[patch] libguile GC crash

[Han-Wen Nienhuys]

address@hidden writes:
>    Hello, I am experiencing a crash using libguile 1.6.4. Here is a
> reduced testcase: (crashes here for i = 1886, but YMMV)
> 
> #include <libguile.h>
> 
> int main(void) {
>   char foo[128]; int i;
>   scm_init_guile();
>   for(i=0; i<100000; i++) {
>     sprintf(foo, "symbol%i%i%i%i", i, i, i, i);
>     scm_c_make_subr(foo, 0, NULL);
>   }
>   return 0;
> }
> 
>    My understanding is that scm_c_make_subr() calls scm_must_realloc()
> to reallocate new_table, which in turn calls check_mtrigger().  But when
> a GC is triggered, scm_igc() calls scm_mark_subr_table(), and since the
> memory pointed by new_table has just been realloc()ated but new_table
> hasn't been updated yet, scm_mark_subr_table() crashes.
> 
>    A simple fix would be to call check_mtrigger() before realloc().
> Proposed patch attached. I am not yet familiar with all the internals
> so I may have missed something, but it looked pretty safe to me.
> 
> Regards,

Thanks for reporting and analyzing the bug. Your analysis as well as
your fix seems correct to me.

Rob, will you apply this patch?

The following comment may also be added:

/*
  realloc() may will probably invalidate the block pointed to by
  WHERE, eg. by unmapping it from memory or altering the contents. 
  Since check_mtrigger() might scan WHERE, it is crucial that
  this call precedes realloc().
*/



-- 

Han-Wen Nienhuys   |   address@hidden   |   http://www.xs4all.nl/~hanwen