Re: "Invalid free()" with C extension on OS X

[Peter Odding <peter@...>]

Hi Josh,

I'm writing the Lua/APR binding which currently includes a very naive 
multi threading module. To improve the situation I'm trying to make it 
possible to share (a selection of userdata) objects between Lua states. 
While working on this functionality I've been getting segmentation 
faults with either of two stack traces, one originating from the 
original thread, the other originating from the newly spawned thread. 
Here is one of those stack traces:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7fe6b70 (LWP 8556)]
0x003571ae in ?? () from /lib/libgcc_s.so.1
(gdb) thread 1
[Switching to thread 1 (Thread 0xb7fe76c0 (LWP 8554))]#0  0x00255ec0 in 
*__GI___libc_free (mem=0x806f9e0) at malloc.c:3736
(gdb) bt
#0  0x00255ec0 in *__GI___libc_free (mem=0x806f9e0) at malloc.c:3736
#1  0x0805a288 in l_alloc (ud=0x0, ptr=0x806f9d8, osize=32, nsize=0) at 
lauxlib.c:631
#2  0x08052783 in luaM_realloc_ (L=0x806d008, block=0x806f9e0, osize=32, 
nsize=0) at lmem.c:79
#3  0x080566cc in luaH_free (L=0x806d008, t=0x806f9e0) at ltable.c:378
#4  0x08051f7f in freeobj (L=<value optimized out>, p=0x806d094, 
count=4294966552) at lgc.c:383
#5  sweeplist (L=<value optimized out>, p=0x806d094, count=4294966552) 
at lgc.c:424
#6  0x08052032 in luaC_freeall (L=0x806d008) at lgc.c:487
#7  0x08055c74 in close_state (L=0x806d008) at lstate.c:108
#8  0x0804b81f in main (argc=4, argv=0xbffff544) at lua.c:621

It's not exactly the same as the stack trace you're getting but it does 
seem very similar:

> ==79057== Invalid free() / delete / delete[]
> ==79057==    at 0x10005846F: free (vg_replace_malloc.c:366)
> ==79057==    by 0x10001BA7B: l_alloc (lauxlib.c:631)
> ==79057==    by 0x10000EF4B: luaM_realloc_ (lmem.c:79)
> ==79057==    by 0x100014D71: luaH_free (ltable.c:376)
> ==79057==    by 0x10000C28C: freeobj (lgc.c:383)
> ==79057==    by 0x10000C3C8: sweeplist (lgc.c:424)
> ==79057==    by 0x10000C715: luaC_freeall (lgc.c:487)
> ==79057==    by 0x100013570: close_state (lstate.c:108)
> ==79057==    by 0x100013A43: lua_close (lstate.c:212)
> ==79057==    by 0x100001FC0: main (lua.c:389)
> ==79057==  Address 0x100760d00 is not stack'd, malloc'd or (recently) free'd

Anyway, to get to my point: I'm thinking my problem is related to 
allocating memory in one thread and then trying to deallocate the memory 
in another thread (either that or a race condition between the memory 
allocators of both threads). Might this be your problem as well? I've 
tried looking through 
https://github.com/haberman/upb/blob/master/lang_ext/lua/upb.c and don't 
see any threading code but that might live in another part of your 
project and I don't have time to look through all of it.

I hope you manage to pinpoint the cause of your crash, good luck!

 - Peter Odding

PS. Despite tools like Valgrind and GDB I hate having to debug these 
kinds of issues. I'll be glad when my binding works and I can retreat to 
the safe sandbox that is Lua :-)