Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mrb_str_modify segfault #3117

Closed
jbreeden opened this issue Feb 21, 2016 · 2 comments
Closed

mrb_str_modify segfault #3117

jbreeden opened this issue Feb 21, 2016 · 2 comments

Comments

@jbreeden
Copy link
Contributor

EDIT: Found a minimal reproduction

[jared:~/projects/mruby] git checkout upstream/master
[jared:~/projects/mruby] git pull upstream master
[jared:~/projects/mruby] rake clean default
[jared:~/projects/mruby] mirb
mirb - Embeddable Interactive Ruby Shell

> count = 1
 => 1
> singular = 'thing'
 => "thing"
> "#{count} #{singular}#{'s' unless count == 1}"
Segmentation fault: 11
[jared:~/projects/mruby] 

Previous description follows below


Getting a segfault in mrb_str_modify. Not 100% on what's causing the error yet. To capture what I can for now....

git bisect

leads me to this commit:

[jared:~/projects/mruby] git status
HEAD detached at d8fc09c
You are currently bisecting, started from branch 'cf5ca03'.
....
[jared:~/projects/mruby] git show head
commit d8fc09cf927aad33138b54bc79d286ac0636cc06
Author: Yukihiro "Matz" Matsumoto <matz@ruby-lang.org>
Date:   Wed Feb 17 11:02:29 2016 +0900

    push value for NULL AST when value is required; fix #3110

Tests & Output

Previous ruby/spec results were ok (relatively few crashes).

When moving from d8fc09^ to d8fc09 I start seeing this instead.

Most of the tests fail with the same segfault. Seems to be something in the mspec HTML formatter, since they all fail just before printing the summary for the tests to the output file.

Any tips for debugging?

Still trying to come up with a minimal reproduction...

The valgrind output shows me where in the c code the error happens. Is there a quick way to dump the ruby stack trace at that point? (edit: mrb_raise seems to generate a stack trace pretty well :)

@jbreeden
Copy link
Contributor Author

Looks like a null pointer is being passed in as s

When I add this:

MRB_API void
mrb_str_modify(mrb_state *mrb, struct RString *s)
{
  fprintf(stderr, "mrb_str_modify\n");
  fflush(stderr);
  fprintf(stderr, "s: %p\n", s);
  fflush(stderr);
  fprintf(stderr, "RSTR_PTR %%p: %p\n", RSTR_PTR(s));
  fflush(stderr);
  fprintf(stderr, "RSTR_PTR %%s: %s\n", RSTR_PTR(s));
  fflush(stderr);

The first 3 test files all fail with the same final output:

mrb_str_modify
s: 0x0
==35178== Invalid read of size 1
==35178==    at 0x10001FE40: mrb_str_modify (string.c:664)
==35178==    by 0x10002020E: mrb_str_concat (string.c:766)
==35178==    by 0x100034039: mrb_vm_exec (vm.c:2217)
==35178==    by 0x100035026: mrb_top_run (vm.c:2448)
==35178==    by 0x100063418: load_exec (parse.y:5637)
==35178==    by 0x10000161B: main (mruby.c:226)
==35178==  Address 0x1 is not stack'd, malloc'd or (recently) free'd
==35178== 
==35178== 
==35178== Process terminating with default action of signal 11 (SIGSEGV)
==35178==  Access not within mapped region at address 0x1
==35178==    at 0x10001FE40: mrb_str_modify (string.c:664)
==35178==    by 0x10002020E: mrb_str_concat (string.c:766)
==35178==    by 0x100034039: mrb_vm_exec (vm.c:2217)
==35178==    by 0x100035026: mrb_top_run (vm.c:2448)
==35178==    by 0x100063418: load_exec (parse.y:5637)
==35178==    by 0x10000161B: main (mruby.c:226)
==35178==  If you believe this happened as a result of a stack
==35178==  overflow in your program's main thread (unlikely but
==35178==  possible), you can try to increase the size of the
==35178==  main thread stack using the --main-stacksize= flag.
==35178==  The main thread stack size used in this run was 8388608.
==35178== 
==35178== HEAP SUMMARY:
==35178==     in use at exit: 1,924,475 bytes in 22,230 blocks
==35178==   total heap usage: 147,147 allocs, 124,917 frees, 48,801,309 bytes allocated
==35178== 
==35178== LEAK SUMMARY:
==35178==    definitely lost: 4,096 bytes in 1 blocks
==35178==    indirectly lost: 0 bytes in 0 blocks
==35178==      possibly lost: 0 bytes in 0 blocks
==35178==    still reachable: 1,885,686 bytes in 21,808 blocks
==35178==         suppressed: 34,693 bytes in 421 blocks
==35178== Rerun with --leak-check=full to see details of leaked memory
==35178== 
==35178== For counts of detected and suppressed errors, rerun with: -v
==35178== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

@matz matz closed this as completed in b8479b6 Feb 22, 2016
@jbreeden
Copy link
Contributor Author

Awesome! Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant