                      movea.l    d0,a0
[00006d40] 2d48 fff8                 move.l     a0,-8(a6)
[00006d44] 200b                      move.l     a3,d0
[00006d46] 6728                      beq.s      $00006D70
[00006d48] 7000                      moveq.l    #0,d0
[00006d4a] 1014                      move.b     (a4),d0  <-- a4 contains zero 
at this point
[00006d4c] 0c80 0000 000d            cmpi.l     #$0000000D,d0
[00006d52] 6708                      beq.s      $00006D5C
[00006d54] 0c80 0000 0010            cmpi.l     #$00000010,d0
[00006d5a] 6614                      bne.s      $00006D70

(on Atari, accessing a NULL pointer will result in a bus-error, similar to a 
segfault on unix)

That code seems to correspond to
https://gitlab.com/freepascal.org/fpc/source/-/blob/main/rtl/inc/
dynarr.inc#L214 

where eletypemngd is checked, but then eletype is accessed. Could there 
something be wrong with the generated RTTI? That would also explain the 
spurious crashes i sometimes encounter on program exit.
And is there an easy way to verify the generated info?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freepascal.org/pipermail/fpc-devel/attachments/20220209/f1a2afda/attachment.htm>