ruby-core

Bugs item #6987, was opened at 2006-11-30 17:19
You can respond by visiting: 
http://rubyforge.org/tracker/?func=detail&atid=1698&aid=6987&group_id=426

Category: Core
Group: None
Status: Open
Resolution: None
Priority: 3
Submitted By: Sylvain Joyeux (lapinot)
Assigned to: Nobody (None)
Summary: Double-free problem in the interpreter

Initial Comment:
One of my test suite crahed, so I traced ruby inside valgrind. (report following). All bad accesses are at the same location, so I removed the traces which were redundant.

Ruby version:
  ruby 1.8.5 (2006-08-25) [i686-linux]
  Compiled from the official tarball on fedora core 5, with the following options:
    --enable-frame-address --disable-pthread --enable-shared

Conditional jump or move depends on uninitialised value(s)
   at 0x4049147: garbage_collect (gc.c:1267)
   by 0x4049757: rb_newobj (gc.c:395)
   by 0x4035595: rb_call0 (eval.c:5856)
   by 0x4036017: rb_call (eval.c:6048)
   by 0x4033678: rb_eval (eval.c:3464)
   by 0x4035BF0: rb_call0 (eval.c:5954)
   by 0x4036017: rb_call (eval.c:6048)
   by 0x4033678: rb_eval (eval.c:3464)
   by 0x403440D: rb_eval (eval.c:3259)
   by 0x4035BF0: rb_call0 (eval.c:5954)
   by 0x4036017: rb_call (eval.c:6048)
   by 0x4033939: rb_eval (eval.c:3443)

Invalid free() / delete / delete[]
   at 0x4004E41: free (vg_replace_malloc.c:235)
   by 0x4049161: garbage_collect (gc.c:1268)
   by 0x4049757: rb_newobj (gc.c:395)
   by 0x4035595: rb_call0 (eval.c:5856)
   by 0x4036017: rb_call (eval.c:6048)
   by 0x4033678: rb_eval (eval.c:3464)
   by 0x4035BF0: rb_call0 (eval.c:5954)
   by 0x4036017: rb_call (eval.c:6048)
   by 0x4033678: rb_eval (eval.c:3464)
   by 0x403440D: rb_eval (eval.c:3259)
   by 0x4035BF0: rb_call0 (eval.c:5954)
   by 0x4036017: rb_call (eval.c:6048)
 Address 0x4A6EAC0 is 0 bytes inside a block of size 24 free'd
   at 0x4004E41: free (vg_replace_malloc.c:235)
   by 0x4049161: garbage_collect (gc.c:1268)
   by 0x4049757: rb_newobj (gc.c:395)
   by 0x4035595: rb_call0 (eval.c:5856)
   by 0x4036017: rb_call (eval.c:6048)
   by 0x4033678: rb_eval (eval.c:3464)
   by 0x4035BF0: rb_call0 (eval.c:5954)
   by 0x4036017: rb_call (eval.c:6048)
   by 0x4033678: rb_eval (eval.c:3464)
   by 0x403440D: rb_eval (eval.c:3259)
   by 0x4035BF0: rb_call0 (eval.c:5954)
   by 0x4036017: rb_call (eval.c:6048)

Invalid read of size 4
   at 0x4028E70: rb_svar (eval.c:967)
   by 0x4068FFD: rb_lastline_get (parse.y:6225)
   by 0x402C0C7: rb_thread_restore_context (eval.c:10367)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC0 is 0 bytes inside a block of size 24 free'd

Invalid read of size 4
   at 0x4028E79: rb_svar (eval.c:968)
   by 0x4068FFD: rb_lastline_get (parse.y:6225)
   by 0x402C0C7: rb_thread_restore_context (eval.c:10367)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC4 is 4 bytes inside a block of size 24 free'd

Invalid read of size 4
   at 0x4028E70: rb_svar (eval.c:967)
   by 0x4069685: rb_lastline_set (parse.y:6236)
   by 0x402C0E1: rb_thread_restore_context (eval.c:10368)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC0 is 0 bytes inside a block of size 24 free'd

Invalid read of size 4
   at 0x4028E79: rb_svar (eval.c:968)
   by 0x4069685: rb_lastline_set (parse.y:6236)
   by 0x402C0E1: rb_thread_restore_context (eval.c:10368)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC4 is 4 bytes inside a block of size 24 free'd

Invalid read of size 4
   at 0x4028E70: rb_svar (eval.c:967)
   by 0x406903D: rb_backref_get (parse.y:6202)
   by 0x402C0F8: rb_thread_restore_context (eval.c:10370)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC0 is 0 bytes inside a block of size 24 free'd

Invalid read of size 4
   at 0x4028E79: rb_svar (eval.c:968)
   by 0x406903D: rb_backref_get (parse.y:6202)
   by 0x402C0F8: rb_thread_restore_context (eval.c:10370)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC8 is 8 bytes inside a block of size 24 free'd

Invalid read of size 4
   at 0x4028E70: rb_svar (eval.c:967)
   by 0x40696D5: rb_backref_set (parse.y:6213)
   by 0x402C112: rb_thread_restore_context (eval.c:10371)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC0 is 0 bytes inside a block of size 24 free'd

Invalid read of size 4
   at 0x4028E79: rb_svar (eval.c:968)
   by 0x40696D5: rb_backref_set (parse.y:6213)
   by 0x402C112: rb_thread_restore_context (eval.c:10371)
   by 0x402BFB0: rb_thread_restore_context (eval.c:10308)
   by 0x1657C: ???
 Address 0x4A6EAC8 is 8 bytes inside a block of size 24 free'd


