Assertion in Zax/STARS
When running zafl.sh a.ncexe ./xxx
(see attached binary), I'm getting intermittent assertion failures in STARS. While duplication has been challenging, this binary seems to cause the issue pretty often. Enough that I could duplicate the issue in gdb and get a backtrace of the problem and problematic instruction:
(gdb) bt[a.ncexe](/uploads/823cde770f9b70beb48636c85531e7c7/a.ncexe)
#0 0x00007fc5adae2f90 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fc5ac8118d2 in SMPInstr::SyncRTLDefUse (this=0x55a6e14d68c0, CurrRT=0x55a6e14d6bd0, UseFP=false, FPDelta=0) at SMPStaticAnalyzer/src/base/SMPInstr.cpp:27110
#2 0x00007fc5ac81176f in SMPInstr::SyncAllRTs (this=0x55a6e14d68c0, UseFP=false, FPDelta=0) at SMPStaticAnalyzer/src/base/SMPInstr.cpp:27081
u#3 0x00007fc5ac6dcc1a in SMPFunction::AdvancedAnalysis (this=0x55a6e133b900) at SMPStaticAnalyzer/src/base/SMPFunction.cpp:5473
p#4 0x00007fc5ac81947c in SMPProgram::Analyze (this=0x55a6dea04050, pi=0x55a6ddbf9020, AnnotFile=0x55a6dea03c40, InfoAnnotFile=0x55a6dea03880) at SMPStaticAnalyzer/src/base/SMPProgram.cpp:501
#5 0x00007fc5ac8a63a6 in STARS::IRDB_Interface_t::do_STARS (this=0x55a6df166938, firp=0x55a6ddb19b20) at SMPStaticAnalyzer/src/drivers/library/stars_irdb.cpp:194
#6 0x00007fc5adf15d74 in libIRDB::StarsDeepAnalysis_t::StarsDeepAnalysis_t (this=0x55a6df166920, firp=0x55a6ddb19b20, options=std::vector of length 0, capacity 0) at irdb-libs/libIRDB-deep/src/deep.cpp:30
#7 0x00007fc5adf17301 in IRDB_SDK::DeepAnalysis_t::factory (firp=0x55a6ddb19b20, ae=@0x7fffdda28aa0: IRDB_SDK::aeSTARS, options=std::vector of length 0, capacity 0) at irdb-libs/libIRDB-deep/src/deep.cpp:195
#8 0x000055a6dc6064eb in Zafl::ZaxBase_t::ZaxBase_t (this=0x55a6de9f25a0, p_dbinterface=..., p_variantIR=0x55a6ddb19b20, p_forkServerEntryPoint="0x5ca0", p_exitPoints=std::set with 0 elements, p_use_stars=true, p_autozafl=false)
at tools/zax/zax_base.cpp:136
#9 0x000055a6dc5fd3c0 in Zafl::Zax_t::Zax_t (this=0x55a6de9f25a0, p_dbinterface=..., p_variantIR=0x55a6ddb19b20, p_forkServerEntryPoint="0x5ca0", p_exitPoints=std::set with 0 elements, p_use_stars=true, p_autozafl=false) at tools/zax/zax.cpp:46
#10 0x000055a6dc61b773 in main (argc=6, argv=0x7fffdda292c8) at tools/zax/zax_driver.cpp:317
(gdb) up
#1 0x00007fc5ac8118d2 in SMPInstr::SyncRTLDefUse (this=0x55a6e14d68c0, CurrRT=0x55a6e14d6bd0, UseFP=false, FPDelta=0) at SMPStaticAnalyzer/src/base/SMPInstr.cpp:27110
27110 assert(! LeftOp->IsImmedOp());
(gdb) p this->Dump()
bdfc 6 SMPitype: 0 SPOffset: 0 palignr xmm3, xmm2, 1
USEs: Operand: immed 1
Operand: XMMReg reg: 66 SSANum: -1
Operand: XMMReg reg: 67 SSANum: -1
DEFs: Operand: immed 1
RTL: Operand: immed 1 SMP_ASSIGN Operand: XMMReg reg: 66 SMP_REVERSE_SHIFT_U Operand: immed 1 SMP_CONCATENATE Operand: XMMReg reg: 67
DEFMemOp:
USEMemOp:
booleans1: 3 booleans2: 0 booleans3: 192 booleans4: 0 booleans5: 0
Flow type: DEFAULT
$1 = void
(gdb)
Notes:
- This binary comes from the GT benchmark suite and is: res20-anope.icx.O2.pie.strip.elf.gz
- The faulting instruction is
palignr xmm3, xmm2, 1
and the fault is that "LeftOp->IsImmed()". As a rare, 3-op instruction in x86, I think it's probably an obvious fix. - keep track of hours for AIS. AIS hours are limited. @jwd or @an7s will need to give limits.
May be related: #32 (closed)
Edited by Jason Hiser