Bug #17362: Thread core dump

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 2.7.2p137 (2020-10-01 revision 5445e04352) [x86_64-freebsd12.1]
• Backport: 2.5: UNKNOWN, 2.6: UNKNOWN, 2.7: UNKNOWN

[npic1 (Nat Pic1)]

Hi,
I moved from 2.4.10 to 2.7.2, and now I get one thread killed.
I am unable to isolate the root cause.

This is the backtrace from the core dump.

Program terminated with signal SIGABRT, Aborted.
#0  0x0000000808eda16a in thr_kill () from /lib/libc.so.7
[Current thread is 1 (LWP 101104)]


(gdb) info thre 1
  Id   Target Id                        Frame
* 1    LWP 101104 "XXXX::RRDNetworkT" 0x0000000808eda16a in thr_kill () from /lib/libc.so.7

(gdb) bt
#0  0x0000000808eda16a in thr_kill () from /lib/libc.so.7
#1  0x0000000808ed8594 in raise () from /lib/libc.so.7
#2  0x0000000808e4c799 in abort () from /lib/libc.so.7
#3  0x0000000000812459 in die () at error.c:632
#4  0x0000000000812660 in rb_bug_for_fatal_signal (default_sighandler=0x0, sig=11, ctx=0x8033bea00, fmt=0x250ef2 "uction at %p") at error.c:664
#5  0x000000000092fef6 in sigsegv (sig=11, info=0x8033bed70, ctx=0x8033bea00) at signal.c:945
#6  0x00000008059fc3ce in ?? () from /lib/libthr.so.3
#7  0x00000008059fb98f in ?? () from /lib/libthr.so.3
#8  <signal handler called>
#9  0x00000000009adfa5 in vm_call0_body (ec=0x802030650, calling=0x7fffdecf43b8, cd=0xa02b38 <num_funcall_op_1.rb_funcallv_data>, argv=0x7fffdecf4410)
    at ./vm_eval.c:117
#10 0x00000000009abf87 in rb_funcallv_with_cc (cd=0xa02b38 <num_funcall_op_1.rb_funcallv_data>, recv=8, mid=140, argc=1, argv=0x7fffdecf4410)
    at ./vm_eval.c:1012
#11 0x00000000008a517a in num_funcall_op_1 (y=0, arg=21, recursive=0) at numeric.c:364
#12 0x0000000000970dbd in exec_recursive (func=<optimized out>, obj=<optimized out>, pairid=<optimized out>, arg=<optimized out>, outer=<optimized out>)
    at thread.c:5051
#13 0x000000000089e1e7 in fix_equal (x=21, y=0) at numeric.c:4154
#14 rb_int_equal (x=21, y=0) at numeric.c:4166
#15 0x00000000009ae4e9 in vm_push_frame (ec=0x802030650, iseq=0x0, type=<optimized out>, self=1, specval=<optimized out>, cref_or_me=34860001040, pc=0x0,
    sp=0x802030650, local_size=0, stack_max=0) at ./vm_insnhelper.c:307
#16 vm_call0_cfunc_with_frame (ec=0x802030650, calling=<optimized out>, argv=<optimized out>, cd=<optimized out>) at ./vm_eval.c:85
#17 vm_call0_cfunc (ec=0x802030650, calling=<optimized out>, argv=<optimized out>, cd=<optimized out>) at ./vm_eval.c:105
#18 vm_call0_body (ec=0x802030650, calling=<optimized out>, cd=<optimized out>, argv=<optimized out>) at ./vm_eval.c:140
#19 0x00000000009abf87 in rb_funcallv_with_cc (cd=0xa03318 <rb_obj_not_equal.rb_funcallv_data>, recv=1, mid=140, argc=1, argv=0x7fffdecf46c0)
    at ./vm_eval.c:1012
#20 0x00000000008a67a5 in rb_obj_not_equal (obj1=0, obj2=21) at object.c:246
#21 0x00000000009bda40 in vm_call_cfunc_with_frame (ec=<optimized out>, reg_cfp=<optimized out>, calling=<optimized out>, cd=<optimized out>,
    empty_kw_splat=<optimized out>) at ./vm_insnhelper.c:2513
#22 vm_call_cfunc (ec=0x802030650, reg_cfp=0x7fffdedf4bf0, calling=<optimized out>, cd=<optimized out>) at ./vm_insnhelper.c:2539
#23 0x00000000009a4021 in vm_sendish (ec=<optimized out>, reg_cfp=<optimized out>, cd=0xe7073dd80, block_handler=0, method_explorer=<optimized out>)
    at ./vm_insnhelper.c:4013
#24 vm_exec_core (ec=<optimized out>, initial=<optimized out>) at insns.def:782
#25 0x00000000009b88aa in vm_push_frame (ec=<optimized out>, iseq=<optimized out>, type=2022178817, self=<optimized out>, specval=7, cref_or_me=0,
    pc=<optimized out>, sp=0x0, local_size=<optimized out>, stack_max=<optimized out>) at ./vm_insnhelper.c:303
#26 vm_exec_handle_exception (ec=<optimized out>, state=<optimized out>, errinfo=<optimized out>, initial=<optimized out>) at vm.c:2129
#27 rb_vm_exec (ec=<optimized out>, mjit_enable_p=<optimized out>) at vm.c:1927
#28 0x00000000009b11ce in VM_EP_LEP (ep=0x0) at vm.c:48
#29 VM_CF_LEP (cfp=<optimized out>) at vm.c:84
#30 VM_CF_BLOCK_HANDLER (cfp=<optimized out>) at vm.c:97
#31 check_block_handler (ec=<optimized out>) at vm.c:1159
#32 vm_yield (argc=<optimized out>, argv=0x15, ec=<optimized out>, kw_splat=<optimized out>) at vm.c:1179
#33 rb_yield_0 (argc=0, argv=0x802030650) at ./vm_eval.c:1227
#34 rb_yield_values2 (argc=0, argv=0x802030650) at ./vm_eval.c:1273
#35 0x000000000084a879 in each_pair_i_fast (key=<optimized out>, value=<optimized out>, _=0) at hash.c:3062
#36 0x000000000084183b in hash_ar_foreach_iter (key=56145041120, value=21, argp=<optimized out>, error=0) at hash.c:1337
#37 ar_foreach_check (hash=34518409680, arg=140736931515144, never=52, func=<optimized out>) at hash.c:962
#38 hash_foreach_call (arg=140736931515144) at hash.c:1485
#39 0x000000000081e3d7 in rb_ensure (b_proc=<optimized out>, data1=<optimized out>, e_proc=<optimized out>, data2=<optimized out>) at eval.c:1129
#40 0x0000000000841785 in rb_hash_foreach (hash=34518409680, func=0x84a850 <each_pair_i_fast>, farg=0) at hash.c:1509
#41 0x00000000008467ca in rb_hash_each_pair (hash=34518409680) at hash.c:3095
#42 0x00000000009bda40 in vm_call_cfunc_with_frame (ec=<optimized out>, reg_cfp=<optimized out>, calling=<optimized out>, cd=<optimized out>, empty_kw_splat=<optimized out>) at ./vm_insnhelper.c:2513
#43 vm_call_cfunc (ec=0x802030650, reg_cfp=0x7fffdedf4d08, calling=<optimized out>, cd=<optimized out>) at ./vm_insnhelper.c:2539
#44 0x00000000009a4021 in vm_sendish (ec=<optimized out>, reg_cfp=<optimized out>, cd=0xe1abbd140, block_handler=0, method_explorer=<optimized out>) at ./vm_insnhelper.c:4013
#45 vm_exec_core (ec=<optimized out>, initial=<optimized out>) at insns.def:782
#46 0x00000000009b88aa in vm_push_frame (ec=<optimized out>, iseq=<optimized out>, type=2022178817, self=<optimized out>, specval=57638207856, cref_or_me=0, pc=<optimized out>, sp=0x0, local_size=<optimized out>, stack_max=<optimized out>) at ./vm_insnhelper.c:303
#47 vm_exec_handle_exception (ec=<optimized out>, state=<optimized out>, errinfo=<optimized out>, initial=<optimized out>) at vm.c:2129
#48 rb_vm_exec (ec=<optimized out>, mjit_enable_p=<optimized out>) at vm.c:1927
#49 0x0000000000974f11 in thread_do_start (th=0xaa81420c0) at thread.c:693
#50 0x0000000000974896 in thread_start_func_2 (th=<optimized out>, stack_start=<optimized out>) at thread.c:745
#51 0x0000000000974462 in list_node_init (n=0x0) at ./ccan/list/list.h:103
#52 native_thread_init (th=0xaa81420c0) at ./thread_pthread.c:603
#53 thread_start_func_1 (th_ptr=0xaa81420c0) at ./thread_pthread.c:966
#54 0x00000008059f6736 in ?? () from /lib/libthr.so.3
#55 0x0000000000000000 in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffdedf5000

