Bug 15367

Summary: webkitgtk faults in qemu user mode generating gir data with qemu 8.2.0
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Richard Purdie <richard.purdie>
Component: devtools / tool chainAssignee: Pavel Zhukov <pavel>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium+ CC: alexandre.belloni, meta.mr.watcher, meta.watcher, pavel, randy.macleod
Version: 0.0.0   
Target Milestone: 5.1   
Hardware: x86   
OS: Multiple   
Whiteboard: AB-INT
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Richard Purdie 2024-01-25 14:44:01 UTC
After upgrading to qemu 8.2.0 we're seeing segfaults in webkitgtk on debian11 workers:

https://autobuilder.yoctoproject.org/typhoon/#/builders/117/builds/4284

https://autobuilder.yoctoproject.org/typhoon/#/builders/40/builds/8488

I've tried using the staging 8.2 branch (commit 5e4e438f9d602f8089e88252e58c523d77947ee1) and master (4a4efae44f19528589204581e9e2fab69c5d39aa) and those both SEGV. Switching back to staging-8.1 (72694a69c98723f51a0b4ab8113ab0362029c753) allows webkitgtk to build, confirming the issue is directly from qemu-native.
Comment 1 Randy MacLeod 2024-01-25 15:45:25 UTC
Next step is to bisect to find the error.
Comment 2 Richard Purdie 2024-01-25 19:36:46 UTC
It bisects to:

7b7a3366e142d3baeb3fd1d3660a50e7956c19eb is the first bad commit
commit 7b7a3366e142d3baeb3fd1d3660a50e7956c19eb
Author: Richard Henderson <richard.henderson@linaro.org>
Date:   Tue Aug 8 20:02:19 2023 -0700

    linux-user: Use walk_memory_regions for open_self_maps
    
    Replace the by-hand method of region identification with
    the official user-exec interface.  Cross-check the region
    provided to the callback with the interval tree from
    read_self_maps().
    
    Tested-by: Helge Deller <deller@gmx.de>
    Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
    Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

 linux-user/syscall.c | 190 ++++++++++++++++++++++++++++++---------------------
 1 file changed, 114 insertions(+), 76 deletions(-)

with the error:

ERROR:../git/accel/tcg/cpu-exec.c:532:cpu_exec_longjmp_cleanup: assertion failed: (cpu == current_cpu)
Bail out! ERROR:../git/accel/tcg/cpu-exec.c:532:cpu_exec_longjmp_cleanup: assertion failed: (cpu == current_cpu)


which changes in:

7dfd3ca8d95f9962cdd2ebdfcdd699279b98fa18 is the first bad commit
commit 7dfd3ca8d95f9962cdd2ebdfcdd699279b98fa18
Author: Helge Deller <deller@gmx.de>
Date:   Sat Aug 12 18:43:14 2023 +0200

    linux-user: Detect and report host crashes
    
    If there is an internal program error in the qemu source code which
    raises SIGSEGV or SIGBUS, we currently assume the signal belongs to
    the guest.  With an artificial error introduced, we will now print
    
       QEMU internal SIGSEGV {code=MAPERR, addr=(nil)}
    
    Signed-off-by: Helge Deller <deller@gmx.de>
    Message-Id: <20230812164314.352131-1-deller@gmx.de>
    [rth: Use in_code_gen_buffer and die_with_signal; drop backtrace]
    Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

 linux-user/signal.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 63 insertions(+), 6 deletions(-)

to the SIGSEGV.
Comment 5 Richard Purdie 2024-02-05 11:01:29 UTC
qemu upstream would like a reproducer: https://www.mail-archive.com/qemu-devel@nongnu.org/msg1020874.html
Comment 6 Randy MacLeod 2024-02-08 16:03:59 UTC
Pavel, Do you have update on this HIGH bug that Richard said you were working on?