From: Paul Brannan <pbrannan@...>
Date: 2002-10-09T02:52:30+09:00
Subject: segfault in gc.c

I just had a ruby (1.6.7) process segfault a little while ago.  The
process had been running for many hours, so this is probably some sort
of race condition.  The program is pure ruby code; no weird extensions.
I'd like to be able to reproduce the segfault so I can make sure this
won't bite me in the future.

The segfault occurred in rb_gc_mark_frame, while marking the argv member
of the frame of one of the threads; the pointer looks valid (0x22b00), but the
argv member has already been deleted (gdb says "Cannot access memory at
address 0x22b00).  When I examine the thread structure, I see:

$4 = {next = 0x8062b68, prev = 0x80a12d8, context = {{__jmpbuf =
{1074487776, 0, 134863240, -1073782760, -1073783264, 1074021466},
__mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 32 times>}}}},
result = 0, stk_len = 9365, stk_max = 13849, stk_ptr = 0x80a4a60,
stk_pos = 0xbfff5de8, frame = 0xbfff61c0, scope = 0x402de2b0, dyna_vars
= 0x40276990, block = 0xbfff85b0, iter = 0xbfff60e8, tag = 0xbfff6dd0,
klass = 1076460832, wrapper = 0, cref = 0x40289d10, flags = 0, file =
0x8098be8 "/users/pbrannan/crimson/tail_f.rb", line = 11, tracing = 0,
errinfo = 4, last_status = 4, last_line = 1076747396, last_match = 4,
safe = 0, status = THREAD_STOPPED, wait_for = 4, fd = 0, readfds =
{__fds_bits = { 0 <repeats 32 times>}}, writefds = {__fds_bits = {0
<repeats 32 times>}}, exceptfds = {__fds_bits = {0 <repeats 32 times>}},
select_value = 0, delay = 1034090066.587968, join = 0x0, abort = 0,
priority = 0, gid = 1, locals = 0x0, thread = 1076749996}

Line 11 of tail_f.rb reads:
  sleep 1

The line I was executing when rb_gc_mark was called was:
  $somehash[symbol] = Time.now

The gc was invoked from time_s_now().

Any ideas what might be causing this segfault?

Paul