Created attachment 1238
segfault after realloc
Only reproduced on 64 bit posix systems.
This is kind of complicated. The reduced program needs to iterate a couple of
times (probably to corrupt the GC?) a few times before the problem will
trigger. The good news, is that the segfault deterministically repeats itselft,
so the debug "should" be easy to do.
It would *appear* that the core culprit is creating a dynamic array (or size
larger than 4080), and then calling realloc on "array.ptr". Now, I'm not 100%
sure this is legal to begin with, since "array.ptr" is actually offset by 16
bytes from the start of the memory block. Is that actually undefined behavior,
or does it just reduce the chances of the program working?
I'd simply leave it at that and move on, but there is something that bothers me
deeply:
//----
ubyte[] arr = new ubyte[](5000);
GC.realloc(arr.ptr, 0, GC.BlkAttr.NO_SCAN);
//----
This works 100% fine (AFAIK, never segfaulted), but this:
//----
ubyte[] arr;
arr.length = 5000;
GC.realloc(arr.ptr, 0, GC.BlkAttr.NO_SCAN);
//----
Doing this ends up segfaulting later down the line.
*** Why is the behavior different? ***
I believe it is worth trying to investigate this at least a little, we might be
able to unravel a bug somewhere inside the code...
The code is in the attachment. I've reduced it as much as I could.
If somebody with more skills (and is more used to debugging in a *nix
environment) could take a peak?
Comment #1 by maxim — 2013-07-23T03:56:52Z
Reduced:
import core.memory, std.array;
extern(C) int printf(const char*, ...);
void readt()
{
//ubyte[] result = new ubyte[](5000); //This works
ubyte[] result; result.length = 5000; //But this fails
GC.free(result.ptr);
result = null;
}
string toStr(long src)
{
auto w = appender!string();
return "";
}
void main()
{
foreach(int i; 0 .. 256)
{
printf("Step: %d\n", i);
string corruptme = "./temp";
foreach(e; 0 .. 256)
{
corruptme ~= toStr(1);
}
readt();
}
}
Removing appender makes bug go away.
Comment #2 by monarchdodra — 2013-07-23T05:04:48Z
(In reply to comment #1)
> Reduced:
> [...]
> Removing appender makes bug go away.
Nice.
Appender in itself isn't doing anything much. As long as an allocation occurs, any function will do:
//----
string toStr(long src)
{
new int;
return "";
}
//----
EG:
//----
import core.memory;
extern(C) int printf(const char*, ...);
void readt()
{
//ubyte[] result = new ubyte[](5000); //This works
ubyte[] result; result.length = 5000; //But this fails
GC.free(result.ptr);
result = null;
}
string toStr(long src)
{
new int;
return "";
}
void main()
{
foreach(int i; 0 .. 1024)
{
printf("Step: %d\n", i);
string corruptme = "./temp";
foreach(e; 0 .. 256)
{
corruptme ~= toStr(1);
}
readt();
}
}
//----
This still preserves the "This works/But this fails" issue. Cores on iteration 255 (adding more "new int" will divide that number by the amount of "new")
Comment #3 by maxim — 2013-07-23T06:07:35Z
(In reply to comment #2)
> (In reply to comment #1)
> > Reduced:
> > [...]
> > Removing appender makes bug go away.
>
> Nice.
>
> Appender in itself isn't doing anything much. As long as an allocation occurs,
> any function will do:
>
> //----
> string toStr(long src)
> {
> new int;
> return "";
> }
> //----
Then futher reduced:
import core.memory;
extern(C) int printf(const char*, ...);
void readt()
{
//ubyte[] result = new ubyte[](5000); //This works
ubyte[] result; result.length = 5000; //But this fails
GC.free(result.ptr); //works if commented out
result = null;
}
void main()
{
foreach(i; 0 .. 1024)
{
foreach(e; 0 .. 1024)
{
new int;
}
readt();
}
}
Comment #4 by safety0ff.bugz — 2013-10-25T12:16:48Z