Re: Segfault on armv5tel-linux-gnueabi

[Ludovic Courtès]

Hello,

Sooo, the test case can be reduced to this:

--8<---------------cut here---------------start------------->8---
(use-modules (ice-9 threads))

(define (test)
  (pk 'test)
  (let* ((m (make-mutex))
         (c (make-condition-variable))
         (t (begin-thread (begin (pk 'kid (current-thread)) (lock-mutex m)
                                 (wait-condition-variable c m)
                                 (pk 'kid-done (current-thread)))))
         (r (join-thread t (current-time))))
    (pk 'parent (current-thread))
    (cancel-thread t)
    (not r))) 

(test)
(test) ;; <- VM stack overflow, then segfault
(test)
--8<---------------cut here---------------end--------------->8---

With breakpoints at ‘pthread_cancel’ and ‘scm_error’, we get a nicer
backtrace:

--8<---------------cut here---------------start------------->8---
(gdb) thread apply all bt

Thread 2 (Thread 0x41257470 (LWP 23878)):
#0  scm_error (key=0xc7060, subr=0x0, message=0x403ba554 "Stack overflow", 
args=0x4, rest=0x4) at ../../libguile/error.c:61
#1  0x4036dbe0 in scm_report_stack_overflow () at ../../libguile/stackchk.c:58
#2  0x40392640 in scm_c_vm_run (vm=0x1f57e8, program=0x708e8, argv=0x41256cc8, 
nargs=4) at ../../libguile/vm.c:564
#3  0x40304344 in scm_call_4 (proc=0x708e8, arg1=<value optimized out>, 
arg2=<value optimized out>, arg3=<value optimized out>, arg4=0x1c1880) at 
../../libguile/eval.c:506
#4  0x4037ab40 in scm_catch_with_pre_unwind_handler (key=0x404, thunk=0x1c18a0, 
handler=0x1c1890, pre_unwind_handler=0x1c1880) at ../../libguile/throw.c:86
#5  0x402fb380 in scm_i_with_continuation_barrier (body=0x402fabdc <c_body>, 
body_data=0x41256d4c, handler=0x402faeb0 <c_handler>, handler_data=0x41256d4c, 
pre_unwind_handler=0x402fad10 <pre_unwind_handler>, 
    pre_unwind_handler_data=0xda340) at ../../libguile/continuations.c:450
#6  0x402fb440 in scm_c_with_continuation_barrier (func=<value optimized out>, 
data=<value optimized out>) at ../../libguile/continuations.c:546
#7  0x4012a2d8 in GC_call_with_stack_base () from 
/nix/store/iva9d3m74d1sw2ymas27kacnj2k3rp81-boehm-gc-7.2pre20110122/lib/libgc.so.1
#8  0x403788fc in scm_i_with_guile_and_parent (func=<value optimized out>, 
data=<value optimized out>) at ../../libguile/threads.c:919
#9  scm_with_guile (func=<value optimized out>, data=<value optimized out>) at 
../../libguile/threads.c:925
#10 0x4012a2d8 in GC_call_with_stack_base () from 
/nix/store/iva9d3m74d1sw2ymas27kacnj2k3rp81-boehm-gc-7.2pre20110122/lib/libgc.so.1
#11 0x4037861c in on_thread_exit (v=0x1a52a0) at ../../libguile/threads.c:716
#12 0x4015a348 in __nptl_deallocate_tsd () from 
/nix/store/x7n64n36xpqbsi10lgpr3x9f1z9jsp83-glibc-2.12.2/lib/libpthread.so.0
#13 0x40167ea4 in ?? () from 
/nix/store/x7n64n36xpqbsi10lgpr3x9f1z9jsp83-glibc-2.12.2/lib/libpthread.so.0
#14 0x40167ea4 in ?? () from 
/nix/store/x7n64n36xpqbsi10lgpr3x9f1z9jsp83-glibc-2.12.2/lib/libpthread.so.0
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Thread 1 (Thread 0x400a5000 (LWP 23877)):
#0  scm_cancel_thread (thread=<value optimized out>) at 
../../libguile/threads.c:1142
#1  0x40390524 in vm_regular_engine (vm=0xda3a8, program=0x0, argv=0x107160, 
nargs=404768) at ../../libguile/vm-i-system.c:892
#2  0x40392634 in scm_c_vm_run (vm=0xda3a8, program=0x1c1820, argv=0x0, 
nargs=0) at ../../libguile/vm.c:565
#3  0x40390524 in vm_regular_engine (vm=0xda3a8, program=0x107118, 
argv=0x10710c, nargs=404768) at ../../libguile/vm-i-system.c:892
