GNU bug report logs - #26542
guile 2.0.13

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Andy Wingo <wingo <at> igalia.com>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#26542: closed (guile 2.0.13)
Date: Wed, 19 Apr 2017 08:09:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Wed, 19 Apr 2017 10:08:42 +0200
with message-id <87pog8es51.fsf <at> igalia.com>
and subject line Re: bug#26542: guile 2.0.13
has caused the debbugs.gnu.org bug report #26542,
regarding guile 2.0.13
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
26542: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=26542
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: romph <at> web.de
To: bug-guile <at> gnu.org
Subject: guile 2.0.13
Date: Mon, 17 Apr 2017 15:15:10 +0200

[Message part 3 (text/plain, inline)]

Hello,

The attached simple test calls free functions with bad smob_tag.
I see the same stuff with 2.2.0
There are no errors using the stable 2.0.11 version.

my system is:
Linux linux8 4.10.0-19-generic #21-Ubuntu SMP Thu Apr 6 17:04:57 UTC
2017 x86_64 x86_64 x86_64 GNU/Linux

[box.c (text/x-csrc, attachment)]

[Makefile (text/plain, attachment)]

[test.scm (text/x-scheme, attachment)]

[Message part 7 (message/rfc822, inline)]

From: Andy Wingo <wingo <at> igalia.com>
To: romph <at> web.de
Cc: 26542-close <at> debbugs.gnu.org
Subject: Re: bug#26542: guile 2.0.13
Date: Wed, 19 Apr 2017 10:08:42 +0200

Hi,

romph <at> web.de writes:

> Hello,
>
> The attached simple test calls free functions with bad smob_tag.
> I see the same stuff with 2.2.0
> There are no errors using the stable 2.0.11 version.
>
> static size_t
> free_box (SCM box_smob)
> {
> 	if (SCM_TYP16(box_smob) != scm_tc16_box) {
> 		// bad type, do not free it
> 		fprintf (stderr, "[free] error: bad smob 0x%x\n", (int)SCM_TYP16(box_smob));
> 		exit (-1);
> 	}
> 	return 0;
> }

I believe this is fallout from this bug fix in which markers and
finalizers could race each other:

  https://debbugs.gnu.org/cgi/bugreport.cgi?bug=19883

The basic issue is that finalizers run asynchronously on values that are
still live, yet they can invalidate invariants on those live values.
Concurrent markers can then see objects which are being concurrently
finalized, causing intermittent hard-to-debug crashes that couldn't be
properly fixed.

The fix was to "null out" the SMOB tag before calling the finalizer, in
such a way to prevent future GCs from invoking the SMOB mark function on
an object that was being finalized.  So the new expectation is that
finalizers see the SMOB tag as being scm_tc7_smob + SMOB number 0,
indicating the "finalized" smob type.

I guess we weren't aware of how this might affect other users that check
the SMOB tag during the free function.  Apologies for that undocumented
change.  It was necessary though to fix 19883.

Andy

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.