[Issue 18717] Segfault in BitManip

[d-bugmail at puremagic.com]

https://issues.dlang.org/show_bug.cgi?id=18717

ag0aep6g <ag0aep6g at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ag0aep6g at gmail.com

--- Comment #2 from ag0aep6g <ag0aep6g at gmail.com> ---
(In reply to Cédric Picard from comment #0)
> │           0x5558709cde70      0fa33e         bt dword [rsi], edi          
> 
> 
> At that point we have:
> rsi = 0x7f40163e2010   -> our BitArray
> rdi = 0x97174d8b       -> "evilVal"

This is a codegen bug. It should be rdi in the bt instruction, not edi.

It's hard to find information on this, but this page says that the bt
instruction interprets the offset as signed:
<http://faydoc.tripod.com/cpu/bt.htm>. So rdi = 0x97174d8b becomes edi =
-1760080501. That's not intended, of course.

I've filed a new issue for the dmd bug: issue 18730. When that one gets fixed,
this one can be closed as a duplicate. Or thise one can be fixed by working
around the dmd bug in the BitArray code.

> A look at /proc/*/maps shows that the call falls into that section:
> 
> 0x00007f40163e2000 # 0x00007f4032928000 - usr 453.3M s -rw- unk1 unk1
> 
> IIUC this is what was allocated for our BitArray. However this isn't enough
> as 0x00007f4032928000 - 0x00007f40163e2000 < 2534886795.

You're comparing bytes to bits there. 2534886795 is the number of bits in the
array. That means, it needs ceil(2534886795 / 8) = 316860850 bytes. And that's
less than 0x00007f4032928000 - 0x00007f40163e2000.

--