Mantis Bug Tracker

View Issue Details Jump to Notes ] Issue History ] Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0005188OCamlOCaml generalpublic2010-12-04 13:112012-03-24 15:01
Reporterherbelin 
Assigned Toxleroy 
PrioritynormalSeveritycrashReproducibilityrandom
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version3.11.2 
Target VersionFixed in Version3.12.1+dev 
Summary0005188: double free corruption with bytecode system threads and stack reallocation
DescriptionHi, the following code randomly but most often leads to a double free corruption.

let rec f x = if x = 0 then 0 else 1 + f (x-1)
let _ = Thread.join (Thread.create f 200)

(compiled with "ocamlc -thread unix.cma threads.cma bug.ml").

A valgrind analysis showed that the second illegal free is raised by the instruction "stat_free(th->stack_low);" at line 449 of posix.c: a reallocation of the stack happened but the th and th->stack_low did not get a chance to be updated yet (no entering in a blocking section). The attached patch seems to solve the problem in 3.11.

Apparently, thread implementation has been revised in 3.12 but the problem remains.

Incidentally, with a large system such as Coq, if we link it with the thread library, even though we might not make any use of the functions of the library, we randomly experiment out of memory errors at startup (in native code). Any ideas how to debug this?

Best regards. Hugo.
TagsNo tags attached.
Attached Files? file icon patch.double-free-3.11 [^] (1,080 bytes) 2010-12-04 13:11

- Relationships

-  Notes
(0005750)
xleroy (administrator)
2010-12-22 14:42

Well spotted, thanks a lot. I adapted your fix to 3.12 and "committed" it in the 3.12 bugfix branch, for release in 3.12.1. I don't feel this bug warrants a new release of 3.11 but will let our esteemed release manager decide.

As to the random out-of-memory errors at startup, I have no clue, but if you have a (semi-) repro case to suggest, I'll look into it.

- Issue History
Date Modified Username Field Change
2010-12-04 13:11 herbelin New Issue
2010-12-04 13:11 herbelin File Added: patch.double-free-3.11
2010-12-22 14:42 xleroy Note Added: 0005750
2010-12-22 14:42 xleroy Assigned To => xleroy
2010-12-22 14:42 xleroy Status new => resolved
2010-12-22 14:42 xleroy Resolution open => fixed
2010-12-22 14:42 xleroy Fixed in Version => 3.12.1+dev
2012-03-24 15:01 xleroy Status resolved => closed


Copyright © 2000 - 2011 MantisBT Group
Powered by Mantis Bugtracker