"Invalid free()" with C extension on OS X

[Josh Haberman <jhaberman@...>]

I usually track down problems like this myself, but I'm at a bit of a loss.

I have an extension that runs a test lua program valgrind-clean on Linux.

When I build and run the same extension the same way on OS X (10.6),
running the same lua test program gives me a valgrind "invalid free()"
error inside Lua, but no other valgrind errors (which I would expect to
see if I was stomping on Lua's memory).

==79057== Invalid free() / delete / delete[]
==79057==    at 0x10005846F: free (vg_replace_malloc.c:366)
==79057==    by 0x10001BA7B: l_alloc (lauxlib.c:631)
==79057==    by 0x10000EF4B: luaM_realloc_ (lmem.c:79)
==79057==    by 0x100014D71: luaH_free (ltable.c:376)
==79057==    by 0x10000C28C: freeobj (lgc.c:383)
==79057==    by 0x10000C3C8: sweeplist (lgc.c:424)
==79057==    by 0x10000C715: luaC_freeall (lgc.c:487)
==79057==    by 0x100013570: close_state (lstate.c:108)
==79057==    by 0x100013A43: lua_close (lstate.c:212)
==79057==    by 0x100001FC0: main (lua.c:389)
==79057==  Address 0x100760d00 is not stack'd, malloc'd or (recently) free'd

When I run the same in gdb, I can get parameters for all the frames, and
everything looks reasonable AFAICS (this was compiled with -O0, so I
expect all the frames are reliable):


lua(82346) malloc: *** error for object 0x1000cad00: pointer being
freed was not allocated
*** set a breakpoint in malloc_error_break to debug

Program received signal SIGABRT, Aborted.
0x00007fff862ea616 in __kill ()
(gdb) bt
#0  0x00007fff862ea616 in __kill ()
#1  0x00007fff8638acca in abort ()
#2  0x00007fff862a26f5 in free ()
#3  0x000000010001ba7c in l_alloc (ud=0x0, ptr=0x1000cad00, osize=40, nsize=0)
at lauxlib.c:631
#4  0x000000010000ef4c in luaM_realloc_ (L=0x100100080, block=0x1000cad00,
osize=40, nsize=0) at lmem.c:79
#5  0x0000000100014d72 in luaH_free (L=0x100100080, t=0x10010c840) at
ltable.c:376
#6  0x000000010000c28d in freeobj (L=0x100100080, o=0x10010c840) at lgc.c:383
#7  0x000000010000c3c9 in sweeplist (L=0x100100080, p=0x100100160, 
count=18446744073709551612) at lgc.c:424
#8  0x000000010000c716 in luaC_freeall (L=0x100100080) at lgc.c:487
#9  0x0000000100013571 in close_state (L=0x100100080) at lstate.c:108
#10 0x0000000100013a44 in lua_close (L=0x100100080) at lstate.c:212
#11 0x0000000100001fc1 in main (argc=2, argv=0x7fff5fbff958) at lua.c:389

What could I be doing wrong that would cause this error on OS X but not Linux?
This is with Lua 5.1.4.  If anyone wants to reproduce the problem, run:

$ git clone https://github.com/haberman/upb.git
$ cd upb
$ make lua
$ (cd lang_ext/lua && valgrind lua test.lua)

Josh