HaxeFoundation / HaxeFoundation/hxcpp

Mixed @:generic may crash some usages

Open
#581 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
330
Forks
227
Avg merge
2d 16h
Merged PRs (30d)
18

Description

This code generates binary which is executable but crashes (Segmentation fault) on specific setup.

- Mac (Mountain Lion, Yosemite and Sierra confirmed)
- Haxe 3.4.2
- hxcpp 3.4.64

```haxe
package;

// this code crashes (Segmentation fault) cpp executable in some setups

class Test {
public static function main():Void trace(new ListOfOmapKey(new StdOmap()).first());
}

@:generic @:remove
class StdOmap implements IOmap {
public function new() return;
public function first():Null {
var v = null;
return v;
}
public function resolveName(v:V):Null return null;
}

class ListOfOmapKey implements IList {
private var omap:IOmap;
public function new(omap:IOmap) this.omap = omap;
public function first():Null {
var v = this.omap.first();
//trace(v);
return this.omap.resolveName(v);
}
}

interface IOmap
extends IList
extends IOmapRemove
{
function resolveName(v:V):Null;
}

interface IList
{
function first():Null;
}

interface IOmapRemove extends IList { }
```

(sorry I could't make it any shorter)

### Some research

In particular, generated file `StdOmap_Int_String.cpp` contains code below

```
static ::IOmapRemove_obj _hx_StdOmap_Int_String__hx_IOmapRemove= {
( ::Dynamic (hx::Object::*)())&::StdOmap_Int_String_obj::first_8b3ae2fb,
};

static ::IList_obj _hx_StdOmap_Int_String__hx_IList= {
( ::Dynamic (hx::Object::*)())&::StdOmap_Int_String_obj::first,
};

static ::IOmap_obj _hx_StdOmap_Int_String__hx_IOmap= {
( ::Dynamic (hx::Object::*)())&::StdOmap_Int_String_obj::first,
( ::Dynamic (hx::Object::*)( ::Dynamic))&::StdOmap_Int_String_obj::resolveName_dc94b8fa,
};

```

which seems to be invalid (I tried to replace two of `StdOmap_Int_String_obj::first` into `StdOmap_Int_String_obj::first_8b3ae2fb` and recompiled with `haxelib run hxcpp Build.xml`, which completed normally without SEGV)

### More research

According to my stepping with lldb, the `::Dynamic` local and `_hx_stackframe.ctx` appears to be corrupted.

```
$ haxe -debug -cpp bin/cpp -main Test; lldb bin/cpp/Test-debug
haxelib run hxcpp Build.xml haxe -Ddebug -Dhaxe3="1" -Dhaxe_ver="3.402" -Dhxcpp_api_level="331" -Dsource-header="Generated by Haxe 3.4.2" -I"/usr/lib/haxe/extraLibs/" -I"/usr/local/lib/haxe/extraLibs/" -I"" -I"/usr/lib/haxe/std/cpp/_std/" -I"/usr/share/haxe/std/cpp/_std/" -I"/usr/local/lib/haxe/std/cpp/_std/" -I"/usr/lib/haxe/std/" -I"/usr/share/haxe/std/" -I"/usr/local/lib/haxe/std/"
(lldb) target create "bin/cpp/Test-debug"
Current executable set to 'bin/cpp/Test-debug' (x86_64).
(lldb) b ListOfOmapKey_obj::first()
Breakpoint 1: where = Test-debug`ListOfOmapKey_obj::first() + 21 at ListOfOmapKey.cpp:56, address = 0x00000001000042d5
(lldb) r
Process 10870 launched: '/Users/kaikoga/Desktop/hx/bin/cpp/Test-debug' (x86_64)
Process 10870 stopped
* thread #1: tid = 0x5a6eb, 0x00000001000042d5 Test-debug`ListOfOmapKey_obj::first(this=0x0000000102001dec) + 21 at ListOfOmapKey.cpp:56, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
frame #0: 0x00000001000042d5 Test-debug`ListOfOmapKey_obj::first(this=0x0000000102001dec) + 21 at ListOfOmapKey.cpp:56
53 }
54
55 ::Dynamic ListOfOmapKey_obj::first(){
-> 56 HX_STACKFRAME(&_hx_pos_2509b7e536c5d112_22_first)
57 HXLINE( 23) ::Dynamic v = ::IList_obj::first(this->omap);
58 HXLINE( 25) return ::IOmap_obj::resolveName(this->omap,v);
59 }
(lldb) n
Process 10870 stopped
* thread #1: tid = 0x5a6eb, 0x00000001000042fb Test-debug`ListOfOmapKey_obj::first(this=0x0000000102001dec) + 59 at ListOfOmapKey.cpp:57, queue = 'com.apple.main-thread', stop reason = step over
frame #0: 0x00000001000042fb Test-debug`ListOfOmapKey_obj::first(this=0x0000000102001dec) + 59 at ListOfOmapKey.cpp:57
54
55 ::Dynamic ListOfOmapKey_obj::first(){
56 HX_STACKFRAME(&_hx_pos_2509b7e536c5d112_22_first)
-> 57 HXLINE( 23) ::Dynamic v = ::IList_obj::first(this->omap);
58 HXLINE( 25) return ::IOmap_obj::resolveName(this->omap,v);
59 }
60
(lldb) fr v
(ListOfOmapKey_obj *) this = 0x0000000102001dec
(hx::StackFrame) _hx_stackframe = {
ctx = 0x0000000100401cf0
position = 0x0000000100116940
lineNumber = 22
}
(Dynamic) v = {
hx::ObjectPtr = (mPtr = 0x00007fff5fbff6b0)
}
(lldb) n
Process 10870 stopped
* thread #1: tid = 0x5a6eb, 0x000000010000432d Test-debug`ListOfOmapKey_obj::first(this=0x0000000102001dec) + 109 at ListOfOmapKey.cpp:58, queue = 'com.apple.main-thread', stop reason = step over
frame #0: 0x000000010000432d Test-debug`ListOfOmapKey_obj::first(this=0x0000000102001dec) + 109 at ListOfOmapKey.cpp:58
55 ::Dynamic ListOfOmapKey_obj::first(){
56 HX_STACKFRAME(&_hx_pos_2509b7e536c5d112_22_first)
57 HXLINE( 23) ::Dynamic v = ::IList_obj::first(this->omap);
-> 58 HXLINE( 25) return ::IOmap_obj::resolveName(this->omap,v);
59 }
60
61
(lldb) fr v
(ListOfOmapKey_obj *) this = 0x0000000102001dec
(hx::StackFrame) _hx_stackframe = {
ctx = 0x0000000000000000
position = 0x0000000100116940
lineNumber = 23
}
(Dynamic) v = {
hx::ObjectPtr = (mPtr = 0x00007fff00000000)
}
(lldb) p &_hx_stackframe
(hx::StackFrame *) $1 = 0x00007fff5fbff610
(lldb) memory write -s 8 0x00007fff5fbff610 0x0000000100401cf0
(lldb) p &v
(Dynamic *) $2 = 0x00007fff5fbff608
(lldb) memory write -s 8 0x00007fff5fbff608 0
(lldb) c
Process 10870 resuming
Test.hx:6: null
Process 10870 exited with status = 0 (0x00000000)
(lldb)
```

### Notes

This issue is difficult to reproduce:

- Haxe must be latest
- only observed on Mac
- the `IOmapRemove` must exist with exact name
- `@:generic` and non-`@:generic` must be specified as-is

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.