From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS4713 221.184.0.0/13 X-Spam-Status: No, score=-3.7 required=3.0 tests=AWL,BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from neon.ruby-lang.org (neon.ruby-lang.org [221.186.184.75]) by dcvr.yhbt.net (Postfix) with ESMTP id 6D3281F45F for ; Sun, 5 May 2019 04:26:02 +0000 (UTC) Received: from neon.ruby-lang.org (localhost [IPv6:::1]) by neon.ruby-lang.org (Postfix) with ESMTP id 2229812096B; Sun, 5 May 2019 13:25:56 +0900 (JST) Received: from o1678916x28.outbound-mail.sendgrid.net (o1678916x28.outbound-mail.sendgrid.net [167.89.16.28]) by neon.ruby-lang.org (Postfix) with ESMTPS id 485DF120907 for ; Sun, 5 May 2019 13:25:54 +0900 (JST) Received: by filter0104p3las1.sendgrid.net with SMTP id filter0104p3las1-4149-5CCE65D2-20 2019-05-05 04:25:54.90079066 +0000 UTC m=+805051.980127751 Received: from herokuapp.com (unknown [54.80.106.145]) by ismtpd0011p1iad2.sendgrid.net (SG) with ESMTP id ccRqigjrTnGnE1bdPBXZug for ; Sun, 05 May 2019 04:25:54.515 +0000 (UTC) Date: Sun, 05 May 2019 04:25:54 +0000 (UTC) From: ko1@atdot.net Message-ID: References: Mime-Version: 1.0 X-Redmine-MailingListIntegration-Message-Ids: 68024 X-Redmine-Project: ruby-trunk X-Redmine-Issue-Id: 15821 X-Redmine-Issue-Author: wanabe X-Redmine-Sender: ko1 X-Mailer: Redmine X-Redmine-Host: bugs.ruby-lang.org X-Redmine-Site: Ruby Issue Tracking System X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-SG-EID: =?us-ascii?Q?fVTMYOBjtdvXNcWwrscBhLsHItUXVK5L4mtnq0mdcRenxKoAvTfguaCdh+vY2l?= =?us-ascii?Q?mQN8F9HZ15KXVrjdFZ5aB2eHjtzqOs3v+yxc5e0?= =?us-ascii?Q?qXIlNCFMAUxyUNQEd7oRLa+3RJFWXXTl3neyKrM?= =?us-ascii?Q?FrNCxFYQQgIxXy0LJ47lK=2F7Sofr9b7omErMu+Tu?= =?us-ascii?Q?zhPAsVf0U8DE5?= To: ruby-core@ruby-lang.org X-ML-Name: ruby-core X-Mail-Count: 92541 Subject: [ruby-core:92541] [Ruby trunk Bug#15821] ruby_process_options() may cause "WB miss (O->Y)" X-BeenThere: ruby-core@ruby-lang.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Ruby developers List-Id: Ruby developers List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ruby-core-bounces@ruby-lang.org Sender: "ruby-core" Issue #15821 has been updated by ko1 (Koichi Sasada). I didn't understand completely, but it is local problem on it? or all of `rb_ary_replace()` calls have the same issue? ---------------------------------------- Bug #15821: ruby_process_options() may cause "WB miss (O->Y)" https://bugs.ruby-lang.org/issues/15821#change-77900 * Author: wanabe (_ wanabe) * Status: Open * Priority: Normal * Assignee: * Target version: * ruby -v: ruby 2.7.0dev (2019-05-04 trunk b72623012d) [x86_64-linux] * Backport: 2.4: UNKNOWN, 2.5: UNKNOWN, 2.6: UNKNOWN ---------------------------------------- ## Problem Ruby interpreter may cause error "WB miss (O->Y)" on some conditions that are `RGENGC_CHECK_MODE=5` and `RUBY_DEBUG=gc_stress` ## How to reproduce 1. build ruby with high RGENGC_CHECK_MODE * `make ruby optflags="-O3 -DRGENGC_CHECK_MODE=5"` 2. run ruby with gc_stress * `RUBY_DEBUG=gc_stress ./ruby --disable-gems -ve 1` ## Probable cause 1. `rb_construct_expanded_load_path` calls `rb_ary_replace(vm->load_path_snapshot, vm->load_path)`. 