(gdb) rb_ps
$1 = (rb_vm_t *) 0x81217d000
* #<Thread:0x81a04bf60 rb_thread_t:0x812579000 native_thread:0x810837000>
8:0x9725b0 <thread_raise_m+96 at thread.c:2430>:in `join'
No symbol "RUBY_IMEMO_MASK" in current context.

[jeremyevans0 (Jeremy Evans)]

• Status changed from Open to Feedback

Can you please provide a minimal self-contained example showing the problem? Without it, I'm afraid there is not much we can do to help.

[mame (Yusuke Endoh)]

I suspect this is the same issue as #17289 because the segfault occurs immediately after rb_funcallv_with_cc, but I'm not 100% sure. Unfortunately, there is no reproducible code of this issue that is available for ruby core developers, so we cannot address the issue yet.

[npic1 (Nat Pic1)]

jeremyevans0 (Jeremy Evans) wrote in #note-1:

Can you please provide a minimal self-contained example showing the problem? Without it, I'm afraid there is not much we can do to help.

Sorry I was unable to understand which block of code cause the fault to isolate it. Using v2.6.6 the code works without issues.

[mame (Yusuke Endoh)]

• Related to Bug #17289: Time#strftime occurs Segmentation Fault on ruby-2.7.2p137 added

[mame (Yusuke Endoh)]

Using v2.6.6 the code works without issues.

Thanks. It is also the same as #17289.

Can you provide us the core file? I cannot promise anything, but we may investigate the issue.

[npic1 (Nat Pic1)]

mame (Yusuke Endoh) wrote in #note-5:

Using v2.6.6 the code works without issues.

Thanks. It is also the same as #17289.

Can you provide us the core file? I cannot promise anything, but we may investigate the issue.

Sorry, for policy reasons, I can't share the core dump.

[mame (Yusuke Endoh)]

npic1 (Nat Pic1) wrote in #note-6:

Sorry, for policy reasons, I can't share the core dump.

I see, thank you for your consideration.

[mame (Yusuke Endoh)]

• Related to Bug #17382: Segfault in String#inspect added

[jeremyevans0 (Jeremy Evans)]

• Status changed from Feedback to Closed