SIGBUS: access to undefined memory

[enigma]

TL;DR: On Mac PProfProfiler sometimes does bad memory access.
From running with --profile=dev it seems to crash in profiler.rs#L312:

thread 'main' panicked at 'misaligned pointer dereference: address must be a multiple of 0x10 but is 0x16d7bbf58', /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pprof-0.11.1/src/profiler.rs:312:36

It's deterministic on my machine, but I can't guarantee on others. You can find the commands and failures below, and the files to repro at the bottom.

PProfProfiler only crashes when running with --profile-time, but flamegraph are only available when using --profile-time.

---

$ cargo bench --bench benches -- --profile-time 1 
    Finished bench [optimized] target(s) in 0.06s
     Running benches/benches.rs (target/release/deps/benches-762c4f26ad7490aa)
Benchmarking subject 0: Complete (Analysis Disabled)

Benchmarking subject 100: Profiling for 1.0000 serror: bench failed, to rerun pass `--bench benches`

Caused by:
  process didn't exit successfully: `/Users/ndr/coding/repro-bug/repro-pprof-bug/target/release/deps/benches-762c4f26ad7490aa --profile-time 1 --bench` (signal: 10, SIGBUS: access to undefined memory)

Running with --profile=dev reveals more details:

cargo bench --profile=dev --bench benches -- --profile-time=1
    Finished dev [unoptimized + debuginfo] target(s) in 0.06s
     Running benches/benches.rs (target/debug/deps/benches-65ad6c461a64cfec)
Benchmarking subject 0: Profiling for 1.0000 sthread 'main' panicked at 'misaligned pointer dereference: address must be a multiple of 0x10 but is 0x16d7bbf58', /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pprof-0.11.1/src/profiler.rs:312:36
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread 'main' panicked at 'panic in a function that cannot unwind', library/core/src/panicking.rs:126:5
stack backtrace:
   0:        0x102c8555c - std::backtrace_rs::backtrace::libunwind::trace::h41efc44bd5f6eac0
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:        0x102c8555c - std::backtrace_rs::backtrace::trace_unsynchronized::hb92d48f8ba27d408
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:        0x102c8555c - std::sys_common::backtrace::_print_fmt::h2a6adcda7490c452
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/sys_common/backtrace.rs:65:5
   3:        0x102c8555c - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h2e4b316da8d1b868
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/sys_common/backtrace.rs:44:22
   4:        0x102ca226c - core::fmt::write::hee60b630fddd701c
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/core/src/fmt/mod.rs:1247:17
   5:        0x102c81a14 - std::io::Write::write_fmt::h7829782ffee0a74a
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/io/mod.rs:1712:15
   6:        0x102c853bc - std::sys_common::backtrace::_print::h3cd3898b3f08d275
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/sys_common/backtrace.rs:47:5
   7:        0x102c853bc - std::sys_common::backtrace::print::h69a078fe21ab83fc
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/sys_common/backtrace.rs:34:9
   8:        0x102c868d4 - std::panicking::default_hook::{{closure}}::h5166913d03826b1e
   9:        0x102c866d8 - std::panicking::default_hook::h4211b85bce80d367
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:288:9
  10:        0x102c86cfc - std::panicking::rust_panic_with_hook::h4c1dd5e7fe26462e
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:691:13
  11:        0x102c86bf0 - std::panicking::begin_panic_handler::{{closure}}::h0964cad812c6bc09
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:580:13
  12:        0x102c85958 - std::sys_common::backtrace::__rust_end_short_backtrace::h18678632515b788f
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/sys_common/backtrace.rs:150:18
  13:        0x102c869c4 - rust_begin_unwind
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:578:5
  14:        0x102cc32d4 - core::panicking::panic_nounwind_fmt::h5dd08d2ace36795d
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/core/src/panicking.rs:96:14
  15:        0x102cc3350 - core::panicking::panic_nounwind::h90ae1e15b4f0a689
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/core/src/panicking.rs:126:5
  16:        0x102cc3444 - core::panicking::panic_cannot_unwind::he1b64df5624328ec
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/core/src/panicking.rs:188:5
  17:        0x10267c220 - perf_signal_handler
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pprof-0.11.1/src/profiler.rs:275:1
  18:        0x1a4b5aa84 - __platform_memmove
  19:        0x102647b38 - benches::bench_fn::{{closure}}::{{closure}}::h193b051e02bebb19
                               at /Users/ndr/coding/repro-bug/repro-pprof-bug/benches/benches.rs:9:47
  20:        0x102650c6c - criterion::bencher::Bencher<M>::iter::h28fbad8c0d9bb590
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/bencher.rs:88:23
  21:        0x102647ac4 - benches::bench_fn::{{closure}}::h37de55d6ae62833e
                               at /Users/ndr/coding/repro-bug/repro-pprof-bug/benches/benches.rs:9:37
  22:        0x102657d0c - criterion::benchmark_group::BenchmarkGroup<M>::bench_function::{{closure}}::h235692c07002a9e7
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/benchmark_group.rs:254:60
  23:        0x10264f634 - <criterion::routine::Function<M,F,T> as criterion::routine::Routine<M,T>>::warm_up::hb22784ffc643472f
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/routine.rs:270:13
  24:        0x102650830 - criterion::routine::Routine::profile::h86dbdce17036b487
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/routine.rs:60:38
  25:        0x102658348 - criterion::benchmark_group::BenchmarkGroup<M>::run_bench::h9b551ed45b366e66
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/benchmark_group.rs:346:21
  26:        0x102657cc8 - criterion::benchmark_group::BenchmarkGroup<M>::bench_function::h2c5aa19d14838acf
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/benchmark_group.rs:254:9
  27:        0x102646b80 - criterion::Criterion<M>::bench_function::h524291c831cd6a4d
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/lib.rs:1149:9
  28:        0x102660980 - benches::bench_fn::h67802e46129c7db1
                               at /Users/ndr/coding/repro-bug/repro-pprof-bug/benches/benches.rs:9:9
  29:        0x102660a44 - benches::benches::h2a0e19095db0aaed
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/macros.rs:71:17
  30:        0x102660aa8 - benches::main::hded1264c1fbbfac0
                               at /Users/ndr/.cargo/registry/src/index.crates.io-6f17d22bba15001f/criterion-0.4.0/src/macros.rs:124:17
  31:        0x10264d6ec - core::ops::function::FnOnce::call_once::h36a7982ca268cde8
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/core/src/ops/function.rs:250:5
  32:        0x10265af24 - std::sys_common::backtrace::__rust_begin_short_backtrace::haa56d44240dc12d1
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/sys_common/backtrace.rs:134:18
  33:        0x10265919c - std::rt::lang_start::{{closure}}::hca925fbaae964406
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/rt.rs:166:18
  34:        0x102c7cbf4 - core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::haaf7aa25477c8173
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/core/src/ops/function.rs:284:13
  35:        0x102c7cbf4 - std::panicking::try::do_call::h5d002844412967ab
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:485:40
  36:        0x102c7cbf4 - std::panicking::try::h9fb44f363cb22bb3
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:449:19
  37:        0x102c7cbf4 - std::panic::catch_unwind::h8ab57ba457dbcda2
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panic.rs:140:14
  38:        0x102c7cbf4 - std::rt::lang_start_internal::{{closure}}::ha1ab06997d2f5db7
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/rt.rs:148:48
  39:        0x102c7cbf4 - std::panicking::try::do_call::hb10fa6e7fd76f50f
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:485:40
  40:        0x102c7cbf4 - std::panicking::try::h2f2c6727cf230fac
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panicking.rs:449:19
  41:        0x102c7cbf4 - std::panic::catch_unwind::hed487fe4bd6703f0
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/panic.rs:140:14
  42:        0x102c7cbf4 - std::rt::lang_start_internal::h204464183949bff0
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/rt.rs:148:20
  43:        0x102659168 - std::rt::lang_start::hfce65c34518d4281
                               at /rustc/1c42cb4ef0544fbfaa500216e53382d6b079c001/library/std/src/rt.rs:165:17
  44:        0x102660b34 - _main
thread caused non-unwinding panic. aborting.
error: bench failed, to rerun pass `--bench benches`

