Segfaults on mutiple thread app + multiple thread-chan on janet_sweep

[Geo-7]

When I was working on my proxy example with multiple threads and multiple thread-chans, I encountered segfaults. I tried to reproduce this issue with a simple scenario :

janet version: 1.30.0-2ac36a05 on linux

init.janet

(defn producer [conn-chan no]
  (forever
    (def another-garbage @"I'm creating another garbage haha!")
    (ev/give conn-chan (math/random))))

(defn consumer [conn-chan no]
  (forever
    (def num (ev/take conn-chan))
    (def my-garbage @"I'm creating garbage haha!")
    ))

(defn main [& args]
  (def conn-chans @[])
  (for i 0 2
    (array/push conn-chans (ev/thread-chan 1000))
    (ev/spawn-thread (producer (conn-chans i) i))
    (ev/spawn-thread (consumer (conn-chans i) (+ (* i 10) i)))
    (ev/spawn-thread (consumer (conn-chans i) (+ (* i 10) i 1)))
    )
  )

Valgrind summery

==43801== Process terminating with default action of signal 11 (SIGSEGV)
==43801==  General Protection Fault
==43801==    at 0x12C259: janet_sweep (gc.c:336)
==43801==    by 0x12FEBE: janet_collect (gc.c:459)
==43801==    by 0x12FEBE: janet_collect (gc.c:436)
==43801==    by 0x158290: run_vm (vm.c:1263)
==43801==    by 0x15D7B2: janet_continue_no_check (vm.c:1515)
==43801==    by 0x15E7B7: janet_loop1 (ev.c:1323)
==43801==    by 0x15EBA4: janet_loop (ev.c:1392)
==43801==    by 0x15EE48: janet_go_thread_subr (ev.c:2943)
==43801==    by 0x11E4CB: janet_thread_body (ev.c:2096)
==43801==    by 0x49E9B42: start_thread (pthread_create.c:442)
==43801==    by 0x4A7ABB3: clone (clone.S:100)
==43801== 
==43801== HEAP SUMMARY:
==43801==     in use at exit: 13,726,804 bytes in 298,192 blocks
==43801==   total heap usage: 4,021,648 allocs, 3,723,457 frees, 138,036,374 bytes allocated
==43801== 
==43801== LEAK SUMMARY:
==43801==    definitely lost: 192 bytes in 2 blocks
==43801==    indirectly lost: 186,396 bytes in 4,144 blocks
==43801==      possibly lost: 1,728 bytes in 6 blocks
==43801==    still reachable: 13,538,488 bytes in 294,040 blocks
==43801==         suppressed: 0 bytes in 0 blocks
==43801== Rerun with --leak-check=full to see details of leaked memory
==43801== 
==43801== Use --track-origins=yes to see where uninitialised values come from
==43801== For lists of detected and suppressed errors, rerun with: -s
==43801== ERROR SUMMARY: 35 errors from 13 contexts (suppressed: 0 from 0)
Segmentation fault (core dumped)

gdb output:

(gdb) continue 
Continuing.
[New Thread 0x7ffff7bff640 (LWP 47021)]
[New Thread 0x7ffff73fe640 (LWP 47022)]
[New Thread 0x7ffff6bfd640 (LWP 47023)]
[New Thread 0x7ffff63fc640 (LWP 47024)]
[New Thread 0x7ffff5bfb640 (LWP 47025)]
[New Thread 0x7ffff53fa640 (LWP 47026)]
malloc(): unsorted double linked list corrupted

Thread 2 "segfault" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff7bff640 (LWP 47021)]
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140737349940800) at ./nptl/pthread_kill.c:44
44      ./nptl/pthread_kill.c: No such file or directory.

[Geo-7]

I should also note that sometimes this program does not start correctly

gdb output

Temporary breakpoint 1, 0x0000555555569560 in main ()
(gdb) continue 
Continuing.
[New Thread 0x7ffff7bff640 (LWP 47826)]
[New Thread 0x7ffff73fe640 (LWP 47827)]
[New Thread 0x7ffff6bfd640 (LWP 47828)]
[New Thread 0x7ffff63fc640 (LWP 47829)]
[New Thread 0x7ffff5bfb640 (LWP 47830)]
[New Thread 0x7ffff53fa640 (LWP 47831)]
error: cannot release lock
  in ev/take [src/core/ev.c]error: cannot release lock
  in on line 985
  in consumer [segfault/init.janet] (tailcall) on line 9, column 14
 ev/give [src/core/ev.c] on line 973
  in producer [segfault/init.janet] (tailcall) on line 5, column 5
[Thread 0x7ffff7bff640 (LWP 47826) exited]
[Thread 0x7ffff73fe640 (LWP 47827) exited]

[bakpakin]

Thanks for this investigation and repro! Looks like a bug with reference counting in the garbage collector for threaded channels.

[bakpakin]

Should be fixed in b7f8224.

For better integration with GitHub, please file issues instead of forum discussions in the future.

[Geo-7]

Thanks, I'll do that next time.