SIGSEGV from jemalloc.c running ruby test suite

To: current-users%netbsd.org@localhost
Subject: SIGSEGV from jemalloc.c running ruby test suite
From: rudolf <netbsd%eq.cz@localhost>
Date: Sun, 22 Apr 2012 11:58:24 +0200

Hi,

When running ruby (ruby-lang.org) test suite, I am able to provoke asegfault using one test [1] (it segfaults in about one in 10 tries). Thebacktrace (attached) points to a jemalloc.c source code file.

I don't know if this is a NetBSD or Ruby problem, so if somebodyrecognizes that, please let me know, I can then file a PR at theappropriate site.


Environment:
- NetBSD-6.0_BETA amd64, from 2012/04/21

- ruby_1_9_3 branch, revision 35416 (I've also tried the ruby193 packagefrom pkgsrc and it has similar problem)

- 8 GB RAM, a lot of free memory, dual-core CPU

It is easy to provoke the problem with this command launched in shell(1-20 times until the problem shows):

$ ruby -e "Thread.new { fork { GC.start } }.join"

Thanks,

r.


[1] test from bootstraptest/test_thread.rb:
begin
  Thread.new { fork { GC.start } }.join
  pid, status = Process.wait2
  $result = status.success? ? :ok : :ng
rescue NotImplementedError
  $result = :ok
end

