Problem with garbage collector while parsing

[Ingo van Lil <inguin@...>]

Hello there,

I'm currently hunting a bug in our project where the LUA garbage 
collector occasionally frees one particular Proto object although it is 
still reachable and in use. I've now managed to come up with a small 
example demonstrating the problem.

Test setup:
- Lua 5.1.4, including the official lua-5.1.4-3 patch
- lua_assert defined to assert
- Fedora 15, i386, gcc 4.6.1

The attached program (test1.lua) creates a number of entries in a table 
(depending on the command line argument), then imports a second source 
file (test2.lua). For some values of the argument (29 in my case) this 
step makes the LUA interpreter fail an assertion:

> ./lua test1.lua 29
29
lua: lgc.c:664: luaC_barrierf: Assertion `(((o)->gch.marked) & 
((1<<(2)))) && (((v)->gch.marked) & ((((1<<(0)) | (1<<(1)))))) && 
!((v)->gch.marked & (g->currentwhite ^ ((1<<(0)) | (1<<(1)))) & 
((1<<(0)) | (1<<(1)))) && !((o)->gch.marked & (g->currentwhite ^ 
((1<<(0)) | (1<<(1)))) & ((1<<(0)) | (1<<(1))))' failed.
Aborted (core dumped)

The according backtrace is:

#5  0x08058112 in luaC_barrierf (L=0x809d008, o=0x80a2c20, v=0x80a36d0) 
at lgc.c:664
#6  0x08059d87 in pushclosure (ls=0xbfe50f64, func=0xbfe50a04, 
v=0xbfe50c64) at lparser.c:319
#7  0x0805ad74 in body (ls=0xbfe50f64, e=0xbfe50c64, needself=0, 
line=33) at lparser.c:592
#8  0x0805c60b in funcstat (ls=0xbfe50f64, line=33) at lparser.c:1218
#9  0x0805c958 in statement (ls=0xbfe50f64) at lparser.c:1297
#10 0x0805ca0c in chunk (ls=0xbfe50f64) at lparser.c:1330
#11 0x0805a49d in luaY_parser (L=0x809d008, z=0xbfe51168, 
buff=0xbfe5112c, name=0x80a26e0 "@./test2.lua") at lparser.c:391
#12 0x0805412a in f_parser (L=0x809d008, ud=0xbfe51128) at ldo.c:497
#13 0x08052821 in luaD_rawrunprotected (L=0x809d008, f=0x80540ae 
<f_parser>, ud=0xbfe51128) at ldo.c:116
#14 0x0805400c in luaD_pcall (L=0x809d008, func=0x80540ae <f_parser>, 
u=0xbfe51128, old_top=228, ef=36) at ldo.c:463
#15 0x080542e1 in luaD_protectedparser (L=0x809d008, z=0xbfe51168, 
name=0x80a26e0 "@./test2.lua") at ldo.c:513
#16 0x0804fa6e in lua_load (L=0x809d008, reader=0x8066f99 <getF>, 
data=0xbfe511a8, chunkname=0x80a26e0 "@./test2.lua") at lapi.c:869
#17 0x08067287 in luaL_loadfile (L=0x809d008, filename=0x80a26c0 
"./test2.lua") at lauxlib.c:581
#18 0x08074589 in loader_Lua (L=0x809d008) at loadlib.c:385
#19 0x080537ed in luaD_precall (L=0x809d008, func=0x809d2c0, nresults=1) 
at ldo.c:319
#20 0x08053ad1 in luaD_call (L=0x809d008, func=0x809d2c0, nResults=1) at 
ldo.c:376
#21 0x0804f64d in lua_call (L=0x809d008, nargs=1, nresults=1) at lapi.c:782
#22 0x08074a70 in ll_require (L=0x809d008) at loadlib.c:473
#23 0x080537ed in luaD_precall (L=0x809d008, func=0x809d278, nresults=0) 
at ldo.c:319
#24 0x08064aaf in luaV_execute (L=0x809d008, nexeccalls=1) at lvm.c:590
#25 0x08053ae8 in luaD_call (L=0x809d008, func=0x809d260, nResults=-1) 
at ldo.c:377
#26 0x0804f6a5 in f_call (L=0x809d008, ud=0xbfe5373c) at lapi.c:800
#27 0x08052821 in luaD_rawrunprotected (L=0x809d008, f=0x804f67b 
<f_call>, ud=0xbfe5373c) at ldo.c:116
#28 0x0805400c in luaD_pcall (L=0x809d008, func=0x804f67b <f_call>, 
u=0xbfe5373c, old_top=48, ef=36) at ldo.c:463
#29 0x0804f810 in lua_pcall (L=0x809d008, nargs=1, nresults=-1, 
errfunc=2) at lapi.c:821
#30 0x0804ad49 in docall (L=0x809d008, narg=1, clear=0) at lua.c:102
#31 0x0804b568 in handle_script (L=0x809d008, argv=0xbfe53ac4, n=1) at 
lua.c:250
#32 0x0804ba7c in pmain (L=0x809d008) at lua.c:362
#33 0x080537ed in luaD_precall (L=0x809d008, func=0x809d23c, nresults=0) 
at ldo.c:319
#34 0x08053ad1 in luaD_call (L=0x809d008, func=0x809d23c, nResults=0) at 
ldo.c:376
#35 0x0804f9cc in f_Ccall (L=0x809d008, ud=0xbfe539d4) at lapi.c:846
#36 0x08052821 in luaD_rawrunprotected (L=0x809d008, f=0x804f844 
<f_Ccall>, ud=0xbfe539d4) at ldo.c:116
#37 0x0805400c in luaD_pcall (L=0x809d008, func=0x804f844 <f_Ccall>, 
u=0xbfe539d4, old_top=12, ef=0) at ldo.c:463
#38 0x0804fa1a in lua_cpcall (L=0x809d008, func=0x804b90b <pmain>, 
ud=0xbfe53a0c) at lapi.c:856
#39 0x0804bb31 in main (argc=3, argv=0xbfe53ac4) at lua.c:387

Does anybody have an idea what might be the problem here? I'm sorry if 
the code looks a bit weird, I have literally boiled down our code line 
by line and character by character to get a minimum example.

Thanks in advance,
Ingo

n = arg[1]
t = {}
print(n)
for i = 1, n do
	t[tostring(i)] = i
end

require("test2")

require("os")

constants = {
	entry1 = {
		v1 = 0.9,
		v2 = 1.1
	},
	entry2 = {
		v1 = 0.1,
		v2 = 0.3,
		value3 = 1.3,
		value4 = 1.6
	},
	entry3 = {
		v1 = 0.6,
		v2 = 0.8,
		v3 = 1,
		v4 = 0
	},
	entry4 = {
		v1 = nil,
		v2 = 5,
		v3 = 10
	}
}

local function function1()
end

function func2()
end

function abcdefghijklmnopqrstuv(aa, bb, cc)
end

empty_table = {}