Regression on powerpc: segfault on evaluating JS code

[barracuda156]

@bnoordhuis @saghul @bellard I will try to dig into this myself too, but if you got any idea, it would be very helpful.

Original ticket about the issue is here: andrjohns/QuickJSR#88
But the bug is in quickjs-ng itself, as it appears, not in its R port or my R build environment.

Specifically, this example fails both with 0.10.x and 0.9.0:

wget https://github.com/stan-dev/stanc3/releases/download/nightly/stanc.js
./qjs --include ./stanc.js 
qjs > stanc("model_name","data{}")

0.10.x crashes already on the first command:

Starting program: /opt/local/bin/qjs --include ./stanc.js
Reading symbols for shared libraries +++. done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x03000300
0x03000300 in ?? ()
(gdb) bt
#0  0x03000300 in ?? ()
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
#1  0x000228b8 in JS_RunGC ()
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
Cannot access memory at address 0x3000300
#2  0x00025200 in JS_NewObjectFromShape ()
Cannot access memory at address 0x3000300
#3  0x00026d5c in JS_NewArrayFrom ()
#4  0x00014b40 in JS_CallInternal ()
#5  0x0001494c in JS_CallInternal ()
#6  0x0001494c in JS_CallInternal ()
#7  0x0001494c in JS_CallInternal ()
#8  0x0001494c in JS_CallInternal ()
#9  0x0001494c in JS_CallInternal ()
#10 0x0001494c in JS_CallInternal ()
#11 0x00019660 in JS_CallFree ()
#12 0x0006d03c in __JS_EvalInternal ()
#13 0x00040224 in JS_EvalThis2 ()
#14 0x000402ac in JS_Eval ()
#15 0x00003468 in eval_buf ()
#16 0x00003500 in eval_file ()
#17 0x00079b18 in main ()

0.9.0 handles the first command, but segfaults on the second:

$ qjs --include ./stanc.js
QuickJS-ng - Type ".help" for help
qjs >  stanc("model_name","data{}")
Segmentation fault

For comparison, quickjs (non-ng one, 2025.04.05) works normally:

$ qjs --include ./stanc.js
QuickJS - Type "\h" for help
qjs > stanc("model_name","data{}")
{ result: "// Code generated by stanc v2.37.0-rc2-20-g216cb27\n#include <stan/model/m...", warnings: [  ] }
qjs > 

And a build from May:

--->  Activating quickjs-devel @20250520_0
Sergey-Fedorovs-Mac:~ svacchanda\$ qjs --include ./stanc.js
QuickJS - Type "\h" for help
qjs > stanc("model_name","data{}")
{ result: "// Code generated by stanc v2.37.0-rc2-20-g216cb27\n#include <stan/model/model_header.hpp>\nnamespace model_name_namespace {\nusing stan::model::model_base_crtp;\nusing namespace stan::math;\nstan::math::profile_map profiles__;\nstatic constexpr std::array<const char*, 1> locations_array__ =\n  {\" (found before start of program)\"};\nclass model_name final : public model_base_crtp<model_name> {\n private:\n  \n public:\n  ~model_name() {}\n  model_name(stan::io::var_context& context__, unsigned int\n             random_seed__ = 0, std::ostream* pstream__ = nullptr)\n      : model_base_crtp(0) {\n    int current_statement__ = 0;\n    // suppress unused var warning\n    (void) current_statement__;\n    using local_scalar_t__ = double;\n    auto base_rng__ = stan::services::util::create_rng(random_seed__, 0);\n    // suppress unused var warning\n    (void) base_rng__;\n    static constexpr const char* function__ =\n      \"model_name_namespace::model_name\";\n    // suppress unused var warning\n    (void) function__;"... 11809 more characters, warnings: [  ] }
qjs > 

[barracuda156]

The first crash is fixed in the PR. This is the second:

Starting program: /opt/local/bin/qjs --include ./stanc.js
Reading symbols for shared libraries +++. done
QuickJS-ng - Type ".help" for help
qjs > stanc("model_name","data{}")

