Bug 9677 – Crash on setting length property of array VC 2012 64 bit

Exception code: 0xc0000005 Fault offset: 0x0000000000002112 Compiles, but crashes. Sample: // dmd -m64 sample.d int main(string[] args) { int[] a; a.length = 10; return 0; } Win 8 Pro 64 bit Dmd 2.062 Visual Studio 2012 Express for Windows Desktop; Update 2 CTP (Update 1)

This is actually a codegen bug that just happens to be exposed by TLS memory being in memory above 4GB with VS2012. Reduced test case: /////////////////////// 8< ////////// module lifetime; int *__blkcache_storage; size_t __nextBlkIdx; /** * Resize dynamic arrays with 0 initializers. */ void _d_arraysetlengthT(size_t newlength) { asm { mov RAX, newlength; } auto cache = __blkcache_storage; int *curpos = cache + __nextBlkIdx; *curpos = 0; } /////////////////////// >8 ////////// "dmd -c -O -m64 lifetime.d" creates this code: _D8lifetime18_d_arraysetlengthTFmZv: 0000000000000000: 55 push rbp 0000000000000001: 48 8B EC mov rbp,rsp 0000000000000004: 48 83 EC 10 sub rsp,10h 0000000000000008: 53 push rbx 0000000000000009: 48 89 4D 10 mov qword ptr [rbp+10h],rcx 000000000000000D: 48 8B 45 10 mov rax,qword ptr [rbp+10h] 0000000000000011: 8B 05 00 00 00 00 mov eax,dword ptr [_tls_index] 0000000000000017: 65 48 8B 14 25 58 mov rdx,qword ptr gs:[58h] 00 00 00 0000000000000020: 48 8D 04 C2 lea eax,[rdx+rax*8] 0000000000000024: 48 8B 10 mov rdx,qword ptr [rax] 0000000000000027: BB 00 00 00 00 mov ebx,offset _D8lifetime18__blkcache_storagePi 000000000000002C: 48 8B 14 1A mov rdx,qword ptr [rdx+rbx] 0000000000000030: 48 89 55 F8 mov qword ptr [rbp-8],rdx 0000000000000034: 48 8B 00 mov rax,qword ptr [rax] 0000000000000037: BA 00 00 00 00 mov edx,offset _D8lifetime12__nextBlkIdxm 000000000000003C: 48 8B 04 10 mov rax,qword ptr [rax+rdx] 0000000000000040: 48 8B 55 F8 mov rdx,qword ptr [rbp-8] 0000000000000044: 48 8D 04 82 lea rax,[rdx+rax*4] 0000000000000048: 48 89 45 F0 mov qword ptr [rbp-10h],rax 000000000000004C: 48 8B 45 F0 mov rax,qword ptr [rbp-10h] 0000000000000050: C7 00 00 00 00 00 mov dword ptr [rax],0 0000000000000056: 5B pop rbx 0000000000000057: 48 8D 65 00 lea rsp,[rbp] 000000000000005B: 5D pop rbp 000000000000005C: C3 ret Note the "eax" assignment at offset 0x20, it should be rax.

*** Issue 9678 has been marked as a duplicate of this issue. ***

Arg, I modified the disassembly after trying the fix, so please don't be confused by the generated code bytes, the original code did not have the 0x48 prefix: 0000000000000020: 8D 04 C2 lea eax,[rdx+rax*8]

Github pull requests are usually marked as pull, not patch.

Commit pushed to master at https://github.com/D-Programming-Language/dmd https://github.com/D-Programming-Language/dmd/commit/a90fa90bf975cf5db5f1f490735692abafc9be92 Merge pull request #1733 from rainers/tls_array_pvoid fix issue 9677: Crash on setting length property of array 64 bit

Commit pushed to 2.062 at https://github.com/D-Programming-Language/dmd https://github.com/D-Programming-Language/dmd/commit/e7489b375a3cf80179ab678ccdea2d1a0a6491d7 Merge pull request #1733 from rainers/tls_array_pvoid fix issue 9677: Crash on setting length property of array 64 bit

Commit pushed to dmd-1.x at https://github.com/D-Programming-Language/dmd https://github.com/D-Programming-Language/dmd/commit/73162f3008cbe2842c32f9e6ac9bdb0a0c155bf2 Merge pull request #1733 from rainers/tls_array_pvoid fix issue 9677: Crash on setting length property of array 64 bit