Project

General

Profile

Actions

Bug #11352

closed

Sample code Garbage collection dies with an address is T_NONE

Added by fgifford (Frank Gifford) about 7 years ago. Updated about 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
ruby -v:
2.2.2p95
[ruby-core:69969]

Files

crash.rb (4.53 KB) crash.rb Sample crash file fgifford (Frank Gifford), 07/14/2015 08:15 PM
crash_out (9.48 KB) crash_out ./crash.rb > crash_out 2>&1 fgifford (Frank Gifford), 07/14/2015 08:15 PM

Related issues 2 (0 open2 closed)

Related to Ruby master - Bug #7466: Hashの大きさによってHash#keysでvalueが返ることがあるClosed11/29/2012Actions
Related to Ruby master - Bug #11411: Crash in rb_gc_mark() during Rails app boot with GC.stress=1ClosedActions

Updated by fgifford (Frank Gifford) about 7 years ago

  • File crash.rb crash.rb added
  • File crash_out crash_out added
  • Subject changed from Sample code Garbage collection dies with a to Sample code Garbage collection dies with an address is T_NONE
  • ruby -v set to 2.2.2p95

 ./crash.rb
./crash.rb:5: [BUG] rb_gc_mark(): 0x85e344c is T_NONE
ruby 2.2.2p95 (2015-04-13 revision 50295) [i686-linux]

I was able to create a crash.rb file (attached) that would generate a crash. Essentially, we create a large hash of 131 entries in a method and then discard it. Having 130 entries did not seem to make the crash happen. The crash happens right away.

This was first noticed for sure in 2.1.3, it probably exists in 2.1.6 and I verified it here with 2.2.2p95

I believe this may be related to other bugs such as 10803, 10827, and 10163.

Updated by wanabe (_ wanabe) about 7 years ago

ruby -e 'puts "GC.stress = true; {", *(1..128).map {|i| "#{i} => 0," }, "129 => [],", "130 => [],", "131 => [],", "}"' | ruby

It causes similer [BUG] on ruby 2.2.2p95 (2015-04-13 revision 50295) [x86_64-darwin14] and ruby 2.3.0dev (2015-07-15 trunk 51015) [x86_64-darwin14].
I guess hash.length should be >= 131, and 129th (and also 130th and 131st ?) item of hash should be a target of GC.

Actions #3

Updated by nobu (Nobuyoshi Nakada) about 7 years ago

  • Related to Bug #7466: Hashの大きさによってHash#keysでvalueが返ることがある added

Updated by nobu (Nobuyoshi Nakada) about 7 years ago

  • Backport changed from 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN to 2.0.0: WONTFIX, 2.1: REQUIRED, 2.2: REQUIRED
Actions #5

Updated by nobu (Nobuyoshi Nakada) about 7 years ago

  • Status changed from Open to Closed

Applied in changeset r51263.


vm.c: fix mark with rewinding cfp

  • vm.c (m_core_hash_merge_ptr): copy the arguments to the machine
    stack before rewinding the control frame pointer and leaving the
    arguments outside valid region of the value stack.
    [ruby-core:69969] [Bug #11352]
Actions #6

Updated by wanabe (_ wanabe) about 7 years ago

  • Related to Bug #11411: Crash in rb_gc_mark() during Rails app boot with GC.stress=1 added

Updated by nagachika (Tomoyuki Chikanaga) about 7 years ago

  • Backport changed from 2.0.0: WONTFIX, 2.1: REQUIRED, 2.2: REQUIRED to 2.0.0: WONTFIX, 2.1: REQUIRED, 2.2: DONE

Backported into ruby_2_2 branch at r51521.

Actions #8

Updated by usa (Usaku NAKAMURA) about 7 years ago

  • Backport changed from 2.0.0: WONTFIX, 2.1: REQUIRED, 2.2: DONE to 2.0.0: WONTFIX, 2.1: DONE, 2.2: DONE

ruby_2_1 r51601 merged revision(s) 51263,51264.

Actions

Also available in: Atom PDF