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x062da041
lre_exec_backtrack (s=0xbfffa4d8, capture=0x267ab0, stack=0xbfffa4c0, stack_len=0, pc=0x62da042 <Address 0x62da042 out of bounds>, cptr=0x1040674 "result", no_recurse=false) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/libregexp.c:2071
2071            opcode = *pc++;
(gdb) bt
#0  lre_exec_backtrack (s=0xbfffa4d8, capture=0x267ab0, stack=0xbfffa4c0, stack_len=0, pc=0x62da042 <Address 0x62da042 out of bounds>, cptr=0x1040674 "result", no_recurse=false) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/libregexp.c:2071
#1  0x00010764 in lre_exec (capture=0x267ab0, bc_buf=0x2da034 "", cbuf=0x1040674 "result", cindex=0, clen=6, cbuf_type=0, opaque=0x2022d0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/libregexp.c:2510
#2  0x000a6058 in js_regexp_exec (ctx=0x2022d0, this_val=18446744069477889872, argc=1, argv=0xbfffb1a0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:45554
#3  0x000491ac in js_call_c_function (ctx=0x2022d0, func_obj=18446744069417380416, this_obj=18446744069477889872, argc=1, argv=0xbfffb1a0, flags=2) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16270
#4  0x00049b00 in JS_CallInternal (caller_ctx=0x2022d0, func_obj=18446744069417380416, this_obj=18446744069477889872, new_target=12884901888, argc=1, argv=0xbfffb1a0, flags=2) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16485
#5  0x00054dec in JS_CallFree (ctx=0x2022d0, func_obj=18446744069417380416, this_obj=18446744069477889872, argc=1, argv=0xbfffb1a0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:18948
#6  0x000a6e5c in JS_RegExpExec (ctx=0x2022d0, r=18446744069477889872, s=18446744043661821536) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:45817
#7  0x000a71bc in js_regexp_Symbol_match (ctx=0x2022d0, this_val=18446744069477889872, argc=1, argv=0xbfffbe08) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:45875
#8  0x000491ac in js_call_c_function (ctx=0x2022d0, func_obj=18446744069477890304, this_obj=18446744069477889872, argc=1, argv=0xbfffbe08, flags=2) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16270
#9  0x00049b00 in JS_CallInternal (caller_ctx=0x2022d0, func_obj=18446744069477890304, this_obj=18446744069477889872, new_target=12884901888, argc=1, argv=0xbfffbe08, flags=2) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16485
#10 0x00054dec in JS_CallFree (ctx=0x2022d0, func_obj=18446744069477890304, this_obj=18446744069477889872, argc=1, argv=0xbfffbe08) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:18948
#11 0x0009f484 in js_string_match (ctx=0x2022d0, this_val=18446744043661821536, argc=1, argv=0xbfffc9f0, atom=214) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:43545
#12 0x00049214 in js_call_c_function (ctx=0x2022d0, func_obj=18446744069477113520, this_obj=18446744043661821536, argc=1, argv=0xbfffc9f0, flags=0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16283
#13 0x00049b00 in JS_CallInternal (caller_ctx=0x2022d0, func_obj=18446744069477113520, this_obj=18446744043661821536, new_target=12884901888, argc=1, argv=0xbfffc9f0, flags=0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16485
#14 0x0004bbf0 in JS_CallInternal (caller_ctx=0x2022d0, func_obj=18446744069457735072, this_obj=12884901888, new_target=12884901888, argc=2, argv=0xbfffd4d8, flags=0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16903
#15 0x0004b8ec in JS_CallInternal (caller_ctx=0x2022d0, func_obj=18446744069457620384, this_obj=18446744069457620320, new_target=12884901888, argc=2, argv=0xbfffdef0, flags=0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16866
#16 0x0004bbf0 in JS_CallInternal (caller_ctx=0x2022d0, func_obj=18446744069473179584, this_obj=12884901888, new_target=12884901888, argc=1, argv=0xbfffe8f0, flags=0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16903
#17 0x0004b8ec in JS_CallInternal (caller_ctx=0x2022d0, func_obj=18446744069473224496, this_obj=12884901888, new_target=12884901888, argc=1, argv=0xbffff350, flags=2) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:16866
#18 0x00054d64 in JS_Call (ctx=0x2022d0, func_obj=18446744069473224496, this_obj=12884901888, argc=1, argv=0xbffff350) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:18941
#19 0x000b63c4 in promise_reaction_job (ctx=0x2022d0, argc=5, argv=0x23d064) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:50198
#20 0x000197b0 in JS_ExecutePendingJob (rt=0x200190, pctx=0xbffff434) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs.c:2008
#21 0x000e1b94 in js_std_loop (ctx=0x2022d0) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/quickjs-libc.c:4351
#22 0x00004330 in main (argc=3, argv=0xbffffb50) at /opt/local/var/macports/build/quicrPPK1p/work/quickjs-0.10.1/qjs.c:701

Any idea what causes it?

[barracuda156]

I give up on this for now, it is problematic to bisect, since the issue is old, at least 0.8.0 exhibits the same behavior, but 0.7.0 does not build at all.

It is probably issue with structs sizes, several of which differ between quickjs vs quickjs-ng, but there is no easy way to adjust those, it seems.

FWIW, rebuilding with -mone-byte-bool does not solve the second crash, but pc address differs in that case.

[past-due]

@barracuda156 Any chance these two members of struct JSToken are impacting things?

https://github.com/quickjs-ng/quickjs/blob/0191aea691e0ae37c35bc6737e73760506876148/quickjs.c#L20401-L20402

(Try changing them to int or similar?)

[barracuda156]

@past-due Thank you, I will try it once back to the hardware.

[bnoordhuis]

When I run it locally with tip of master on x86_64, I don't get a crash; I get this (coming from stanc.js itself, it catches and converts the stack overflow RangeError):

qjs > stanc("model_name","data{}")
{
  errors: [
    0,
    'Internal compiler error:\nStack overflow\n\n\nThis should never happen. Please fil...'
  ],
  warnings: []
}

We don't have ppc-specific code but maybe it's a stack limit thing? What happens when you pass --stack-size <n> to qjs and play around with different values of n? n is in kilobytes.

[barracuda156]

@bnoordhuis Unfortunately, stack-size does not seem to have impact here.

@past-due Changing those two bools either to int or to uint8_t breaks the binary (it crashes on launch itself, like originally).

[bnoordhuis]

What happens when you revert to commit 8bcc070? That's the commit preceding the stdbool change.

[barracuda156]

@bnoordhuis I will try.

Besides, looks like this second crash is unrelated to size of bool or bitness. I have just tried on ppc64 and got the same segfault (on ppc64 bool is standard).