Caused by:
  process didn't exit successfully: `/Users/ndr/coding/repro-bug/repro-pprof-bug/target/debug/deps/benches-65ad6c461a64cfec --profile-time=1 --bench` (signal: 6, SIGABRT: process abort signal)

---

benches/benches.rs:

use std::vec;

use criterion::{criterion_group, criterion_main, Criterion};

fn bench_fn(c: &mut Criterion) {
    for i in 0..10 {
        let size = 100 * i;
        let name = format!("subject {}", size);
        c.bench_function(&name, |b| b.iter(|| vec![0; size].iter().sum::<usize>()));
    }
}

use pprof::criterion::{Output, PProfProfiler};

criterion_group!(
name = benches;
config = Criterion::default()
    .with_profiler(
        PProfProfiler::new(100, Output::Flamegraph(None))
    )
    ;
targets = bench_fn
);

criterion_main!(benches);

Cargo.toml:

[package]
name = "repro-pprof-bug"
version = "0.1.0"
edition = "2021"

[dev-dependencies]
criterion="0.4.0"
pprof = { version = "0.11.1", features = ["flamegraph", "criterion", "protobuf-codec"] }

[[bench]]
name = "benches"
harness = false

Platform: Apple M2 Max, Ventura 13.3.1

Possible duplicate: #203