bug#19523: Segfault when creating thread with scm_with_guile

[Andy Wingo <wingo@pobox.com>]

I can reproduce this bug, but I can't get backtraces from my core file
:/  Irritating.  Are you able to get backtraces reliably?  Can you
provide a "thr apply all bt" ?

Regards,

Andy

On Tue 06 Jan 2015 15:27, Anthonin Bonnefoy <anthonin.bonnefoy@securactive.net> writes:

> Hi all,
>
> I have segfaults occurring sometimes when threads are starting with
> scm_with_guile while main thread is using malloc.
>
> Example program:
> ```
> #include <stdlib.h>
> #include <pthread.h>
> #include <libguile.h>
>
> static void *a_libguile_thread(void *unused) {
> }
>
> static void *a_libguile_thread_(void *unused) {
> scm_with_guile(a_libguile_thread, NULL);
> }
>
> static void do_mallocs(void) {
> void *a[1000];
> for (int i = 0; i < 1000; ++i) {
> a[i] = malloc(356);
> }
> for (int i = 0; i < 1000; ++i) {
> free(a[i]);
> }
> }
>
> int main(int argc, char *argv[]) {
> scm_init_guile();
>
> pthread_t pth[10];
> for (int i = 0; i < 10; ++i) {
> GC_pthread_create(pth + i, NULL, a_libguile_thread_, NULL);
> }
>
> do_mallocs();
>
> for (int i = 0; i < 10; ++i) {
> GC_pthread_join(pth[i], NULL);
> }
>
> return 0;
> }
>
> ```
> To compile:
> gcc corruption_guile.c -g -std=c99 `pkg-config --cflags --libs
> guile-2.0`
> ```
> Some iterations are needed before having the segfaults:
> while ./a.out; do echo -n "."; done;
> ```
> Versions:
> gcc (Debian 4.9.1-19) 4.9.1
> guile (GNU Guile) 2.0.11.20-4338f (also tried from v2.0.11 tag)
> libgc gc7_2d
> ```
> Backtrace: 
>
> #0 GC_generic_malloc (lb=524288, k=<optimized out>) at malloc.c:185
> #1 0x00007fcc535541ff in make_vm () at vm.c:704
> #2 0x00007fcc535542d5 in scm_the_vm () at vm.c:781
> #3 0x00007fcc534da600 in scm_call_4 (proc=0x1198c30,
> arg1=arg1@entry=0x404, arg2=<optimized out>, arg3=<optimized out>,
> arg4=<optimized out>) at eval.c:507
> #4 0x00007fcc53550d89 in scm_catch_with_pre_unwind_handler
> (key=key@entry=0x404, thunk=<optimized out>, handler=<optimized out>,
> pre_unwind_handler=<optimized out>) at throw.c:73
> #5 0x00007fcc53550e8f in scm_c_catch (tag=tag@entry=0x404,
> body=body@entry=0x7fcc534d0c00 <c_body>,
> body_data=body_data@entry=0x7fcc4d14cd50,
> handler=handler@entry=0x7fcc534d0fe0 <c_handler>,
> handler_data=handler_data@entry=0x7fcc4d14cd50
> , pre_unwind_handler=pre_unwind_handler@entry=0x7fcc534d0d90
> <pre_unwind_handler>, pre_unwind_handler_data=0x127cff0) at
> throw.c:207
> #6 0x00007fcc534d1381 in scm_i_with_continuation_barrier
> (body=body@entry=0x7fcc534d0c00 <c_body>,
> body_data=body_data@entry=0x7fcc4d14cd50,
> handler=handler@entry=0x7fcc534d0fe0 <c_handler>,
> handler_data=handler_data@entry=0x7fcc4d14cd50,
> pre_unwind_handler=pre_unwind_handler@entry=0x7fcc534d0d90
> <pre_unwind_handler>, pre_unwind_handler_data=0x127cff0) at
> continuations.c:455
> #7 0x00007fcc534d1415 in scm_c_with_continuation_barrier
> (func=<optimized out>, data=<optimized out>) at continuations.c:551
> #8 0x00007fcc5354e6dc in with_guile_and_parent
> (base=base@entry=0x7fcc4d14cdb0, data=data@entry=0x7fcc4d14cde0) at
> threads.c:906
> #9 0x00007fcc53222302 in GC_call_with_stack_base
> (fn=fn@entry=0x7fcc5354e690 <with_guile_and_parent>,
> arg=arg@entry=0x7fcc4d14cde0) at misc.c:1553
> #10 0x00007fcc5354eac8 in scm_i_with_guile_and_parent
> (parent=<optimized out>, data=<optimized out>, func=<optimized out>)
> at threads.c:949
> #11 scm_with_guile (func=<optimized out>, data=<optimized out>) at
> threads.c:955
> #12 0x00000000004008bb in a_libguile_thread_ (unused=0x0) at
> corruption_guile.c:11
> #13 0x00007fcc53226f6e in GC_inner_start_routine (sb=<error reading
> variable: value has been optimized out>, arg=<error reading variable:
> value has been optimized out>) at pthread_start.c:56
> #14 0x00007fcc53222302 in GC_call_with_stack_base (fn=<optimized out>,
> arg=<optimized out>) at misc.c:1553
> #15 0x00007fcc52ff40a4 in start_thread (arg=0x7fcc4d14d700) at
> pthread_create.c:309
> #16 0x00007fcc52d28ccd in clone () at .
> ./sysdeps/unix/sysv/linux/x86_64/clone.S:111
> ```
>
> I thought at first it was a problem with libgc but the given program
> run without problems.
> ```
> #include <stdlib.h>
> #include <pthread.h>
> #define GC_THREADS 1
> #define GC_NO_THREAD_REDIRECTS 1
> #include <gc/gc_mark.h>
> #include <gc.h>
>
> static void *a_lib_gc_thread(void *unused) {
> void *a;
> for (int i = 0; i < 100; ++i) {
> a = GC_generic_malloc(524288, 6);
> }
> GC_free(a);
> }
>
> static void do_mallocs(void) {
> void *a[100];
> for (int i = 0; i < 100; ++i) {
> a[i] = malloc(356);
> }
> for (int i = 0; i < 100; ++i) {
> free(a[i]);
> }
> }
>
> int main(int argc, char *argv[]) {
> pthread_t pth[10];
> for (int i = 0; i < 10; ++i) {
> GC_pthread_create(pth + i, NULL, a_lib_gc_thread, NULL);
> }
> do_mallocs();
> for (int i = 0; i < 10; ++i) {
> GC_pthread_join(pth[i], NULL);
> }
> return 0;
> }
> ```
> I also tried to replace malloc by scm_malloc with no luck.
>
> Regards, Anthonin