$ gdb /opt/src/ruby_1_9_3-r35416/ruby ruby.core 
GNU gdb (GDB) 7.3.1
[...]
This GDB was configured as "x86_64--netbsd".
[...]
Reading symbols from /opt/src/ruby_1_9_3-r35416/ruby...done.
[New process 1]
[New process 2]
Core was generated by `ruby'.
Program terminated with signal 6, Aborted.
#0  0x00007f7ff68ec8ca in _lwp_kill () from /usr/lib/libc.so.12
(gdb) bt
#0  0x00007f7ff68ec8ca in _lwp_kill () from /usr/lib/libc.so.12
#1  0x00007f7ff68ec202 in abort () at /usr/src/lib/libc/stdlib/abort.c:74
#2  0x0000000000571b1c in rb_bug (fmt=0x5af5e7 "Segmentation fault") at 
error.c:284
#3  0x00000000004b8aa4 in sigsegv (sig=11) at signal.c:609
#4  <signal handler called>
#5  0x00007f7ff689e1dc in choose_arena () at 
/usr/src/lib/libc/stdlib/jemalloc.c:1575
#6  imalloc (size=72) at /usr/src/lib/libc/stdlib/jemalloc.c:2988
#7  0x00007f7ff689e229 in malloc (size=72) at 
/usr/src/lib/libc/stdlib/jemalloc.c:3701
#8  0x00007f7ff7808c43 in pthread__attr_init_private (attr=<optimized out>) at 
/usr/src/lib/libpthread/pthread_attr.c:61
#9  0x00007f7ff7808ca8 in _pthread_attr_get_np (thread=0x7f7ff5000000, 
attr=0x7f7ff57fe9f0) at /usr/src/lib/libpthread/pthread_attr.c:100
#10 0x00007f7ff7809080 in pthread_getattr_np (thread=0x7f7ff5000000, 
attr=0x7f7ff57fe9f0) at /usr/src/lib/libpthread/pthread_attr.c:459
#11 0x00000000005341b7 in get_stack (addr=0x7f7ff57fea48, size=0x7f7ff57fea50) 
at thread_pthread.c:487
#12 0x00000000005342ad in ruby_init_stack (addr=0x7f7ff57feaf8) at 
thread_pthread.c:586
#13 0x0000000000417320 in ruby_cleanup (ex=0) at eval.c:129
#14 0x00000000004176b3 in ruby_stop (ex=0) at eval.c:216
#15 0x0000000000478f55 in rb_f_fork (obj=140187593688320) at process.c:2815
#16 0x000000000051bf5b in call_cfunc (func=0x478ee4 <rb_f_fork>, 
recv=140187593688320, len=0, argc=0, argv=0x7f7ff6700038) at vm_insnhelper.c:320
#17 0x000000000051c886 in vm_call_cfunc (th=0x7f7ff6f31400, 
reg_cfp=0x7f7ff67ffef8, num=0, recv=140187593688320, blockptr=0x7f7ff67fff20, 
me=0x7f7ff730cf40) at vm_insnhelper.c:404
#18 0x000000000051cf64 in vm_call_method (th=0x7f7ff6f31400, 
cfp=0x7f7ff67ffef8, num=0, blockptr=0x7f7ff67fff20, flag=8, id=8272, 
me=0x7f7ff730cf40, recv=140187593688320) at vm_insnhelper.c:534
#19 0x00000000005228e4 in vm_exec_core (th=0x7f7ff6f31400, initial=0) at 
insns.def:1015
#20 0x000000000052ff81 in vm_exec (th=0x7f7ff6f31400) at vm.c:1220
#21 0x000000000052e8b3 in invoke_block_from_c (th=0x7f7ff6f31400, 
block=0x7f7ff7356a60, self=140187593688320, argc=0, argv=0x7f7ff6fbdc00, 
blockptr=0x0, cref=0x0) at vm.c:624
#22 0x000000000052eae9 in rb_vm_invoke_proc (th=0x7f7ff6f31400, 
proc=0x7f7ff7356a60, self=140187593688320, argc=0, argv=0x7f7ff6fbdc00, 
blockptr=0x0) at vm.c:670
#23 0x0000000000535649 in thread_start_func_2 (th=0x7f7ff6f31400, 
stack_start=0x7f7ff5800000) at thread.c:453
#24 0x00000000005343cf in thread_start_func_1 (th_ptr=0x7f7ff6f31400) at 
thread_pthread.c:653
#25 0x00007f7ff7809d75 in pthread__create_tramp (cookie=0x7f7ff5000000) at 
/usr/src/lib/libpthread/pthread.c:492
#26 0x00007f7ff6876ef0 in ___lwp_park50 () from /usr/lib/libc.so.12
#27 0x00007f7ff5800000 in ?? ()
#28 0x00007f7ff7ffe3c0 in ?? ()
#29 0x0000000111110001 in ?? ()
#30 0x0000000033330003 in ?? ()
#31 0x0000000000000000 in ?? ()
(gdb) bt full
