bug#19523: Segfault when creating thread with scm_with_guile

[Anthonin Bonnefoy <anthonin.bonnefoy@securactive.net>]

[-- Attachment #1: Type: text/plain, Size: 4551 bytes --]

Hi all,

I have segfaults occurring sometimes when threads are starting with
scm_with_guile while main thread is using malloc.

Example program:
```
#include <stdlib.h>
#include <pthread.h>
#include <libguile.h>

static void *a_libguile_thread(void *unused) {
}

static void *a_libguile_thread_(void *unused) {
    scm_with_guile(a_libguile_thread, NULL);
}

static void do_mallocs(void) {
    void *a[1000];
    for (int i = 0; i < 1000; ++i) {
        a[i] = malloc(356);
    }
    for (int i = 0; i < 1000; ++i) {
        free(a[i]);
    }
}

int main(int argc, char *argv[]) {
    scm_init_guile();

    pthread_t pth[10];
    for (int i = 0; i < 10; ++i) {
        GC_pthread_create(pth + i, NULL, a_libguile_thread_, NULL);
    }

    do_mallocs();

    for (int i = 0; i < 10; ++i) {
        GC_pthread_join(pth[i], NULL);
    }

    return 0;
}

```
To compile:
gcc corruption_guile.c -g -std=c99 `pkg-config --cflags --libs guile-2.0`
```
Some iterations are needed before having the segfaults:
while ./a.out; do echo -n "."; done;
```
Versions:
gcc (Debian 4.9.1-19) 4.9.1
guile (GNU Guile) 2.0.11.20-4338f (also tried from v2.0.11 tag)
libgc gc7_2d
```
Backtrace:

#0  GC_generic_malloc (lb=524288, k=<optimized out>) at malloc.c:185
#1  0x00007fcc535541ff in make_vm () at vm.c:704
#2  0x00007fcc535542d5 in scm_the_vm () at vm.c:781
#3  0x00007fcc534da600 in scm_call_4 (proc=0x1198c30, arg1=arg1@entry=0x404,
arg2=<optimized out>, arg3=<optimized out>, arg4=<optimized out>) at
eval.c:507
#4  0x00007fcc53550d89 in scm_catch_with_pre_unwind_handler
(key=key@entry=0x404,
thunk=<optimized out>, handler=<optimized out>,
pre_unwind_handler=<optimized out>) at throw.c:73
#5  0x00007fcc53550e8f in scm_c_catch (tag=tag@entry=0x404,
body=body@entry=0x7fcc534d0c00
<c_body>, body_data=body_data@entry=0x7fcc4d14cd50,
handler=handler@entry=0x7fcc534d0fe0
<c_handler>, handler_data=handler_data@entry=0x7fcc4d14cd50
, pre_unwind_handler=pre_unwind_handler@entry=0x7fcc534d0d90
<pre_unwind_handler>, pre_unwind_handler_data=0x127cff0) at throw.c:207
#6  0x00007fcc534d1381 in scm_i_with_continuation_barrier
(body=body@entry=0x7fcc534d0c00
<c_body>, body_data=body_data@entry=0x7fcc4d14cd50,
handler=handler@entry=0x7fcc534d0fe0
<c_handler>, handler_data=handler_data@entry=0x7fcc4d14cd50,
 pre_unwind_handler=pre_unwind_handler@entry=0x7fcc534d0d90
<pre_unwind_handler>, pre_unwind_handler_data=0x127cff0) at
continuations.c:455
#7  0x00007fcc534d1415 in scm_c_with_continuation_barrier (func=<optimized
out>, data=<optimized out>) at continuations.c:551
#8  0x00007fcc5354e6dc in with_guile_and_parent
(base=base@entry=0x7fcc4d14cdb0,
data=data@entry=0x7fcc4d14cde0) at threads.c:906
#9  0x00007fcc53222302 in GC_call_with_stack_base (fn=fn@entry=0x7fcc5354e690
<with_guile_and_parent>, arg=arg@entry=0x7fcc4d14cde0) at misc.c:1553
#10 0x00007fcc5354eac8 in scm_i_with_guile_and_parent (parent=<optimized
out>, data=<optimized out>, func=<optimized out>) at threads.c:949
#11 scm_with_guile (func=<optimized out>, data=<optimized out>) at
threads.c:955
#12 0x00000000004008bb in a_libguile_thread_ (unused=0x0) at
corruption_guile.c:11
#13 0x00007fcc53226f6e in GC_inner_start_routine (sb=<error reading
variable: value has been optimized out>, arg=<error reading variable: value
has been optimized out>) at pthread_start.c:56
#14 0x00007fcc53222302 in GC_call_with_stack_base (fn=<optimized out>,
arg=<optimized out>) at misc.c:1553
#15 0x00007fcc52ff40a4 in start_thread (arg=0x7fcc4d14d700) at
pthread_create.c:309
#16 0x00007fcc52d28ccd in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111
```

I thought at first it was a problem with libgc but the given program run
without problems.
```
#include <stdlib.h>
#include <pthread.h>
#define GC_THREADS 1
#define GC_NO_THREAD_REDIRECTS 1
#include <gc/gc_mark.h>
#include <gc.h>

static void *a_lib_gc_thread(void *unused) {
    void *a;
    for (int i = 0; i < 100; ++i) {
        a = GC_generic_malloc(524288, 6);
    }
    GC_free(a);
}

static void do_mallocs(void) {
    void *a[100];
    for (int i = 0; i < 100; ++i) {
        a[i] = malloc(356);
    }
    for (int i = 0; i < 100; ++i) {
        free(a[i]);
    }
}

int main(int argc, char *argv[]) {
    pthread_t pth[10];
    for (int i = 0; i < 10; ++i) {
        GC_pthread_create(pth + i, NULL, a_lib_gc_thread, NULL);
    }
    do_mallocs();
    for (int i = 0; i < 10; ++i) {
        GC_pthread_join(pth[i], NULL);
    }
    return 0;
}
```
I also tried to replace malloc by scm_malloc with no luck.

Regards, Anthonin

[-- Attachment #2: Type: text/html, Size: 5503 bytes --]