Callgrind always segfaults on macOS 26.3 on M4 Max

[LoganDark]

Callgrind seems to always segfault no matter what command I run it with:

$ valgrind --tool=callgrind /usr/bin/true
==28369== Callgrind, a call-graph generating cache profiler
==28369== Copyright (C) 2002-2017, and GNU GPL'd, by Josef Weidendorfer et al.
==28369== Using Valgrind-3.27.0.GIT-lbmacos and LibVEX; rerun with -h for copyright info
==28369== Command: /usr/bin/true
==28369== 
==28369== For interactive control, run 'callgrind_control -h'.
==28369== 
==28369== Process terminating with default action of signal 11 (SIGSEGV)
==28369==  Bad permissions for mapped region at address 0x8
==28369==    at 0x1003DEDA8: cerror_nocancel (in /usr/lib/dyld)
==28369==    by 0x1003E1C17: __kdebug_typefilter (in /usr/lib/dyld)
==28369==    by 0x1003DDA4B: kdebug_is_enabled (in /usr/lib/dyld)
==28369==    by 0x10042A713: dyld3::kdebug_trace_dyld_marker(unsigned int, dyld3::kt_arg, dyld3::kt_arg, dyld3::kt_arg, dyld3::kt_arg) (in /usr/lib/dyld)
==28369==    by 0x1003E319F: (below main) (in /usr/lib/dyld)
==28369== 
==28369== Events    : Ir
==28369== Collected : 70
==28369== 
==28369== I   refs:      70
zsh: segmentation fault  valgrind --tool=callgrind /usr/bin/true

I built from source and installed with a prefix of /opt/homebrew/opt/valgrind/ after running into #161, and valgrind --version doesn't crash but valgrind --tool=callgrind /usr/bin/true always segfaults.

Information

• macOS architecture (uname -m): arm64
• macOS version (sw_vers): 26.3
• Xcode version (xcrun --sdk macosx --show-sdk-version): 26.2

[LouisBrunner]

Hi @LoganDark, thanks for the report.

I can reproduce on my setup. I get a lot of different errors (not the same as yours but most likely the same cause):

==1693== Process terminating with default action of signal 11 (SIGSEGV)
==1693==  Bad permissions for mapped region at address 0x170
==1693==    at 0x193089374: _xzm_segment_group_alloc_segment (in /usr/lib/system/libsystem_malloc.dylib)
==1693==    by 0x1930870C3: xzm_segment_group_alloc_chunk (in /usr/lib/system/libsystem_malloc.dylib)
==1693==    by 0x1930A3663: _xzm_xzone_find_and_malloc_from_freelist_chunk (in /usr/lib/system/libsystem_malloc.dylib)
==1693==    by 0x1930A293F: _xzm_xzone_malloc_freelist_outlined (in /usr/lib/system/libsystem_malloc.dylib)
==1693==    by 0x192E2D783: realizeClassWithoutSwift(objc_class*, objc_class*) (in /usr/lib/libobjc.A.dylib)
==1693==    by 0x192E2BE17: map_images_nolock (in /usr/lib/libobjc.A.dylib)
==1693==    by 0x192E29D8B: map_images (in /usr/lib/libobjc.A.dylib)
==1693==    by 0x1003EB927: invocation function for block in dyld4::RuntimeState::setObjCNotifiers(dyld4::ReadOnlyCallback<void (*)(char const*, mach_header const*)>, dyld4::ReadOnlyCallback<void (*)(mach_header const*, void*, mach_header const*, void const*)>, dyld4::ReadOnlyCallback<void (*)(_dyld_objc_notify_mapped_info const*)>, dyld4::ReadOnlyCallback<void (*)(unsigned int, _dyld_objc_notify_mapped_info const*, void ( block_pointer)(unsigned int))>)::$_0::operator()() const (in /usr/lib/dyld)
==1693==    by 0x1003DEBC7: dyld4::RuntimeLocks::withLoadersReadLock(void ( block_pointer)()) (in /usr/lib/dyld)
==1693==    by 0x1003E746B: dyld4::RuntimeState::setObjCNotifiers(dyld4::ReadOnlyCallback<void (*)(char const*, mach_header const*)>, dyld4::ReadOnlyCallback<void (*)(mach_header const*, void*, mach_header const*, void const*)>, dyld4::ReadOnlyCallback<void (*)(_dyld_objc_notify_mapped_info const*)>, dyld4::ReadOnlyCallback<void (*)(unsigned int, _dyld_objc_notify_mapped_info const*, void ( block_pointer)(unsigned int))>) (in /usr/lib/dyld)
==1693==    by 0x1004094CF: dyld4::APIs::_dyld_objc_register_callbacks(dyld4::ObjCCallbacks const*) (in /usr/lib/dyld)
==1693==    by 0x192E7EC6B: _dyld_objc_register_callbacks (in /usr/lib/system/libdyld.dylib)