#0  0x00007f7ff68ec8ca in _lwp_kill () from /usr/lib/libc.so.12
No symbol table info available.
#1  0x00007f7ff68ec202 in abort () at /usr/src/lib/libc/stdlib/abort.c:74
        mask = {__bits = {4294967263, 4294967295, 4294967295, 4294967295}}
#2  0x0000000000571b1c in rb_bug (fmt=0x5af5e7 "Segmentation fault") at 
error.c:284
        args = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 
0x7f7ff57fe4e0, reg_save_area = 0x7f7ff57fe410}}
        file = 0x7f7ff7b81820 "-e"
        line = 1
#3  0x00000000004b8aa4 in sigsegv (sig=11) at signal.c:609
No locals.
#4  <signal handler called>
No symbol table info available.
#5  0x00007f7ff689e1dc in choose_arena () at 
/usr/src/lib/libc/stdlib/jemalloc.c:1575
        curcpu = 4294967295
        map = 0x7f7ff7fe7010
#6  imalloc (size=72) at /usr/src/lib/libc/stdlib/jemalloc.c:2988
No locals.
#7  0x00007f7ff689e229 in malloc (size=72) at 
/usr/src/lib/libc/stdlib/jemalloc.c:3701
        ret = <optimized out>
#8  0x00007f7ff7808c43 in pthread__attr_init_private (attr=<optimized out>) at 
/usr/src/lib/libpthread/pthread_attr.c:61
        p = <optimized out>
#9  0x00007f7ff7808ca8 in _pthread_attr_get_np (thread=0x7f7ff5000000, 
attr=0x7f7ff57fe9f0) at /usr/src/lib/libpthread/pthread_attr.c:100
        p = <optimized out>
#10 0x00007f7ff7809080 in pthread_getattr_np (thread=0x7f7ff5000000, 
attr=0x7f7ff57fe9f0) at /usr/src/lib/libpthread/pthread_attr.c:459
        error = 0
#11 0x00000000005341b7 in get_stack (addr=0x7f7ff57fea48, size=0x7f7ff57fea50) 
at thread_pthread.c:487
        err = 32639
        attr = {pta_magic = 572653570, pta_flags = 0, pta_private = 0x0}
        guard = 0
#12 0x00000000005342ad in ruby_init_stack (addr=0x7f7ff57feaf8) at 
thread_pthread.c:586
        size = 0
        space = 0
        addr = 0x5370ee
#13 0x0000000000417320 in ruby_cleanup (ex=0) at eval.c:129
        state = 0
        errs = {1, 4}
        th = 0x7f7ff6f31400
        nerr = 4
#14 0x00000000004176b3 in ruby_stop (ex=0) at eval.c:216
No locals.
#15 0x0000000000478f55 in rb_f_fork (obj=140187593688320) at process.c:2815
        status = 0
        pid = 0
#16 0x000000000051bf5b in call_cfunc (func=0x478ee4 <rb_f_fork>, 
recv=140187593688320, len=0, argc=0, argv=0x7f7ff6700038) at vm_insnhelper.c:320
No locals.
#17 0x000000000051c886 in vm_call_cfunc (th=0x7f7ff6f31400, 
reg_cfp=0x7f7ff67ffef8, num=0, recv=140187593688320, blockptr=0x7f7ff67fff20, 
me=0x7f7ff730cf40) at vm_insnhelper.c:404
        val = 0
        def = 0x7f7ff7316b20
        cfp = 0x7f7ff67ffea0
#18 0x000000000051cf64 in vm_call_method (th=0x7f7ff6f31400, 
cfp=0x7f7ff67ffef8, num=0, blockptr=0x7f7ff67fff20, flag=8, id=8272, 
me=0x7f7ff730cf40, recv=140187593688320) at vm_insnhelper.c:534
        val = 8272
#19 0x00000000005228e4 in vm_exec_core (th=0x7f7ff6f31400, initial=0) at 
insns.def:1015
        v = 0
        me = 0x7f7ff730cf40
        recv = 140187593688320
        flag = 8
        klass = 140187593688280
        blockptr = 0x7f7ff67fff20
        num = 0
        id = 8272
        val = 0
        ic = 0x7f7ff6f8d920
        blockiseq = 0x7f7ff6f6c400
        op_argc = 0
        op_id = 8272
        op_flag = 8
        reg_pc = 0x7f7ff7356a08
        reg_cfp = 0x7f7ff67ffef8
        insns_address_table = {0x51fdae, 0x51fdc9, 0x51fe66, 0x51fedf, 
