Summary

using set-finalizer in this loop triggers a OOM panic / segfault

Metadata

Description

This innocent looking program crashes:

 (use lolevel)
 
 (define (make-stuff)
   (let ((mem (allocate 100)))
     (set-finalizer! mem free)
     mem))
 
 (let lp ((i 0))
   (make-stuff)
   (lp (add1 i)))

This has been confirmed by Peter on NetBSD, I have the situation that it works for me if I add a (print i) before (make-stuff). Peter cannot see the same behaviour on his machine.

I have tried 4.5.0 4.7.0 and master from last week. All show the same strange thing.

Am I misusing this? I stumbled upon it during some allocation in an egg for a FFI buffer...

Changes and comments

[2011-11-05 22:31:33 UTC] ckeen wrote:

I managed to get a stacktrace from gdb:

 Starting program: /home/ckeen/proj/chicken/doodle/small-test 
 
 Program received signal SIGSEGV, Segmentation fault.
 [Switching to process 1287, thread 0x88518400]
 0x0b075c74 in really_remark (x=0x7c5bd1e8) at runtime.c:3300
 3300        h = p->header;
 (gdb) bt
 #0  0x0b075c74 in really_remark (x=0x7c5bd1e8) at runtime.c:3300
 #1  0x0b075903 in C_rereclaim2 (size=516388, double_plus=0) at runtime.c:3211
 #2  0x0b0b31a9 in allocate_vector_2 (dummy=0x2ae686c0) at runtime.c:7003
 #3  0x0b0716b7 in CHICKEN_run (toplevel=0x0) at runtime.c:1312
 #4  0x0b06f5c6 in CHICKEN_main (argc=1, argv=0xcfbefef8, toplevel=0x1c000df1) at runtime.c:532
 #5  0x1c000db8 in main (argc=Cannot access memory at address 0x0
 (gdb) p p->header
 Cannot access memory at address 0xa9a414
 (gdb) p *(C_SCHEME_BLOCK*)h
 $5 = {header = 687865857, data = {-2114364416}}

[2011-11-11 08:19:15 UTC] felix wrote:

Does this happen with the current HEAD? I can't reproduce this right now (only tried on Windows). What is shown when the code is compiled and run with "-:d" ?

[2011-11-11 09:51:44 UTC] ckeen wrote:

gah, this is weird...

 (use lolevel)
 
 (define (make-stuff)
   (let ((mem (allocate 1000)))
     (set-finalizer! mem free)
     mem))
 
 (let lp ((i 0))
   (print i)
   (make-stuff)
   (lp (add1 i)))

either one of these version crashes for me now on OpenBSD 32 bit 4.7.0 (sorry I don't have a more recent version there)

The above program does crash with current master on 64 bit linux when adding -O3. With the print output sent to /dev/null I get this:

  ./bla -:d >/dev/null
 [debug] application startup...
 [debug] heap resized to 500000 bytes
 [debug] stack bottom is 0x7ffff803d090.
 [debug] entering toplevel toplevel...
 [debug] stack resized to 262144 bytes
 [debug] entering toplevel library_toplevel...
 [debug] entering toplevel build_2dversion_toplevel...
 [debug] resizing heap dynamically from 500k to 1032k ...
 [debug] entering toplevel eval_toplevel...
 [debug] entering toplevel expand_toplevel...
 [debug] entering toplevel modules_toplevel...
 [debug] entering toplevel lolevel_toplevel...
 [debug] entering toplevel srfi_2d69_toplevel...
 [debug] resizing heap dynamically from 1032k to 2196k ...
 [panic] out of memory - heap full while resizing - execution terminated
 
 ...more...
 bla.scm:6: set-finalizer!
 bla.scm:12: lp
 bla.scm:10: print
 bla.scm:11: make-stuff
 bla.scm:5: allocate
 bla.scm:6: set-finalizer!
 bla.scm:12: lp
 bla.scm:10: print
 bla.scm:11: make-stuff
 bla.scm:5: allocate
 bla.scm:6: set-finalizer!
 bla.scm:12: lp
 bla.scm:10: print
 bla.scm:11: make-stuff
 bla.scm:5: allocate
 bla.scm:6: set-finalizer! 	<--

[2011-11-11 09:56:20 UTC] sjamaan wrote:

Note that it only crashes when compiled! (the OP forgot to mention this)

[2011-11-11 09:57:15 UTC] ckeen wrote:

Chicken is after all a compiler in the first place... ;)

[2011-11-11 10:01:43 UTC] sjamaan wrote:

I can even reproduce it on my ancient 4.4.0 installation

[2012-04-27 23:21:48 UTC] felix wrote:

I suggest to postpone investigating this to after the 4.8.0 release.

[2012-05-04 09:04:29 UTC] felix removed milestone 4.8.0

[2012-05-24 19:48:40 UTC] ckeen wrote:

I am now unable to reproduce this anymore...

[2012-06-21 20:55:03 UTC] sjamaan wrote:

Still crashes for me

[2012-06-23 20:11:28 UTC] sjamaan wrote:

No longer crashes when the patch from here http://lists.nongnu.org/archive/html/chicken-hackers/2012-06/msg00080.html is applied

[2012-06-24 21:22:50 UTC] ckeen changed status from new to closed

[2012-06-24 21:22:50 UTC] ckeen set resolution to fixed

[2012-06-24 21:22:50 UTC] ckeen wrote:

Yep, seems to do the right thing now. Thanks!