From: "wanabe (_ wanabe)" <noreply@...>
Date: 2022-03-21T00:32:13+00:00
Subject: [ruby-core:107993] [Ruby master Bug#17529] Ractor Segfaults with GC enabled

Issue #17529 has been updated by wanabe (_ wanabe).


I confirmed with 3.0.0 that the issue is reproducible.
According to `git bisect`, it seems to be fixed in fff1edf23ba28267bf57097c269f7fa87530e3fa and d0d6227a0da5925acf946a09191f172daf53baf2.

```
$ (git checkout origin/ruby_3_0 && git cherry-pick d0d6227a0da5925acf946a09191f172daf53baf2 fff1edf23ba28267bf57097c269f7fa87530e3fa && make miniruby -j8 ) >/dev/null 2>&1 && ./miniruby -v -W0 segv.rb
ruby 3.0.4p197 (2022-03-13 revision b04eb796e4) [x86_64-linux]

$ (git checkout origin/ruby_3_0 && make miniruby -j8 ) >/dev/null 2>&1 && ./miniruby -v -W0 segv.rbruby 3.0.4p197 (2022-03-13 revision f404b21f84) [x86_64-linux]
<internal:ractor>:627: [BUG] Segmentation fault at 0x0000000000000020
ruby 3.0.4p197 (2022-03-13 revision f404b21f84) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0003 p:0003 s:0015 e:000014 METHOD <internal:ractor>:627
c:0002 p:0019 s:0008 e:000007 BLOCK  segv.rb:13 [FINISH]
c:0001 p:---- s:0003 e:000002 (none) [FINISH]

-- Ruby level backtrace information ----------------------------------------
segv.rb:13:in `block (4 levels) in <main>'
<internal:ractor>:627:in `yield'

-- Machine register context ------------------------------------------------
 RIP: 0x0000560d0246f8d8 RBP: 0x00007f1c80f28920 RSP: 0x00007f1c80f28800
 RAX: 0x0000000000000000 RBX: 0x00007f1c80f28810 RCX: 0x0000000000000000
 RDX: 0x0000000000000001 RDI: 0x0000560d04738b98 RSI: 0x0000000000000000
  R8: 0x0000560d04738e10  R9: 0x0000000000000000 R10: 0x0000000000000001
 R11: 0x0000000000000002 R12: 0x00007f1c80f28820 R13: 0x0000560d04738b70
 R14: 0x0000560d047416b8 R15: 0x00007f1c80f28810 EFL: 0x0000000000010246

-- C level backtrace information -------------------------------------------
./miniruby(rb_vm_bugreport+0x4a4) [0x560d02565b34]
./miniruby(rb_bug_for_fatal_signal+0xf4) [0x560d02369a54]
./miniruby(sigsegv+0x4d) [0x560d024bae1d]
[0x7f1c85894520]
./miniruby(ractor_select+0x478) [0x560d0246f8d8]
./miniruby(builtin_inline_class_627+0x3e) [0x560d0247019e]
./miniruby(vm_exec_core+0x32cd) [0x560d0254d31d]
./miniruby(rb_vm_exec+0x1a2) [0x560d0254f8d2]
./miniruby(thread_do_start_proc+0x339) [0x560d025057d9]
./miniruby(thread_start_func_2+0xc84) [0x560d02506554]
./miniruby(thread_start_func_1+0xde) [0x560d0250682e]
[0x7f1c858e6947]
[0x7f1c85976a44]

-- Other runtime information -----------------------------------------------
(snip)
```

And the following script has been modified to make it easier to try.
```
1000.times do |q|
  producer = Ractor.new do
    1000.times do |i|
      Ractor.yield true
    end
  end

  workers = (1..10).map do
    Ractor.new producer do |producer|
      while n = producer.take
        Ractor.yield nil
      end
    rescue Ractor::ClosedError
    end
  end

  loop do
    _r, prime = Ractor.select(*workers)
  end
end
```


----------------------------------------
Bug #17529: Ractor Segfaults with GC enabled
https://bugs.ruby-lang.org/issues/17529#change-96947

* Author: prajjwal (Prajjwal Singh)
* Status: Assigned
* Priority: Normal
* Assignee: ko1 (Koichi Sasada)
* ruby -v: ruby 3.0.0p0 (2020-12-25 revision 95aff21468) [x86_64-linux]
* Backport: 2.5: UNKNOWN, 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN
----------------------------------------
I've been benchmarking `Ractor` on my machine with the following naive prime number generator:

```ruby
# frozen_string_literal: true

def prime?(n)
  2.upto(n - 1).none? { |i| n % i == 0 }
end

NUM_WORKERS = ARGV[0].to_i

producer = Ractor.new do
  i = 1000000

  loop { Ractor.yield i; i += 1 }
end

workers = (1..NUM_WORKERS).map do
  Ractor.new producer do |producer|
    while n = producer.take
      Ractor.yield [n, prime?(n)]
    end
  end
end

loop do
  _r, ( number, prime ) = Ractor.select(*workers)

  p number if prime
end
```

The code inevitably segfaults, and it appears to be the garbage collector.

If I stick `GC.disable` in there, the code happily chugs along for several minutes on end without a problem.

---Files--------------------------------
ractor.crash (22.5 KB)


-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>