==1835== Process terminating with default action of signal 11 (SIGSEGV)
==1835==  Bad permissions for mapped region at address 0x0
==1835==    at 0x192E4FE64: objc::DenseMap<DisguisedPtr<objc_class>, objc::category_list, objc::DenseMapValueInfo<objc::category_list>, objc::DenseMapInfo<DisguisedPtr<objc_class> >, objc::detail::DenseMapPair<DisguisedPtr<objc_class>, objc::category_list> >::init(unsigned int) (in /usr/lib/libobjc.A.dylib)
==1835==    by 0x192E299A3: _objc_init (in /usr/lib/libobjc.A.dylib)
==1835==    by 0x1930C18FB: _os_object_init (in /usr/lib/system/libdispatch.dylib)
==1835==    by 0x1930F6C2B: libdispatch_init (in /usr/lib/system/libdispatch.dylib)
==1835==    by 0x1A2C5034F: libSystem_initializer (in /usr/lib/libSystem.B.dylib)
==1835==    by 0x104BF9CAF: invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const (in /usr/lib/dyld)
==1835==    by 0x104C3772F: invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void ( block_pointer)(unsigned int), void const*) const (in /usr/lib/dyld)
==1835==    by 0x104C56533: invocation function for block in mach_o::Header::forEachSection(void ( block_pointer)(mach_o::Header::SectionInfo const&, bool&)) const (in /usr/lib/dyld)
==1835==    by 0x104C53157: mach_o::Header::forEachLoadCommand(void ( block_pointer)(load_command const*, bool&)) const (in /usr/lib/dyld)
==1835==    by 0x104C549EF: mach_o::Header::forEachSection(void ( block_pointer)(mach_o::Header::SectionInfo const&, bool&)) const (in /usr/lib/dyld)
==1835==    by 0x104C3721F: dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void ( block_pointer)(unsigned int), void const*) const (in /usr/lib/dyld)
==1835==    by 0x104BF9A67: dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const (in /usr/lib/dyld)

==1891== Process terminating with default action of signal 10 (SIGBUS)
==1891==  Invalid address alignment at address 0x10270E344
==1891==    at 0x193087008: xzm_segment_group_alloc_chunk (in /usr/lib/system/libsystem_malloc.dylib)
==1891==    by 0x1930A3663: _xzm_xzone_find_and_malloc_from_freelist_chunk (in /usr/lib/system/libsystem_malloc.dylib)
==1891==    by 0x1930A293F: _xzm_xzone_malloc_freelist_outlined (in /usr/lib/system/libsystem_malloc.dylib)
==1891==    by 0x192E2D783: realizeClassWithoutSwift(objc_class*, objc_class*) (in /usr/lib/libobjc.A.dylib)
==1891==    by 0x192E2BE17: map_images_nolock (in /usr/lib/libobjc.A.dylib)
==1891==    by 0x192E29D8B: map_images (in /usr/lib/libobjc.A.dylib)
==1891==    by 0x102467927: invocation function for block in dyld4::RuntimeState::setObjCNotifiers(dyld4::ReadOnlyCallback<void (*)(char const*, mach_header const*)>, dyld4::ReadOnlyCallback<void (*)(mach_header const*, void*, mach_header const*, void const*)>, dyld4::ReadOnlyCallback<void (*)(_dyld_objc_notify_mapped_info const*)>, dyld4::ReadOnlyCallback<void (*)(unsigned int, _dyld_objc_notify_mapped_info const*, void ( block_pointer)(unsigned int))>)::$_0::operator()() const (in /usr/lib/dyld)
==1891==    by 0x10245ABC7: dyld4::RuntimeLocks::withLoadersReadLock(void ( block_pointer)()) (in /usr/lib/dyld)
==1891==    by 0x10246346B: dyld4::RuntimeState::setObjCNotifiers(dyld4::ReadOnlyCallback<void (*)(char const*, mach_header const*)>, dyld4::ReadOnlyCallback<void (*)(mach_header const*, void*, mach_header const*, void const*)>, dyld4::ReadOnlyCallback<void (*)(_dyld_objc_notify_mapped_info const*)>, dyld4::ReadOnlyCallback<void (*)(unsigned int, _dyld_objc_notify_mapped_info const*, void ( block_pointer)(unsigned int))>) (in /usr/lib/dyld)
==1891==    by 0x1024854CF: dyld4::APIs::_dyld_objc_register_callbacks(dyld4::ObjCCallbacks const*) (in /usr/lib/dyld)
==1891==    by 0x192E7EC6B: _dyld_objc_register_callbacks (in /usr/lib/system/libdyld.dylib)
==1891==    by 0x192E29B0B: _objc_init (in /usr/lib/libobjc.A.dylib)

