Bug 13795 – DMD ICE segfault compiling druntime

Reduced from a segfault compiling runtime: void f() { T1!cfloat; } template T0(T) { void g(T v) { v = 0 + 0i; } } template T1(T) { void h() { if (T0!T) return; } } output when compiled: test3.d(18): Error: expression Floating!cfloat of type void does not have a boolean value test3.d(19): Error: return expression expected test3.d(3): Error: template instance test3.Array!cfloat error instantiating Segmentation fault: 11 Tested on OS X 10.10, dmd git HEAD

lldb output: Process 78905 stopped * thread #1: tid = 0x23835c, 0x000000010002e2bd dmd`ComplexExp::ComplexExp(Loc, complex_t, Type*) + 45, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) frame #0: 0x000000010002e2bd dmd`ComplexExp::ComplexExp(Loc, complex_t, Type*) + 45 dmd`ComplexExp::ComplexExp(Loc, complex_t, Type*) + 45: -> 0x10002e2bd: movaps %xmm1, 0x40(%rdi) 0x10002e2c1: movaps %xmm0, 0x30(%rdi) 0x10002e2c5: movq %rcx, 0x20(%rdi) 0x10002e2c9: popq %rbp (lldb) bt all * thread #1: tid = 0x23835c, 0x000000010002e2bd dmd`ComplexExp::ComplexExp(Loc, complex_t, Type*) + 45, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) * frame #0: 0x000000010002e2bd dmd`ComplexExp::ComplexExp(Loc, complex_t, Type*) + 45 frame #1: 0x0000000100015cbf dmd`Cast(Type*, Type*, Expression*) + 879 frame #2: 0x00000001000a02a4 dmd`Expression_optimize(Expression*, int, bool)::OptimizeVisitor::visit(CastExp*) + 964 frame #3: 0x000000010009f495 dmd`Expression_optimize(Expression*, int, bool)::OptimizeVisitor::visit(BinExp*) + 133 frame #4: 0x000000010009ee2a dmd`Expression_optimize(Expression*, int, bool) + 42 frame #5: 0x00000001000b845e dmd`ExpStatement::semantic(Scope*) + 94 frame #6: 0x00000001000b8efc dmd`CompoundStatement::semantic(Scope*) + 284 frame #7: 0x00000001000545d1 dmd`FuncDeclaration::semantic3(Scope*) + 3425 frame #8: 0x00000001000d7f84 dmd`TemplateInstance::semantic3(Scope*) + 276 frame #9: 0x00000001000d295f dmd`TemplateInstance::semantic(Scope*, Array<Expression*>*) + 2463 frame #10: 0x000000010003284a dmd`ScopeExp::semantic(Scope*) + 154 frame #11: 0x00000001000b8423 dmd`ExpStatement::semantic(Scope*) + 35 frame #12: 0x00000001000b8efc dmd`CompoundStatement::semantic(Scope*) + 284 frame #13: 0x00000001000545d1 dmd`FuncDeclaration::semantic3(Scope*) + 3425 frame #14: 0x000000010007c984 dmd`Module::semantic3() + 84 frame #15: 0x0000000100079f60 dmd`tryMain(unsigned long, char const**) + 10576 frame #16: 0x0000000100000e18 dmd`_start + 230 frame #17: 0x0000000100000d31 dmd`start + 33 (lldb) disas dmd`ComplexExp::ComplexExp(Loc, complex_t, Type*): 0x10002e290: pushq %rbp 0x10002e291: movq %rsp, %rbp 0x10002e294: movq %rsi, 0x8(%rdi) 0x10002e298: movq %rdx, 0x10(%rdi) 0x10002e29c: movl $0x98, 0x18(%rdi) 0x10002e2a3: movb $0x50, 0x28(%rdi) 0x10002e2a7: movb $0x0, 0x29(%rdi) 0x10002e2ab: leaq 0x1f4bee(%rip), %rax ; vtable for ComplexExp + 16 0x10002e2b2: movq %rax, (%rdi) 0x10002e2b5: movaps 0x10(%rbp), %xmm0 0x10002e2b9: movaps 0x20(%rbp), %xmm1 -> 0x10002e2bd: movaps %xmm1, 0x40(%rdi) 0x10002e2c1: movaps %xmm0, 0x30(%rdi) 0x10002e2c5: movq %rcx, 0x20(%rdi) 0x10002e2c9: popq %rbp 0x10002e2ca: retq 0x10002e2cb: nopl (%rax,%rax) (lldb) register read General Purpose Registers: rax = 0x0000000100222ea0 dmd`vtable for ComplexExp + 16 rbx = 0x00007fff5fbff388 rcx = 0x00000001005018d0 rdx = 0x0000000d0000000a rdi = 0x00007fff5fbff388 rsi = 0x0000000100405220 rbp = 0x00007fff5fbff180 rsp = 0x00007fff5fbff180 r8 = 0x0000000000000000 r9 = 0x0000000000000004 r10 = 0x0000000100600000 r11 = 0x0000000000000001 r12 = 0x00000001005018d0 r13 = 0x00000001005018d0 r14 = 0x00000001005018d0 r15 = 0x0000000100616100 rip = 0x000000010002e2bd dmd`ComplexExp::ComplexExp(Loc, complex_t, Type*) + 45 rflags = 0x0000000000010206 cs = 0x000000000000002b fs = 0x0000000000000000 gs = 0x0000000000000000

At least the segfault doesn't occur in Windows, with git HEAD (4c98263)

It only occurs when dmd is built with optimisations, with clang.

I'm also hitting this, same call stack. Was introduced with this commit to dmd https://github.com/D-Programming-Language/dmd/commit/262905e4419340e72ffb1514d38f94558a99c357 Looks like it's an unaligned access -> 0x10002e2bd: movaps %xmm1, 0x40(%rdi) %rdi = 0x00007fff5fbfd2e8 <--- movaps requires 16-byte align

Commits pushed to master at https://github.com/D-Programming-Language/dmd https://github.com/D-Programming-Language/dmd/commit/6f42e722534ec043f52e97f05783969612df8d7b Issue 13795 - Add longdouble to UnionExp to provide alignment https://github.com/D-Programming-Language/dmd/commit/c23d48280f4ebe1b64ec06bc3789c2b2763e0134 Merge pull request #4207 from Poita/Issue13795 Issue 13795 - Add longdouble to UnionExp to provide alignment

Commits pushed to 2.067 at https://github.com/D-Programming-Language/dmd https://github.com/D-Programming-Language/dmd/commit/6f42e722534ec043f52e97f05783969612df8d7b Issue 13795 - Add longdouble to UnionExp to provide alignment https://github.com/D-Programming-Language/dmd/commit/c23d48280f4ebe1b64ec06bc3789c2b2763e0134 Merge pull request #4207 from Poita/Issue13795