Bug #9718: Segmentation fault is occurred on trunk and 2.1

• Status: Closed
• Assignee: ko1 (Koichi Sasada)
• Target version: 2.2.0
• ruby -v: ruby 2.2.0dev (2014-04-09 trunk 45543) [x86_64-darwin13]
• Backport: 2.0.0: DONTNEED, 2.1: DONE

[mrkn (Kenta Murata)]

The following code occurs segmentation fault on trunk and 2.1.

require 'thread'

queue = Queue.new

thread = Thread.start do
  loop do
    queue.pop.call
  end
end

loop do
  queue << -> do
    p Time.now
    sleep 1
  end
end

Execution log:

2014-04-09 22:10:07 +0900
2014-04-09 22:10:08 +0900
2014-04-09 22:10:09 +0900
2014-04-09 22:10:10 +0900
2014-04-09 22:10:12 +0900
2014-04-09 22:10:13 +0900
2014-04-09 22:10:14 +0900
2014-04-09 22:10:15 +0900
2014-04-09 22:10:16 +0900
2014-04-09 22:10:17 +0900
test2.rb:7: [BUG] Segmentation fault at 0x00000000000000
ruby 2.1.2p80 (2014-03-01 revision 45231) [x86_64-darwin13.0]

-- Crash Report log information --------------------------------------------
   See Crash Report log file under the one of following:
     * ~/Library/Logs/CrashReporter
     * /Library/Logs/CrashReporter
     * ~/Library/Logs/DiagnosticReports
     * /Library/Logs/DiagnosticReports
   for more details.

-- Control frame information -----------------------------------------------
c:0004 p:0011 s:0010 e:000008 BLOCK  test2.rb:7 [FINISH]
c:0003 p:---- s:0007 e:000006 CFUNC  :loop
c:0002 p:0007 s:0004 e:000003 BLOCK  test2.rb:6 [FINISH]
c:0001 p:---- s:0002 e:000001 TOP    [FINISH]

test2.rb:6:in `block in <main>'
test2.rb:6:in `loop'
test2.rb:7:in `block (2 levels) in <main>'

-- C level backtrace information -------------------------------------------
0   libruby.2.1.0.dylib                 0x000000010a134119 rb_print_backtrace + 25
1   libruby.2.1.0.dylib                 0x000000010a134239 rb_vm_bugreport + 153
2   libruby.2.1.0.dylib                 0x0000000109f42017 report_bug + 375
3   libruby.2.1.0.dylib                 0x0000000109f41e6a rb_bug + 426
4   libruby.2.1.0.dylib                 0x000000010a076650 init_sigchld + 0
5   libsystem_platform.dylib            0x00007fff85de95aa _sigtramp + 26
6   libruby.2.1.0.dylib                 0x000000010a083d78 st_lookup + 24
7   ???                                 0x000000010a697ab0 0x0 + 4469652144

-- Other runtime information -----------------------------------------------

* Loaded script: test2.rb

* Loaded features:

    0 enumerator.so
    1 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/x86_64-darwin13.0/enc/encdb.bundle
    2 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/x86_64-darwin13.0/enc/trans/transdb.bundle
    3 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/x86_64-darwin13.0/rbconfig.rb
    4 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/compatibility.rb
    5 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/defaults.rb
    6 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/deprecate.rb
    7 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/errors.rb
    8 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/version.rb
    9 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/requirement.rb
   10 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/platform.rb
   11 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/basic_specification.rb
   12 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/stub_specification.rb
   13 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/util/stringio.rb
   14 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/specification.rb
   15 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/exceptions.rb
   16 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/core_ext/kernel_gem.rb
   17 thread.rb
   18 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/x86_64-darwin13.0/thread.bundle
   19 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/monitor.rb
   20 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems/core_ext/kernel_require.rb
   21 /Users/mrkn/work/emsegv/lib/ruby/2.1.0/rubygems.rb

[NOTE]
You may have encountered a bug in the Ruby interpreter or extension libraries.
Bug reports are welcome.
For details: http://www.ruby-lang.org/bugreport.html

Abort trap: 6

[mrkn (Kenta Murata)]

• File ruby_2014-04-09-221019_P524.crash ruby_2014-04-09-221019_P524.crash added

[mrkn (Kenta Murata)]

• Description updated (diff)

[mrkn (Kenta Murata)]

• ruby -v changed from ruby 2.1.2p80 (2014-03-01 revision 45231) [x86_64-darwin13.0] to ruby 2.2.0dev (2014-04-09 trunk 45543) [x86_64-darwin13]

[normalperson (Eric Wong)]

Reproducible on ruby 2.2.0dev (2014-04-09 trunk 45543) [x86_64-linux]
Not reproducible on ruby 2.0.0p451 [x86_64-linux]

I tried the pure Ruby thread.rb from 2.0.0 with trunk, but the segfault
still happens, so I do not think this is a problem with the new thread.so

Looks like a GC problem, valgrind -v output: http://yhbt.net/9718.txt
I'm stuck for now :<

[nobu (Nobuyoshi Nakada)]

• Category set to core
• Status changed from Open to Assigned
• Assignee set to ko1 (Koichi Sasada)

With RGENGC_CHECK_MODE=4, lots of messages emitted:

verify_internal_consistency_reachable_i: WB miss 0x7fe65187f598 (T_ARRAY) -> 0x7fe65187f110 (proc)

The values of proc varies but T_ARRAY does not change.

[ko1 (Koichi Sasada)]

• Status changed from Assigned to Closed
• % Done changed from 0 to 100

Applied in changeset r45553.

---

• array.c (rb_ary_modify): remember shared array owner if a shared
  array owner is promoted and a shared array is not promoted.
  Now, shared array is WB-unprotected so that shared arrays are not
  promoted. All objects referred from shared array should be marked
  correctly.
  [ruby-core:61919] [ruby-trunk - Bug #9718]
• test/ruby/test_array.rb: add a test for above.

[mrkn (Kenta Murata)]

I confirmed that porting r45553 back to 2.1 is resolved this issue on 2.1.
Please backport it into ruby_2_1 branch.

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.0.0: UNKNOWN, 2.1: REQUIRED to 2.0.0: DONTNEED, 2.1: REQUIRED

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.0.0: DONTNEED, 2.1: REQUIRED to 2.0.0: DONTNEED, 2.1: DONE

r45553, r45554, r45557, r45558, r45561, r45566 and r45567 were backported into ruby_2_1 at r46006.