I will see if I can find the source problem.

[LoganDark]

@LouisBrunner, any leads yet? -- do you know if this might be fixable in the next couple days?

(not trying to rush -- just checking if it's realistic for me to wait on this for my work)

[LouisBrunner]

I haven't made much progress on this so I would say avoid relying on a fix in the near future, unfortunately. 😢

[paulfloyd]

Does --sanity-level=3 help?

[LoganDark]

Does --sanity-level=3 help?

$ valgrind --tool=callgrind --sanity-level=3 /usr/bin/true
==17470== Callgrind, a call-graph generating cache profiler
==17470== Copyright (C) 2002-2017, and GNU GPL'd, by Josef Weidendorfer et al.
==17470== Using Valgrind-3.27.0.GIT-lbmacos and LibVEX; rerun with -h for copyright info
==17470== Command: /usr/bin/true
==17470==
==17470== For interactive control, run 'callgrind_control -h'.
--17470:0: aspacem segment mismatch: V's seg 1st, kernel's 2nd:
--17470:0: aspacem  56: anon 0300000000-03007fbfff 8372224 rwx-- SmFixed d=0x000 i=0       o=0       (-1,-1) (none)
--17470:0: aspacem ...: .... 0300000000-03007fbfff 8372224 rw-.. ....... d=0x000 i=0       o=0       (.) m=. (none)
--17470:0: aspacem segment mismatch: V's seg 1st, kernel's 2nd:
--17470:0: aspacem  58: anon 03047fc000-0304ff7fff 8372224 rwx-- SmFixed d=0x000 i=0       o=0       (-1,-1) (none)
--17470:0: aspacem ...: .... 03047fc000-0304ff7fff 8372224 rw-.. ....... d=0x000 i=0       o=0       (.) m=. (none)
--17470:0: aspacem segment mismatch: V's seg 1st, kernel's 2nd:
--17470:0: aspacem  63: ANON 700000004000-700000403fff 4194304 rwx-- SmFixed d=0x000 i=242     o=0       (-1,-1) (none)
--17470:0: aspacem ...: .... 700000004000-700000403fff 4194304 rw-.. ....... d=0x000 i=242     o=0       (.) m=. (none)
--17470:0: aspacem sync check at m_aspacemgr/aspacemgr-linux.c:2249 (Addr vgPlain_am_get_advisory(const MapRequest *, Bool, Bool *)): FAILED
--17470:0: aspacem
--17470:0: aspacem Valgrind: FATAL: aspacem assertion failed:
--17470:0: aspacem   VG_(am_do_sync_check) (__PRETTY_FUNCTION__,__FILE__,__LINE__)
--17470:0: aspacem   at m_aspacemgr/aspacemgr-linux.c:2249 (Addr vgPlain_am_get_advisory(const MapRequest *, Bool, Bool *))
--17470:0: aspacem Exiting now.