Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
Major GC crashes on fragmented heap with large number of block size and first_fit policy #7815
Original bug ID: 7815
Calling Gc.full_major (or simply major) after allocating thousands of block of different word size and freeing half of them with first_fit policy makes the runtime crash with no meaningful trace
Steps to reproduce
Compile the attached file with
ocamlfind ocamlopt -g -linkpkg -package gperftools minimal.ml
and run it. On my machine it also crashes with jemalloc with rounds = 3 and nr_blocks = 20000
opam install jemalloc
I came across this issue after trying to reproduce a bug in minor gc and caml_fl_allocate which under certain conditions makes minor gc run forever (or at least quadratically, but for half an hour on small heaps at least).
I was trying to fill the flp to see what would happen in this case. I don't know yet if those two issues are related
Comment author: @stedolan
That's a nice reproduction case!
This bug is reproducible by running the bytecode interpreter under valgrind, which should make debugging easier. It seems to be independent of the choice of malloc, although it doesn't seem to actually segfault with the default glibc allocator.
In freelist.c, there's this loop:
This example causes 'buf[j++] = prev' (line 345) to run more than FLP_MAX times, overflowing the buffer.