Project

General

Profile

Actions

Bug #15821

closed

ruby_process_options() may cause "WB miss (O->Y)"

Added by wanabe (_ wanabe) almost 5 years ago. Updated over 4 years ago.

Status:
Closed
Assignee:
-
Target version:
-
ruby -v:
ruby 2.7.0dev (2019-05-04 trunk b72623012d) [x86_64-linux]
[ruby-core:92537]

Description

Problem

Ruby interpreter may cause error "WB miss (O->Y)" on some conditions that are RGENGC_CHECK_MODE=5 and RUBY_DEBUG=gc_stress

How to reproduce

  1. build ruby with high RGENGC_CHECK_MODE
    • make ruby optflags="-O3 -DRGENGC_CHECK_MODE=5"
  2. run ruby with gc_stress
    • RUBY_DEBUG=gc_stress ./ruby --disable-gems -ve 1

Probable cause

  1. rb_construct_expanded_load_path calls rb_ary_replace(vm->load_path_snapshot, vm->load_path).
  2. It creates shared root array and makes vm->load_path SHARED_ARRAY.
  3. After a while, process_options calls RARRAY_ASET(load_path, i, path).
  4. It calls rb_gc_writebarrier -> gc_writebarrier_generational.
    • Incremental mark phase is finished because of RUBY_DEBUG=gc_stress.
  5. It makes vm->load_path remembered, but not shared root array!
  6. "WB miss (O->Y)" is done.
    • Old parent is shared root array.
    • New child is path of above 3.

Proposal

How about call rb_ary_modify before RARRAY_SET in process_options?
Or using rb_ary_store instead of RARRAY_SET may avoid the error.

Sample output

An example of full output is attached.
(Sorry, I GZipped it because of file-size limitation)
The snippet is here:

ruby 2.7.0dev (2019-05-04 trunk b72623012d) [x86_64-linux]
verify_internal_consistency_reachable_i: WB miss (O->Y) 0x000055c3262f3610 [3LM   ] T_ARRAY [   ] len: 20, capa:2 ptr:0x000055c326498380 -> 0x000055c3262f3908 [2  P  ] T_STRING (String) /home/wanabe/.rbenv/versions/trunk/lib/ruby/site_ruby/2.7.0
[all refs] (size: 5307)
(snip)
[allrefs_dump_i] 0x000055c3263349f8 [3LMP  ] T_ARRAY [E ] len: 0 (embed) <- <0x000055c326336f28 [0  P U] VM/thread (Thread) VM/thread>
./ruby: [BUG] Segmentation fault at 0x0000000000000010
ruby 2.7.0dev (2019-05-04 trunk b72623012d) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0001 p:0000 s:0003 E:0022c0 (none) [FINISH]


-- Machine register context ------------------------------------------------
 RIP: 0x000055c32452e15a RBP: 0x0000000000000001 RSP: 0x00007ffea126d470
 RAX: 0x0000000000000000 RBX: 0x000055c3262ef3c8 RCX: 0x0000000000000001
 RDX: 0x000055c324773446 RDI: 0x00007ff8c77cb680 RSI: 0x0000000000000001
  R8: 0x000055c3262ef3b8  R9: 0x0000000000000018 R10: 0x0000000000000018
 R11: 0x0000000000000246 R12: 0x0000000000000100 R13: 0x0000000000000005
 R14: 0x000055c3262f3c28 R15: 0x000055c3262ef1b0 EFL: 0x0000000000010206

-- C level backtrace information -------------------------------------------
/home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(rb_vm_bugreport+0x554) [0x55c324769fa4] ../../vm_dump.c:715
[0x55c324760088]
/home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(sigsegv+0x42) [0x55c324640d42] ../../signal.c:997
/lib/x86_64-linux-gnu/libpthread.so.0(__restore_rt+0x0) [0x7ff8c797ff40]
/home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(allrefs_dump+0x1a) [0x55c32452e15a] /usr/include/x86_64-linux-gnu/bits/stdio2.h:100
[0x55c32453a478]
[0x55c32453a64c]
[0x55c32453f874]
/home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(rb_str_dup+0x29) [0x55c32465aa59] ../../string.c:722
[0x55c32463f2e1]
/home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(ruby_process_options+0xc0) [0x55c3246404a0] ../../ruby.c:2380
/home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(ruby_options+0xca) [0x55c32451e1ea] ../../eval.c:118
/home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(main+0x67) [0x55c324519ec7] ../../main.c:42
(snip)
Aborted (core dumped)

Files

out.log.gz (114 KB) out.log.gz wanabe (_ wanabe), 05/04/2019 05:15 AM
Actions

Also available in: Atom PDF

Like0
Like0Like0Like0Like0Like0Like0Like0