GNU bug report logs - #26542
guile 2.0.13

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 26542 in the body.
You can then email your comments to 26542 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: romph <at> web.de
To: bug-guile <at> gnu.org
Subject: guile 2.0.13
Date: Mon, 17 Apr 2017 15:15:10 +0200

[Message part 1 (text/plain, inline)]

Hello,

The attached simple test calls free functions with bad smob_tag.
I see the same stuff with 2.2.0
There are no errors using the stable 2.0.11 version.

my system is:
Linux linux8 4.10.0-19-generic #21-Ubuntu SMP Thu Apr 6 17:04:57 UTC
2017 x86_64 x86_64 x86_64 GNU/Linux

[box.c (text/x-csrc, attachment)]

[Makefile (text/plain, attachment)]

[test.scm (text/x-scheme, attachment)]

Message #8 received at submit <at> debbugs.gnu.org (full text, mbox):

From: "Pach Roman (DGS-EC/ESG4)" <Roman.Pach <at> de.bosch.com>
To: "bug-guile <at> gnu.org" <bug-guile <at> gnu.org>
Subject: bug#26542: guile 2.0.13
Date: Tue, 18 Apr 2017 09:17:41 +0000

[Message part 1 (text/plain, inline)]

Hello!

I can confirm now the same problem on Cygwin.

2.0.11 runs without errors
2.0.13 behaves identically as on linux. i.e. the function free_box(SCM box_smob)
is called with a bad smob identifier.

[Message part 2 (text/html, inline)]

Message #13 received at 26542-close <at> debbugs.gnu.org (full text, mbox):

From: Andy Wingo <wingo <at> igalia.com>
To: romph <at> web.de
Cc: 26542-close <at> debbugs.gnu.org
Subject: Re: bug#26542: guile 2.0.13
Date: Wed, 19 Apr 2017 10:08:42 +0200

Hi,

romph <at> web.de writes:

> Hello,
>
> The attached simple test calls free functions with bad smob_tag.
> I see the same stuff with 2.2.0
> There are no errors using the stable 2.0.11 version.
>
> static size_t
> free_box (SCM box_smob)
> {
> 	if (SCM_TYP16(box_smob) != scm_tc16_box) {
> 		// bad type, do not free it
> 		fprintf (stderr, "[free] error: bad smob 0x%x\n", (int)SCM_TYP16(box_smob));
> 		exit (-1);
> 	}
> 	return 0;
> }

I believe this is fallout from this bug fix in which markers and
finalizers could race each other:

  https://debbugs.gnu.org/cgi/bugreport.cgi?bug=19883

The basic issue is that finalizers run asynchronously on values that are
still live, yet they can invalidate invariants on those live values.
Concurrent markers can then see objects which are being concurrently
finalized, causing intermittent hard-to-debug crashes that couldn't be
properly fixed.

The fix was to "null out" the SMOB tag before calling the finalizer, in
such a way to prevent future GCs from invoking the SMOB mark function on
an object that was being finalized.  So the new expectation is that
finalizers see the SMOB tag as being scm_tc7_smob + SMOB number 0,
indicating the "finalized" smob type.

I guess we weren't aware of how this might affect other users that check
the SMOB tag during the free function.  Apologies for that undocumented
change.  It was necessary though to fix 19883.

Andy

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.