libfsm icon indicating copy to clipboard operation
libfsm copied to clipboard

A memory allocation race in lx is causing nondeterministic crashes

Open silentbicycle opened this issue 4 years ago • 2 comments

Running the following command:

$ while true; do sleep 0.1; ./build/bin/lx -l test < src/lx/lexer.lx && echo ok; done

will produce a steady stream of memory-related errors in lx.

There appears to be a race on malloc/realloc on a shared pointer. I am going to post a PR in a moment that disables multithreading, this issue exists as a reminder to fix it later. It's currently a distraction from other more important work.

silentbicycle avatar Apr 28 '21 20:04 silentbicycle

Hm I can't reproduce this, I tried with and without asan, ubsan and efence. Any ideas?

katef avatar Jan 04 '24 15:01 katef

You need to set the concurrency flag (-C) to use multiple threads. I just checked again on main and

$ while true; do sleep 0.1; ./build/bin/lx -C8 -l test < src/lx/lexer.lx && echo ok; done

still produces errors

ok
malloc_consolidate(): invalid chunk size
Aborted (core dumped)
ok
...
ok
double free or corruption (out)
Aborted (core dumped)
ok
corrupted size vs. prev_size
Aborted (core dumped)
ok
...
ok
corrupted size vs. prev_size
Aborted (core dumped)
ok
...
ok
malloc(): unsorted double linked list corrupted
Aborted (core dumped)
ok
double free or corruption (out)
Aborted (core dumped)
ok

It may depend somewhat on CPU load -- if I ran multiple processes of a busywait program to bog the CPU down the failures reduced in frequency, and they returned when I stopped the busywaiters.

It used to fail without the -C flag, because before ae73900f4cb4e3640621cc94511ed2fcb8448517 the default was 4 threads rather than 1.

silentbicycle avatar Jan 04 '24 20:01 silentbicycle