* Nasty GC bug
@ 2012-08-24 7:26 Dmitry Antipov
2012-08-24 8:56 ` Paul Eggert
2012-08-27 13:25 ` Jim Meyering
0 siblings, 2 replies; 5+ messages in thread
From: Dmitry Antipov @ 2012-08-24 7:26 UTC (permalink / raw)
To: Emacs development discussions
It looks like live_cons_p (M, P) may be true if P is a cons cell from
the spare_memory[X], X = 1..4. So, mark_maybe_{object, pointer} may
call to mark_object for an uninitialized cons from spare blocks, with
random results (most probably a crash). This is very hard to reproduce
because it depends from the values found on a C stack.
The same looks to be true for live_string_p and spare_memory[5, 6].
Suggested fix is to use MEM_TYPE_NON_LISP for spare memory, e.g.:
=== modified file 'src/alloc.c'
--- src/alloc.c 2012-08-21 23:39:56 +0000
+++ src/alloc.c 2012-08-24 07:23:48 +0000
@@ -3816,22 +3816,22 @@
spare_memory[0] = malloc (SPARE_MEMORY);
if (spare_memory[1] == 0)
spare_memory[1] = lisp_align_malloc (sizeof (struct cons_block),
- MEM_TYPE_CONS);
+ MEM_TYPE_NON_LISP);
if (spare_memory[2] == 0)
spare_memory[2] = lisp_align_malloc (sizeof (struct cons_block),
- MEM_TYPE_CONS);
+ MEM_TYPE_NON_LISP);
if (spare_memory[3] == 0)
spare_memory[3] = lisp_align_malloc (sizeof (struct cons_block),
- MEM_TYPE_CONS);
+ MEM_TYPE_NON_LISP);
if (spare_memory[4] == 0)
spare_memory[4] = lisp_align_malloc (sizeof (struct cons_block),
- MEM_TYPE_CONS);
+ MEM_TYPE_NON_LISP);
if (spare_memory[5] == 0)
spare_memory[5] = lisp_malloc (sizeof (struct string_block),
- MEM_TYPE_STRING);
+ MEM_TYPE_NON_LISP);
if (spare_memory[6] == 0)
spare_memory[6] = lisp_malloc (sizeof (struct string_block),
- MEM_TYPE_STRING);
+ MEM_TYPE_NON_LISP);
if (spare_memory[0] && spare_memory[1] && spare_memory[5])
Vmemory_full = Qnil;
#endif
Comments?
Dmitry
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Nasty GC bug
2012-08-24 7:26 Nasty GC bug Dmitry Antipov
@ 2012-08-24 8:56 ` Paul Eggert
2012-08-24 10:58 ` Dmitry Antipov
2012-08-27 13:25 ` Jim Meyering
1 sibling, 1 reply; 5+ messages in thread
From: Paul Eggert @ 2012-08-24 8:56 UTC (permalink / raw)
To: Dmitry Antipov; +Cc: Emacs development discussions
On 08/24/2012 12:26 AM, Dmitry Antipov wrote:
> Suggested fix is to use MEM_TYPE_NON_LISP for spare memory, e.g.:
Thanks for finding this bug.
That patch doesn't look quite right if ! USE_LSB_TAG, since
in that case lisp_align_malloc won't correctly report a
failure in the section of code that checks whether the
memory just allocated can be addressed through a Lisp
object's pointer. Also, what about dont_register_blocks
and allocated_mem_type?
Instead, how about marking the spare conses with Vdead
and the spare strings with NULL data? Admittedly I
haven't had time to think this through....
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Nasty GC bug
2012-08-24 8:56 ` Paul Eggert
@ 2012-08-24 10:58 ` Dmitry Antipov
2012-08-24 17:25 ` Paul Eggert
0 siblings, 1 reply; 5+ messages in thread
From: Dmitry Antipov @ 2012-08-24 10:58 UTC (permalink / raw)
To: Paul Eggert; +Cc: Emacs development discussions
On 08/24/2012 12:56 PM, Paul Eggert wrote:
> Thanks for finding this bug.
>
> That patch doesn't look quite right if ! USE_LSB_TAG, since
> in that case lisp_align_malloc won't correctly report a
> failure in the section of code that checks whether the
> memory just allocated can be addressed through a Lisp
> object's pointer. Also, what about dont_register_blocks
> and allocated_mem_type?
>
> Instead, how about marking the spare conses with Vdead
> and the spare strings with NULL data? Admittedly I
> haven't had time to think this through....
This implies initialization of the data which we will never
use; what about the special memory type, e.g. MEM_TYPE_SPARE?
Dmitry
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Nasty GC bug
2012-08-24 7:26 Nasty GC bug Dmitry Antipov
2012-08-24 8:56 ` Paul Eggert
@ 2012-08-27 13:25 ` Jim Meyering
1 sibling, 0 replies; 5+ messages in thread
From: Jim Meyering @ 2012-08-27 13:25 UTC (permalink / raw)
To: Dmitry Antipov; +Cc: Emacs development discussions
Dmitry Antipov wrote:
> It looks like live_cons_p (M, P) may be true if P is a cons cell from
> the spare_memory[X], X = 1..4. So, mark_maybe_{object, pointer} may
> call to mark_object for an uninitialized cons from spare blocks, with
> random results (most probably a crash). This is very hard to reproduce
> because it depends from the values found on a C stack.
Nice work!
I wouldn't be surprised if this is the cause of some of the GC-related
problems I've reported over the last year or two.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2012-08-27 13:25 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-24 7:26 Nasty GC bug Dmitry Antipov
2012-08-24 8:56 ` Paul Eggert
2012-08-24 10:58 ` Dmitry Antipov
2012-08-24 17:25 ` Paul Eggert
2012-08-27 13:25 ` Jim Meyering
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.