ithreads coredumps on join of joined thread

[p5pRT]

Migrated from rt.perl.org#16681 (status was 'resolved')

Searchable as RT16681$

[p5pRT]

From davem@fdgroup.co.uk

Created by davem@gizmo.fdgroup.co.uk

the following simple bit of code coredumps for me on Solaris​:

  #!/usr/bin/perl -w
  use threads;
  my $a = 'x'x 1; #just a hook for the debugger

  my $t = threads->new(sub {});
  $t->join;
  $t->join;

What appears to be happing is that during the first call to join,
Perl_ithread_join() does

  sv_unmagic(SvRV(obj),PERL_MAGIC_shared_scalar);

which appears to the free up the ithread structure associated
with the thread. So the next call to join, rather than seeing
a PERL_ITHR_JOINED flag, just randomly coredumps.

This gdb stacktrace shows a watchpoint where thread->state changes
back from 6 to 0 during the first join.

Hardware watchpoint 3​: ((ithread *) 2319872)->state

Old value = 6 '\006'
New value = 0 '\000'
0xff1e18e8 in memset () from /usr/platform/SUNW,Ultra-1/lib/libc_psr.so.1
(gdb) bt
#0 0xff1e18e8 in memset () from /usr/platform/SUNW,Ultra-1/lib/libc_psr.so.1
#1 0x33db0 in Perl_gv_init (my_perl=0x1ff358, gv=0x2e512c, stash=0x28dbe0,
  name=0x1c9178 "DESTROY", len=7, multi=1) at gv.c​:111
#2 0x34434 in Perl_gv_fetchmeth (my_perl=0x1ff358, stash=0x28dbe0,
  name=0x1c9178 "DESTROY", len=7, level=0) at gv.c​:215
#3 0x34c48 in Perl_gv_fetchmeth_autoload (my_perl=0x1ff358, stash=0x28dbe0,
  name=0x1c9178 "DESTROY", len=7, level=0) at gv.c​:328
#4 0x39188 in Perl_Gv_AMupdate (my_perl=0x1ff358, stash=0x28dbe0) at gv.c​:1334
#5 0x396d8 in Perl_gv_handler (my_perl=0x1ff358, stash=0x28dbe0, id=65)
  at gv.c​:1406
#6 0xf0cf0 in Perl_sv_clear (my_perl=0x1ff358, sv=0x2e5138) at sv.c​:4952
#7 0xf1e1c in Perl_sv_free (my_perl=0x1ff358, sv=0x2e5138) at sv.c​:5192
#8 0x38bcc in Perl_gp_free (my_perl=0x1ff358, gv=0x2e5120) at gv.c​:1248
#9 0xf15c8 in Perl_sv_clear (my_perl=0x1ff358, sv=0x2e5120) at sv.c​:5026
#10 0xf1e1c in Perl_sv_free (my_perl=0x1ff358, sv=0x2e5120) at sv.c​:5192
#11 0xe223c in do_clean_named_objs (my_perl=0x1ff358, sv=0x2e5120) at sv.c​:367
#12 0xe1d9c in S_visit (my_perl=0x1ff358, f=0xe1fac <do_clean_named_objs>)
  at sv.c​:292
#13 0xe2280 in Perl_sv_clean_objs (my_perl=0x1ff358) at sv.c​:388
#14 0x283a0 in perl_destruct (my_perl=0x1ff358) at perl.c​:469
#15 0xff0922ec in Perl_ithread_destruct (my_perl=0x1e6dc0, thread=0x236600,
  why=0xff095ae0 "no reference") at threads.xs​:138
#16 0xff0927ac in ithread_mg_free (my_perl=0x1e6dc0, sv=0x1e7cd0, mg=0x2f93b0)
  at threads.xs​:204
#17 0xefc6c in Perl_sv_unmagic (my_perl=0x1e6dc0, sv=0x1e7cd0, type=110)
  at sv.c​:4687
#18 0xff093dfc in Perl_ithread_join (my_perl=0x1e6dc0, obj=0x1f78ac)
  at threads.xs​:524
#19 0xff094b04 in XS_threads_join (my_perl=0x1e6dc0, cv=0x26c514)
  at threads.xs​:598
#20 0xdf7b4 in Perl_pp_entersub (my_perl=0x1e6dc0) at pp_hot.c​:2773
#21 0xad384 in Perl_runops_debug (my_perl=0x1e6dc0) at dump.c​:1398
#22 0x2c244 in S_run_body (my_perl=0x1e6dc0, oldscope=1) at perl.c​:1681
#23 0x2bb2c in perl_run (my_perl=0x1e6dc0) at perl.c​:1600
#24 0x25ac8 in main (argc=2, argv=0xffbef5a4, env=0xffbef5b0) at perlmain.c​:85

Perl Info

Flags:
    category=core
    severity=medium

Site configuration information for perl v5.8.0:

Configured by davem at Mon Aug  5 12:46:42 BST 2002.