----------------------------------------------------------------------

You can respond by visiting: 
http://rubyforge.org/tracker/?func=detail&atid=1698&aid=6987&group_id=426

Thread

Prev Next

In This Thread

Prev Next

[#9364] Re: [ ruby-Bugs-6413 ] Some Time Constructors Fail to Call initialize — Sylvain Joyeux <sylvain.joyeux@...4x.org>

[#9365] net/ftp should handle sending of data, not files — <noreply@...>

[#9366] Range of Symbols yields only first item as Symbol — <noreply@...>

[#9367] reduce memory usage of rdoc — <noreply@...>

[#9368] cvs diff broken for pserver — <noreply@...>

[#9369] fatal flaw in popen4 on windows? [WAS] Re: Nonblocking IO read — ara.t.howard@...

[#9370] Array#shuffle and Array#shuffle! — <noreply@...>

[#9371] ri for specific method returns suggestion to refine search if there are similarly named methods — <noreply@...>

[#9372] Set#^ (xor) is broken - patch included — <noreply@...>

[#9376] rdoc --fmt=html throws Segmentation faults — <noreply@...>

[#9377] Re: rdoc parsing bug, confused by block "end" in class-context — Ryan Davis <ryand-ruby@...>

[#9378] test — ara.t.howard@...

[#9379] fatal flaw in popen4 on windows? [WAS] Re: Nonblocking IO read (fwd) — ara.t.howard@...

[#9381] Native Thread extension for 1.8 — "Abhisek Datta" <abhisek@...>

[#9382] the sign of a number is omitted when squaring it. -2**2 vs (-2)**2 — <noreply@...>

[#9385] merge YARV into Ruby — SASADA Koichi <ko1@...>

[#9386] IMAP error parsing bodystructure of multipart/mixed with message/delivery-status sub-part — <noreply@...>

[#9393] unsubscribe — "Ricardo Dias" <ricadias@...>

[#9401] RDoc: f95_parser needs patch to rdoc/option.rb — <noreply@...>

[#9402] fast mutexes for 1.8? — MenTaLguY <mental@...>

[#9447] Casual discussion of SCM (was: merge YARV into Ruby) — "Brian Mitchell" <binary42@...>

[#9450] Bikeshed: No more Symbol < String? — Kornelius Kalnbach <murphy@...>

[#9470] Ruby performanmce improvements — "Michael Selig" <michael.selig@...>

[#9472] Re: fast mutexes for 1.8? — Brent Roman <brent@...>

[#9492] NodeDump for 1.8.5 — Charles Thornton <ceo@...>

[#9493] Future Plans for Ruby 1.8 Series — URABE Shyouhei <shyouhei@...>

[#9500] self-referential constants — <noreply@...>

[#9512] What does rb_memsearch do? — Kornelius Kalnbach <murphy@...>

[#9515] External entropy pool for random number generator — "Kirill Shutemov" <k.shutemov@...>

[#9520] Re: fast mutexes for 1.8? — Brent Roman <brent@...>

[#9540] Different return values for setter methods — "Marcel Molina Jr." <marcel@...>

[#9543] adding rb_warn gives a segmentation fault — Xavier Noria <fxn@...>

[#9547] Net::FTP should check the control connection on EPIPE — Simon Williams <simon.williams@...>

[#9549] 64 bit pack/unpack issues — David Frascone <dave@...>

[#9552] sandbox 0.3 — _why <why@...>

[#9553] Re: fast mutexes for 1.8? — Brent Roman <brent@...>

[#9554] Ruby 1.[89].\d+ and beyond. — Hugh Sasse <hgs@...>

[#9566] optimized mutex progress — MenTaLguY <mental@...>

[#9568] YAML bug. — "Brendan Inglese" <escii@...>

[#9569] tempfile.rb should let you preserve a file — <noreply@...>

[#9570] Patch for HalfOrder, help please! — "Robert Dober" <robert.dober@...>

[#9572] io_write (io.c) bug (and its fix) under MS Windows for GUI apps (rubyw) — "Mounir Idrassi" <idrassi@...>

[#9581] type information — Deni George <denigeorge@...>

[#9591] In a c++ program, when I call "fclose()", or "ofstream::close()" in a file that includes ruby.h, the program crashes — <noreply@...>

[#9599] net/ftp hangs — <noreply@...>

[#9603] YAML loses data — <noreply@...>

[#9604] #ancestors never includes the singleton class (inconsistent) — <noreply@...>

[#9611] Wilderness: How are Class actually built — Charles Thornton <ceo@...>

[#9616] Create Dates from Times — <noreply@...>

[#9621] Typo in string.c — Kornelius Kalnbach <murphy@...>

[#9624] Truncating string set on $0 — "Joao Pedrosa" <joaopedrosa@...>

[#9628] Sync/Sync_m bug? — MenTaLguY <mental@...>

[#9634] (assunto em branco) — Marco Lomar <malp_pontes@...>

[#9635] Formatting patch to benchmark.rb — Gavin Kistner <gavin@...>

[#9636] Problem with Benchmark::Tms#add! - expects &blk but takes no parameters — <noreply@...>

[#9637] Benchmark::Tms#add! missing block argument — <noreply@...>

[#9641] Double-free problem in the interpreter — <noreply@...>

[ ruby-Bugs-6987 ] Double-free problem in the interpreter

Thread

In This Thread

[#9382] the sign of a number is omitted when squaring it. -22 vs (-2)2 — <noreply@...>