#4  0x40392634 in scm_c_vm_run (vm=0xda3a8, program=0xe3670, argv=0xbed6b1ec, 
nargs=1) at ../../libguile/vm.c:565
#5  0x40304618 in scm_primitive_eval (exp=0x1b5820) at ../../libguile/eval.c:639
#6  0x40304698 in scm_eval (exp=0x1b5820, module_or_state=0x161828) at 
../../libguile/eval.c:673
#7  0x403566c4 in scm_shell (argc=<value optimized out>, argv=0xbed6b884) at 
../../libguile/script.c:402
#8  0x40321408 in invoke_main_func (body_data=0xbed6b718) at 
../../libguile/init.c:336
#9  0x402fabf0 in c_body (d=0xbed6b6c4) at ../../libguile/continuations.c:512
#10 0x4037a6f8 in apply_catch_closure (clo=<value optimized out>, args=0x304) 
at ../../libguile/throw.c:146
#11 0x4039031c in vm_regular_engine (vm=0xda3a8, program=0x107054, 
argv=0x107054, nargs=1747296) at ../../libguile/vm-i-system.c:960
#12 0x40392634 in scm_c_vm_run (vm=0xda3a8, program=0x708e8, argv=0xbed6b640, 
nargs=4) at ../../libguile/vm.c:565
#13 0x40304344 in scm_call_4 (proc=0x708e8, arg1=<value optimized out>, 
arg2=<value optimized out>, arg3=<value optimized out>, arg4=0x1aa940) at 
../../libguile/eval.c:506
#14 0x4037ab40 in scm_catch_with_pre_unwind_handler (key=0x404, thunk=0x1aa960, 
handler=0x1aa950, pre_unwind_handler=0x1aa940) at ../../libguile/throw.c:86
#15 0x402fb380 in scm_i_with_continuation_barrier (body=0x402fabdc <c_body>, 
body_data=0xbed6b6c4, handler=0x402faeb0 <c_handler>, handler_data=0xbed6b6c4, 
pre_unwind_handler=0x402fad10 <pre_unwind_handler>, 
    pre_unwind_handler_data=0xda340) at ../../libguile/continuations.c:450
#16 0x402fb440 in scm_c_with_continuation_barrier (func=<value optimized out>, 
data=<value optimized out>) at ../../libguile/continuations.c:546
#17 0x4037871c in with_guile_and_parent (base=0xbed6b6f0, data=<value optimized 
out>) at ../../libguile/threads.c:876
#18 0x4012a2d8 in GC_call_with_stack_base () from 
/nix/store/iva9d3m74d1sw2ymas27kacnj2k3rp81-boehm-gc-7.2pre20110122/lib/libgc.so.1
#19 0x403788fc in scm_i_with_guile_and_parent (func=<value optimized out>, 
data=<value optimized out>) at ../../libguile/threads.c:919
#20 scm_with_guile (func=<value optimized out>, data=<value optimized out>) at 
../../libguile/threads.c:925
#21 0x403214d0 in scm_boot_guile (argc=<value optimized out>, argv=<value 
optimized out>, main_func=<value optimized out>, closure=<value optimized out>) 
at ../../libguile/init.c:319
#22 0x000089a8 in main (argc=<value optimized out>, argv=<value optimized out>) 
at ../../libguile/guile.c:70
(gdb) thread 1
[Switching to thread 1 (Thread 0x400a5000 (LWP 23877))]#0  scm_cancel_thread 
(thread=<value optimized out>) at ../../libguile/threads.c:1142
1142    }
(gdb) p t
$14 = (scm_i_thread *) 0x1a52a0
(gdb) thread 2
[Switching to thread 2 (Thread 0x41257470 (LWP 23878))]#0  scm_error 
(key=0xc7060, subr=0x0, message=0x403ba554 "Stack overflow", args=0x4, 
rest=0x4) at ../../libguile/error.c:61
61          (key,
(gdb) p scm_i_current_thread 
$15 = (scm_i_thread *) 0x1a52a0
--8<---------------cut here---------------end--------------->8---

The thread experiencing the stack overflow is the one being canceled.
Its ‘on_thread_exit’ is called because it’s a pthread key destructor.

When ‘on_thread_exit’ is called, t->guile_mode == 1, which causes
‘with_guile_and_parent’ to keep t->base unchanged, which eventually
causes SCM_STACK_OVERFLOW_P to misdiagnose a stack overflow.

Adding ‘t->guile_mode = 0’ at the beginning of ‘on_thread_exit’ solves
this problem, because it forces t->base to be adjusted.

I’ll see how to solve it correctly.

Ludo’.