Summary of my perl5 (revision 5.0 version 8 subversion 0) configuration:
  Platform:
    osname=solaris, osvers=2.8, archname=sun4-solaris-thread-multi
    uname='sunos gizmo 5.8 generic_108528-03 sun4u sparc sunw,ultra-1 '
    config_args='-des -Dcc=gcc -Dprefix=/home/davem/perl5/perl-5.8.0t.out -Duseithreads -Uinstallusrbinperl -Doptimize=-g'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=define use5005threads=undef useithreads=define usemultiplicity=define
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='gcc', ccflags ='-D_REENTRANT -DDEBUGGING -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
    optimize='-g',
    cppflags='-D_REENTRANT -DDEBUGGING -fno-strict-aliasing -I/usr/local/include'
    ccversion='', gccversion='2.95.2 19991024 (release)', gccosandvers='solaris2.8'
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=4321
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=8, prototype=define
  Linker and Libraries:
    ld='gcc', ldflags =' -L/usr/local/lib '
    libpth=/usr/local/lib /usr/lib /usr/ccs/lib
    libs=-lsocket -lnsl -ldl -lm -lrt -lpthread -lc
    perllibs=-lsocket -lnsl -ldl -lm -lrt -lpthread -lc
    libc=/lib/libc.so, so=so, useshrplib=false, libperl=libperl.a
    gnulibc_version=''
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags=' '
    cccdlflags='-fPIC', lddlflags='-G -L/usr/local/lib'

Locally applied patches:
    


@INC for perl v5.8.0:
    /home/davem/perl5/perl-5.8.0t.out/lib/5.8.0/sun4-solaris-thread-multi
    /home/davem/perl5/perl-5.8.0t.out/lib/5.8.0
    /home/davem/perl5/perl-5.8.0t.out/lib/site_perl/5.8.0/sun4-solaris-thread-multi
    /home/davem/perl5/perl-5.8.0t.out/lib/site_perl/5.8.0
    /home/davem/perl5/perl-5.8.0t.out/lib/site_perl
    .


Environment for perl v5.8.0:
    HOME=/home/davem
    LANG=C
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/usr/ccs/bin:/usr/local/bin:/home/davem/bin:/usr/bin::/usr/dt/bin:/usr/openwin/bin:/bin:/usr/ucb
    PERL_BADLANG (unset)
    SHELL=/bin/bash

[p5pRT]

From @lizmat

At 10​:46 AM 8/21/02 +0000, via RT wrote​:

use threads;
my $a = 'x'x 1; #just a hook for the debugger

my $t = threads\->new\(sub \{\}\);
$t\->join;
$t\->join;

Under Linux I get​:

$ perl -Mthreads -e 'my $t = threads->new( sub {} ); $t->join; $t->join'
Thread already joined at -e line 1.

Liz

[p5pRT]

arthur@contiller.se - Status changed from 'new' to 'open'

[p5pRT]

From arthur@contiller.se

Hi,

Can you see if this still applies? I think I might have fixed it before
5.8 came out. I can't reproduce it on linux.

Arthur

[p5pRT]

From @iabyn

On Sat, Jan 04, 2003 at 01​:09​:09AM -0000, Arthur Bergman wrote​:

Hi,

Can you see if this still applies? I think I might have fixed it before
5.8 came out. I can't reproduce it on linux.

On a copy of 18378 I have lying around, I can get strange effects
on Linux by executing some code that reallocs stuff between the joins​:

  use threads;
  my $a = 'x'x 1; #just a hook for the debugger

  my $t = threads->new(sub {});
  $t->join;
  for (1..100) {
  $a[$_] = "\0xff" x $_;
  }

  $t->join;

[davem@​percy 18378t]$ ./perl -Ilib /tmp/p
Name "main​::a" used only once​: possible typo at /tmp/p line 9.
panic​: MUTEX_LOCK at /tmp/p line 12.

