ruby-core

I found following test script dumps core.

% ruby -v
ruby 1.9.0 (2006-01-10) [x86_64-linux]
% cat tst.rb 
require 'test/unit'
require 'bdb'
require 'fileutils'

DBDIR = "db"

class T < Test::Unit::TestCase
  def test1

    FileUtils.rm_rf(DBDIR)
    Dir.mkdir(DBDIR)

    @db_env = BDB::Env.new(DBDIR, BDB::CREATE | BDB::INIT_MPOOL)
    options = {}
    options["env"] = @db_env
    options["set_store_key"] = lambda {|k| k }
    db = BDB::Btree.open('d', nil, BDB::CREATE, 0644, options)
    db["k"] = "v"

    GC.stress = true
    exit
  end
end

% ruby tst.rb 
Loaded suite tst
Started
zsh: segmentation fault (core dumped)  ruby tst.rb
% gdb ruby core
GNU gdb 6.3-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `tst.rb test1'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux-x86-64.so.2...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /home/akr/ruby/lib/ruby/site_ruby/1.9/x86_64-linux/bdb.so...done.
Loaded symbols for /home/akr/ruby/lib/ruby/site_ruby/1.9/x86_64-linux/bdb.so
Reading symbols from /usr/lib/libdb-4.2.so...done.
Loaded symbols for /usr/lib/libdb-4.2.so
Reading symbols from /home/akr/ruby/lib/ruby/1.9/x86_64-linux/etc.so...done.
Loaded symbols for /home/akr/ruby/lib/ruby/1.9/x86_64-linux/etc.so
#0  0x000000000049701f in st_lookup (table=0x68d240, key=4023, value=0x7fbffff030) at st.c:240
240         hash_val = do_hash(key, table);
(gdb) bt
#0  0x000000000049701f in st_lookup (table=0x68d240, key=4023, value=0x7fbffff030) at st.c:240
#1  0x000000000040fc9f in search_method (klass=182901917664, id=4023, origin=0x7fbffff080) at eval.c:435
#2  0x000000000040fd1d in rb_get_method_body (klassp=0x7fbffff0e8, idp=0x7fbffff0e0, noexp=0x7fbffff0dc) at eval.c:453
#3  0x000000000040ffd8 in rb_method_node (klass=182901917664, id=4023) at eval.c:513
#4  0x0000000000418eda in rb_obj_respond_to (obj=182901917704, id=7785, priv=0) at eval.c:4016
#5  0x0000000000418f7e in rb_respond_to (obj=182901917704, id=7785) at eval.c:4031
#6  0x0000002a95d33a15 in bdb_final (envst=0x76a580) at env.c:801
#7  0x0000002a95d33b35 in bdb_env_free (envst=0x76a580) at env.c:839
#8  0x0000000000433c25 in obj_free (obj=182901920344) at gc.c:1183
#9  0x00000000004335c1 in gc_sweep () at gc.c:1061
#10 0x0000000000434070 in garbage_collect () at gc.c:1388
#11 0x00000000004327f6 in rb_newobj () at gc.c:415
#12 0x00000000004613c7 in rb_node_newnode (type=NODE_MEMO, a0=0, a1=0, a2=0) at parse.y:6880
#13 0x000000000041bbe9 in rb_protect (proc=0x2a95d219d4 <i_close>, data=7743168, state=0x0) at eval.c:5227
#14 0x0000002a95d21aa1 in bdb_free (dbst=0x7626c0) at common.c:776
#15 0x0000000000434c6e in rb_gc_call_finalizer_at_exit () at gc.c:1875
#16 0x00000000004117b0 in ruby_finalize_1 () at eval.c:1456
#17 0x0000000000411915 in ruby_cleanup (ex=0) at eval.c:1493
#18 0x0000000000411b08 in ruby_stop (ex=0) at eval.c:1537
#19 0x0000000000411b55 in ruby_run () at eval.c:1549
#20 0x000000000040f543 in main (argc=2, argv=0x7fbffff9e8, envp=0x7fbffffa00) at main.c:43
(gdb) 

Clearly the segmentation fault means a bug.

However I'm not sure which should be fixed: bdb binding or
ruby interpreter.

The problem is caused by bdb_env_free is called by GC called
by bdb_free called by rb_gc_call_finalizer_at_exit.

Usually GC is not started in bdb_free because during_gc but
rb_gc_call_finalizer_at_exit doesn't set during_gc.

Apart from that I feel bdb_free and bdb_env_final is too
complex for T_DATA freeing function.  They has object
allocation, rb_respond_to, etc.
-- 
Tanaka Akira

Thread

Prev Next

In This Thread

Prev Next