[Qemu-devel] [Bug 932487] Re: win32: git rev 59f971d crashes when accessing disk (coroutine issue)

[Stefan Weil]

The crash is caused by non-working thread local storage (TLS) in
coroutine-win32.c.

It took me some time to analyze this bug because I don't get it in my native 
w32 environment with gcc-4.6.2,
but I could reproduce it with cross compiled w32 code.  SwitchToFiber crashed 
because it was called with a 
TIB (http://en.wikipedia.org/wiki/Win32_Thread_Information_Block) which 
belonged to a thread which was
not converted to a fiber. ConvertThreadToFiber was not called for this thread 
because TLS "current" was
not thread local.

Please try these modified configure option which adds the compiler flag needed 
for multithreading:
--extra-cflags="-O0 -pipe -mthreads". For me, -mthreads solved the problem.

Regards,
Stefan Weil

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/932487

Title:
  win32: git rev 59f971d crashes when accessing disk (coroutine issue)

Status in QEMU:
  Confirmed

Bug description:
  Host: XP SP3 / Vista SP2

  configure commandline: ./configure --target-list="i386-softmmu"
  --audio-drv-list=sdl --audio-card-list=ac97,sb16,adlib --disable-
  linux-aio --disable-vnc-thread --disable-vnc-jpeg --extra-cflags="-O0
  -pipe"

  gcc -v:
  Using built-in specs.
  Target: mingw32
  Configured with: ../gcc-4.3.3/configure --prefix=/mingw --build=mingw32 
--enable-languages=c,ada,c++,fortran,objc,obj-c++ 
--with-bugurl=http://www.tdragon.net/recentgcc/bugs.php --disable-nls 
--disable-win32-registry --enable-libgomp --disable-werror --enable-threads 
--disable-symvers --enable-cxx-flags='-fno-function-sections 
-fno-data-sections' --enable-fully-dynamic-string 
--enable-version-specific-runtime-libs --enable-sjlj-exceptions 
--with-pkgversion='4.3.3-tdm-1 mingw32'
  Thread model: win32
  gcc version 4.3.3 (4.3.3-tdm-1 mingw32)

  gdb output:
  C:\msys\home\User\qemu\i386-softmmu>gdb --args qemu-system-i386.exe -L 
..\pc-bios -hda xp.vmdk
  GNU gdb (GDB) 7.3
  Copyright (C) 2011 Free Software Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
  This is free software: you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
  and "show warranty" for details.
  This GDB was configured as "mingw32".
  For bug reporting instructions, please see:
  <http://www.gnu.org/software/gdb/bugs/>...
  Reading symbols from 
C:\msys\home\User\qemu\i386-softmmu/qemu-system-i386.exe...
  done.
  (gdb) r
  Starting program: C:\msys\home\User\qemu\i386-softmmu/qemu-system-i386.exe -L 
..\\pc-bios -hda xp.vmdk
  [New Thread 2472.0x8e0]
  [New Thread 2472.0xdc4]
  [New Thread 2472.0x8f0]

  Program received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 2472.0x8f0]
  0x7c81071e in SwitchToFiber () from C:\WINDOWS\system32\kernel32.dll
  (gdb) bt
  #0  0x7c81071e in SwitchToFiber () from C:\WINDOWS\system32\kernel32.dll
  #1  0x0044774c in qemu_coroutine_switch (from_=0x19593fc, to_=0xdcee9a8,
      action=COROUTINE_YIELD) at coroutine-win32.c:48
  #2  0x004db18d in coroutine_swap (from=0x1e00, to=0xdcee9a8)
      at qemu-coroutine.c:31
  #3  0x00411618 in bdrv_rw_co (bs=<optimized out>, sector_num=<optimized out>,
      buf=0x2140000 "@", nb_sectors=1, is_write=false) at block.c:1335
  #4  0x00486e39 in ide_sector_read (s=0x1bbdaa0)
      at C:/msys/home/User/qemu/hw/ide/core.c:480
  #5  0x0054e71f in memory_region_iorange_write (iorange=0x1bbcf60, offset=7,
      width=1, data=32) at C:/msys/home/User/qemu/memory.c:431
  #6  0x005494e0 in ioport_writeb_thunk (opaque=0x1bbcf60, addr=7680, data=32)
      at C:/msys/home/User/qemu/ioport.c:211
  #7  0x005496cf in ioport_write (data=<optimized out>,
      address=<optimized out>, index=<optimized out>)
      at C:/msys/home/User/qemu/ioport.c:82
  #8  cpu_outb (addr=2147340288, val=0 '\000')
      at C:/msys/home/User/qemu/ioport.c:274
  #9  0x022c0397 in ?? ()
  Backtrace stopped: previous frame inner to this frame (corrupt stack?)

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/932487/+subscriptions