UBSAN SIGSEGV when calling a JIT compiled pipeline (Clang 17+)

[judicaelclair]

UBSAN SIGSEGV when calling a JIT compiled pipeline (Clang 17+)

[kobalicek]

I'm not sure how I can potentially verify whether it's not some weird clang issue or whether Blend2D does something wrong. Because this exact example runs regularly on our CI with ASAN as well. Are you sure it's not a clang issue?

[kobalicek]

@judicaelclair Could you test the current master and report if you are getting any issues?

I'm using clang-16 with ASAN and all works great.

[judicaelclair]

Sorry for the late response. I've just tried it again with latest master with Clang-18. ASAN seems to work now, but UBSAN is causing me issues now at the same location. I think the previous ASAN issue might have been hiding the UBSAN issue as when I opened this issue I was testing both UBSAN and ASAN together. Here's the UBSAN error I'm getting:

blend2d/src/blend2d/raster/rastercontext.cpp:2641:87: runtime error: downcast of misaligned address 0x55d3b932be28 for type 'RenderFetchData', which requires 16 byte alignment
0x55d3b932be28: note: pointer points here
 d3 55 00 00  00 00 00 00 00 00 00 00  00 00 00 00 04 00 00 00  00 00 00 ff 00 00 00 00  00 00 00 ff
              ^ 
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior blend2d/src/blend2d/raster/rastercontext.cpp:2641:87 in 
blend2d/src/blend2d/raster/rastercontext.cpp:2641:132: runtime error: member access within misaligned address 0x55d3b932be28 for type 'RenderFetchData', which requires 16 byte alignment
0x55d3b932be28: note: pointer points here
 d3 55 00 00  00 00 00 00 00 00 00 00  00 00 00 00 04 00 00 00  00 00 00 ff 00 00 00 00  00 00 00 ff
              ^ 
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior blend2d/src/blend2d/raster/rastercontext.cpp:2641:132 in 
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==37621==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x7fa8e2bdfff8 (pc 0x7fa8e6a7f615 bp 0x7ffefd6c5380 sp 0x7ffefd6c5130 T37621)
==37621==The signal is caused by a READ memory access.
    #0 0x7fa8e6a7f615 in BLRasterEngine::CommandProcSync::fillBoxA(BLRasterEngine::WorkData&, BLPipeline::DispatchData const&, unsigned int, BLBoxI const&, void const*) blend2d/src/blend2d/raster/../raster/rendercommandprocsync_p.h:36:5
    #1 0x7fa8e6a7f615 in unsigned int BLRasterEngine::fillClippedBoxA<(BLRasterEngine::RenderingMode)0>(BLRasterContextImpl*, BLRasterEngine::DispatchInfo, BLRasterEngine::DispatchStyle, BLBoxI const&) blend2d/src/blend2d/raster/rastercontext.cpp:2641:10
    #2 0x7fa8e6a7f615 in unsigned int BLRasterEngine::fillAll<(BLRasterEngine::RenderingMode)0>(BLRasterContextImpl*, BLRasterEngine::DispatchInfo, BLRasterEngine::DispatchStyle) blend2d/src/blend2d/raster/rastercontext.cpp:2715:7
    #3 0x7fa8e6a56904 in unsigned int BLRasterEngine::fillAllImpl<(BLRasterEngine::RenderingMode)0>(BLContextImpl*) blend2d/src/blend2d/raster/rastercontext.cpp:3343:10

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV blend2d/src/blend2d/raster/../raster/rendercommandprocsync_p.h:36:5 in BLRasterEngine::CommandProcSync::fillBoxA(BLRasterEngine::WorkData&, BLPipeline::DispatchData const&, unsigned int, BLBoxI const&, void const*)

I've also made sure to compile asmjit with the sanitiser, but still same issue.

[kobalicek]

Thanks for verifying with UBSAN. I can indeed confirm the issue, although it's pretty harmless (the 16-byte aligned pointer is only used by non-solid fills).

It should be fixed by 480cf05 - let me know if you have any other issues

[judicaelclair]

That's just turned the issue into a read error unfortunately:

UndefinedBehaviorSanitizer:DEADLYSIGNAL
==730775==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x7f0491516ff8 (pc 0x7f04954dee57 bp 0x000000004111 sp 0x7ffd00e00e60 T730775)
==730775==The signal is caused by a READ memory access.
    #0 0x7f04954dee57 in BLRasterEngine::CommandProcSync::fillBoxA(BLRasterEngine::WorkData&, BLPipeline::DispatchData const&, unsigned int, BLBoxI const&, void const*) blend2d/src/blend2d/raster/../raster/rendercommandprocsync_p.h:36:5
    #1 0x7f04954dee57 in unsigned int BLRasterEngine::fillClippedBoxA<(BLRasterEngine::RenderingMode)0>(BLRasterContextImpl*, BLRasterEngine::DispatchInfo, BLRasterEngine::DispatchStyle, BLBoxI const&) blend2d/src/blend2d/raster/rastercontext.cpp:2641:10
    #2 0x7f04954dee57 in unsigned int BLRasterEngine::fillAll<(BLRasterEngine::RenderingMode)0>(BLRasterContextImpl*, BLRasterEngine::DispatchInfo, BLRasterEngine::DispatchStyle) blend2d/src/blend2d/raster/rastercontext.cpp:2715:7

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV blend2d/src/blend2d/raster/../raster/rendercommandprocsync_p.h:36:5 in BLRasterEngine::CommandProcSync::fillBoxA(BLRasterEngine::WorkData&, BLPipeline::DispatchData const&, unsigned int, BLBoxI const&, void const*)

And in some cases alongside this error I get: Caught signal 11 (Segmentation fault: address not mapped to object at address 0x7f2948311ff8)

[kobalicek]

I tried, but I cannot repro this error with any sanitizer.

Can you paste here the code that triggers the problem, and the compiler as well?

I'm currently using Debian clang version 16.0.6 (11) and it all works with ASAN, UBSAN, and valgrind - I have no issues like these.

[judicaelclair]

Exact same code as OP but with a more recent compiler:

Ubuntu clang version 18.0.0 (++20230827042310+1c4c9e8e7029-1~exp1~20230827042445.1148)
Target: x86_64-pc-linux-gnu
Thread model: posix

Running on: Ubuntu 22.04.3 LTS

The Caught signal 11 might be a side effect of the app being uncleanly killed by UBSAN as I only get that when running a non-trivial app. That being said, the DEADLYSIGNAL error should happen every single time ctx.fillAll() is called (e.g. with the trivial example in OP).

[kobalicek]

@judicaelclair

I have compiled clang from git and filled the following issue:

• llvm/llvm-project#65253

Let's wait for the feedback from llvm developers, maybe there is a regression in UBSAN.

[kobalicek]

@judicaelclair AsmJit has added a workaround to help LLVM's UBSAN to not crash. Updating asmjit is required in this case.

[judicaelclair]

Seems to be fixed now, thanks. Closing the issue.