So I guess the bug is still active :-(

Summary of my perl5 (revision 5.0 version 9 subversion 0 patch 18378) configuration​:
  Platform​:
  osname=linux, osvers=2.4.7-10, archname=i686-linux-thread-multi
  uname='linux percy 2.4.7-10 #1 thu sep 6 16​:46​:36 edt 2001 i686 unknown '
  config_args='-des -Dusedevel -Dprefix=/home/davem/perl5/18378t.out -Uinstallusrbinperl -Duseithreads -Doptimize=-g'
  hint=recommended, useposix=true, d_sigaction=define
  usethreads=define useithreads=define usemultiplicity=define
  useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
  use64bitint=undef use64bitall=undef uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm',
  optimize='-g',
  cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -I/usr/local/include -I/usr/include/gdbm'
  ccversion='', gccversion='2.96 20000731 (Red Hat Linux 7.1 2.96-98)', gccosandvers=''
  intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
  ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=4, prototype=define
  Linker and Libraries​:
  ld='cc', ldflags =' -L/usr/local/lib'
  libpth=/usr/local/lib /lib /usr/lib
  libs=-lnsl -lndbm -lgdbm -ldl -lm -lpthread -lc -lcrypt -lutil -lrt
  perllibs=-lnsl -ldl -lm -lpthread -lc -lcrypt -lutil -lrt
  libc=/lib/libc-2.2.4.so, so=so, useshrplib=false, libperl=libperl.a
  gnulibc_version='2.2.4'
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
  cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'

Characteristics of this binary (from libperl)​:
  Compile-time options​: DEBUGGING MULTIPLICITY USE_ITHREADS USE_LARGE_FILES PERL_IMPLICIT_CONTEXT
  Locally applied patches​:
  DEVEL18374
  Built under linux
  Compiled at Jan 1 2003 15​:50​:28
  @​INC​:
  lib
  /home/davem/perl5/18378t.out/lib/5.9.0/i686-linux-thread-multi
  /home/davem/perl5/18378t.out/lib/5.9.0
  /home/davem/perl5/18378t.out/lib/site_perl/5.9.0/i686-linux-thread-multi
  /home/davem/perl5/18378t.out/lib/site_perl/5.9.0
  /home/davem/perl5/18378t.out/lib/site_perl
  .

--
A walk of a thousand miles begins with a single step...
then continues for another 1,999,999 or so.

[p5pRT]

From arthur@contiller.se

On lördag, jan 4, 2003, at 02​:22 Europe/Stockholm, Dave Mitchell wrote​:

On Sat, Jan 04, 2003 at 01​:09​:09AM -0000, Arthur Bergman wrote​:

Hi,

Can you see if this still applies? I think I might have fixed it
before
5.8 came out. I can't reproduce it on linux.

On a copy of 18378 I have lying around, I can get strange effects
on Linux by executing some code that reallocs stuff between the joins​:

use threads;
my $a = 'x'x 1; \#just a hook for the debugger

my $t = threads\->new\(sub \{\}\);
$t\->join;
for \(1\.\.100\) \{
$a\[$\_\] = "\\0xff" x $\_;
\}

$t\->join;

[davem@​percy 18378t]$ ./perl -Ilib /tmp/p
Name "main​::a" used only once​: possible typo at /tmp/p line 9.
panic​: MUTEX_LOCK at /tmp/p line 12.

So I guess the bug is still active :-(

Gah, how annoying. Some seems very prematurely freed.

Can someone run a memory verifier on this and see what is going on
please?

Thanks

Arthur

[p5pRT]

From arthur@contiller.se

Hi,

Seems like substandard operating systems that actually free freed memory had a
problem :-)

This patch fixes this since destroy works.

Arthur

[p5pRT]

From arthur@contiller.se

19240.patch

--- ext/threads/t/join.t-19239	Wed Apr 16 19:37:42 2003
+++ ext/threads/t/join.t	Wed Apr 16 19:37:45 2003
@@ -10,7 +10,7 @@
 
 use ExtUtils::testlib;
 use strict;
-BEGIN { print "1..11\n" };
+BEGIN { print "1..12\n" };
 use threads;
 use threads::shared;
 
@@ -117,4 +117,17 @@
   }
 } else {
   skip("\$0 check: only on Linux");
+}
+
+{
+    my $t = threads->new(sub {});
+    $t->join;
+    my $x = threads->new(sub {});
+    $x->join;
+    eval {
+      $t->join;
+    };
+    my $ok = 0;
+    $ok++ if($@ =~/Thread already joined/);
+    ok($ok, "Double join works");
 }
--- ext/threads/threads.xs-19239	Wed Apr 16 19:37:51 2003
+++ ext/threads/threads.xs	Wed Apr 16 19:37:53 2003
@@ -601,7 +601,7 @@
 	/* We have finished with it */
 	thread->state |= PERL_ITHR_JOINED;
 	MUTEX_UNLOCK(&thread->mutex);
-    	sv_unmagic(SvRV(obj),PERL_MAGIC_shared_scalar);
+    	
 	return retparam;
     }
     return (AV*)NULL;

[p5pRT]

arthur@contiller.se - Status changed from 'open' to 'resolved'