2. It creates shared root array and makes `vm->load_path` SHARED_ARRAY. 3. After a while, `process_options` calls `RARRAY_ASET(load_path, i, path)`. 4. It calls `rb_gc_writebarrier` -> `gc_writebarrier_generational`. * Incremental mark phase is finished because of `RUBY_DEBUG=gc_stress`. 5. It makes `vm->load_path` remembered, but not shared root array! 6. "WB miss (O->Y)" is done. * Old parent is shared root array. * New child is `path` of above 3. ## Proposal How about call `rb_ary_modify` before `RARRAY_SET` in `process_options`? Or using `rb_ary_store` instead of `RARRAY_SET` may avoid the error. ## Sample output An example of full output is attached. (Sorry, I GZipped it because of file-size limitation) The snippet is here: ``` ruby 2.7.0dev (2019-05-04 trunk b72623012d) [x86_64-linux] verify_internal_consistency_reachable_i: WB miss (O->Y) 0x000055c3262f3610 [3LM ] T_ARRAY [ ] len: 20, capa:2 ptr:0x000055c326498380 -> 0x000055c3262f3908 [2 P ] T_STRING (String) /home/wanabe/.rbenv/versions/trunk/lib/ruby/site_ruby/2.7.0 [all refs] (size: 5307) (snip) [allrefs_dump_i] 0x000055c3263349f8 [3LMP ] T_ARRAY [E ] len: 0 (embed) <- <0x000055c326336f28 [0 P U] VM/thread (Thread) VM/thread> ./ruby: [BUG] Segmentation fault at 0x0000000000000010 ruby 2.7.0dev (2019-05-04 trunk b72623012d) [x86_64-linux] -- Control frame information ----------------------------------------------- c:0001 p:0000 s:0003 E:0022c0 (none) [FINISH] -- Machine register context ------------------------------------------------ RIP: 0x000055c32452e15a RBP: 0x0000000000000001 RSP: 0x00007ffea126d470 RAX: 0x0000000000000000 RBX: 0x000055c3262ef3c8 RCX: 0x0000000000000001 RDX: 0x000055c324773446 RDI: 0x00007ff8c77cb680 RSI: 0x0000000000000001 R8: 0x000055c3262ef3b8 R9: 0x0000000000000018 R10: 0x0000000000000018 R11: 0x0000000000000246 R12: 0x0000000000000100 R13: 0x0000000000000005 R14: 0x000055c3262f3c28 R15: 0x000055c3262ef1b0 EFL: 0x0000000000010206 -- C level backtrace information ------------------------------------------- /home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(rb_vm_bugreport+0x554) [0x55c324769fa4] ../../vm_dump.c:715 [0x55c324760088] /home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(sigsegv+0x42) [0x55c324640d42] ../../signal.c:997 /lib/x86_64-linux-gnu/libpthread.so.0(__restore_rt+0x0) [0x7ff8c797ff40] /home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(allrefs_dump+0x1a) [0x55c32452e15a] /usr/include/x86_64-linux-gnu/bits/stdio2.h:100 [0x55c32453a478] [0x55c32453a64c] [0x55c32453f874] /home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(rb_str_dup+0x29) [0x55c32465aa59] ../../string.c:722 [0x55c32463f2e1] /home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(ruby_process_options+0xc0) [0x55c3246404a0] ../../ruby.c:2380 /home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(ruby_options+0xca) [0x55c32451e1ea] ../../eval.c:118 /home/wanabe/work/prog/ruby/ruby/tmp/trunk/ruby(main+0x67) [0x55c324519ec7] ../../main.c:42 (snip) Aborted (core dumped) ``` ---Files-------------------------------- out.log.gz (114 KB) -- https://bugs.ruby-lang.org/