0x51ff99, 0x520016, 0x5200f4, 0x5201ad, 0x520260, 0x5202ee, 0x5203b8, 0x52045d, 
0x520533, 0x5205f0, 0x520681, 0x5206f0, 0x520765, 0x5207dd, 0x520858, 
          0x52095f, 0x5209ef, 0x520a80, 0x520b9b, 0x520c42, 0x520d94, 0x520e60, 
0x520ef1, 0x520f7d, 0x5210ff, 0x5211e5, 0x521459, 0x5215a0, 0x521680, 0x5216c5, 
0x521795, 0x521852, 0x52191b, 0x5219ac, 0x521a49, 0x521b12, 
          0x521b60, 0x52213a, 0x5221d2, 0x522768, 0x52297c, 0x522bf5, 0x522cd7, 
0x522e1f, 0x522e7f, 0x522f23, 0x522f89, 0x523026, 0x5230c3, 0x523198, 0x5232b0, 
0x5233b8, 0x523570, 0x5235d9, 0x5239c4, 0x523d16, 0x52409c, 
          0x5244de, 0x5248e0, 0x524abc, 0x524d28, 0x525034, 0x525253, 0x52555f, 
0x52577e, 0x5259f2, 0x525c6b, 0x525f38, 0x526238, 0x526538, 0x52681f, 0x5269fd, 
0x526abf, 0x526bca, 0x526c67, 0x526ce9}
#20 0x000000000052ff81 in vm_exec (th=0x7f7ff6f31400) at vm.c:1220
        _th = 0x7f7ff6f31400
        _tag = {buf = {140187580941056, 140187556379168, 5456777, 
140187580699768, 1, 140187547992064, 140187556378824, 5439330, 140187572109344, 
0, 140187580941056}, tag = 0, retval = 4, prev = 0x7f7ff57ffb10}
        state = 0
        result = 140187580941056
        err = 33
        initial = 0
        escape_dfp = 0x0
#21 0x000000000052e8b3 in invoke_block_from_c (th=0x7f7ff6f31400, 
block=0x7f7ff7356a60, self=140187593688320, argc=0, argv=0x7f7ff6fbdc00, 
blockptr=0x0, cref=0x0) at vm.c:624
        iseq = 0x7f7ff6f6c300
        cfp = 0x7f7ff67fff50
        i = 0
        arg_size = 0
        type = 33
        ncfp = 0x7f7ff67ffef8
        opt_pc = 0
#22 0x000000000052eae9 in rb_vm_invoke_proc (th=0x7f7ff6f31400, 
proc=0x7f7ff7356a60, self=140187593688320, argc=0, argv=0x7f7ff6fbdc00, 
blockptr=0x0) at vm.c:670
        _th = 0x7f7ff6f31400
        _tag = {buf = {140187580699648, 140187556379568, 5456777, 
140187580699768, 1, 140187547992064, 140187556379336, 5433980, 140187593218064, 
5989264, 140187556379536}, tag = 0, retval = 1, prev = 0x7f7ff57ffbd0}
        val = 6
        state = 0
        stored_safe = 0
#23 0x0000000000535649 in thread_start_func_2 (th=0x7f7ff6f31400, 
stack_start=0x7f7ff5800000) at thread.c:453
        _th = 0x7f7ff6f31400
        _tag = {buf = {140187547992064, 140187556379792, 5456777, 
140187580699768, 1, 140187547992064, 140187556379576, 5461322, 140187556379768, 
140187556379776, 0}, tag = 0, retval = 140187547992064, prev = 0x0}
        state = 0
        args = 140187581275120
        proc = 0x7f7ff7356a60
        join_th = 0x534169
        main_th = 0x7f7f66660006
        errinfo = 4
#24 0x00000000005343cf in thread_start_func_1 (th_ptr=0x7f7ff6f31400) at 
thread_pthread.c:653
        th = 0x7f7ff6f31400
#25 0x00007f7ff7809d75 in pthread__create_tramp (cookie=0x7f7ff5000000) at 
/usr/src/lib/libpthread/pthread.c:492
        self = 0x7f7ff5000000
        retval = 0xffffffff
#26 0x00007f7ff6876ef0 in ___lwp_park50 () from /usr/lib/libc.so.12
[...]

Follow-Ups:
- Re: SIGSEGV from jemalloc.c running ruby test suite
  - From: David Laight

Prev by Date: Re: Improving support for Sun Type 7 USB keyboards
Next by Date: Re: SIGSEGV from jemalloc.c running ruby test suite
Previous by Thread: daily CVS update output
Next by Thread: Re: SIGSEGV from jemalloc.c running ruby test suite
Indexes:

Home | Main Index | Thread Index | Old Index