require .so and call may cause abort trap at free()

[Artur Galyamov <artur-pub@...>]

Hi,

I require external .so module and call a function from it. If it creates a table, lua_close() fails with abort trap somewhere in collector code. I'm stuck with it, can someone please test this on similar configuration?

test.c was reduced from bigger source.
OSX 10.6.8, Lua 5.2.0 release (tar xf, make macosx, make install) in /usr/local

cc, gcc and clang all give same results. I tried it with 5.1.4, still same results..

If I do main() && luaL_newstate() && luaopen_test() && luaL_dostring() in test.c, it's all ok.
It seems that problem is in test.so itself… Is my test.so build process okay?

Thanks in advance.

-- Artur

$ cc test.c -shared -o test.so -llua -lm

$ lua bug.lua
table: 0x100105280
lua(1716) malloc: *** error for object 0x1000a8ea0: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Abort trap

$ lua -v
Lua 5.2.0  Copyright (C) 1994-2011 Lua.org, PUC-Rio

$ uname -a
Darwin iMac-Artur-Galamov.local 10.8.0 Darwin Kernel Version 10.8.0: Tue Jun  7 16:33:36 PDT 2011; root:xnu-1504.15.3~1/RELEASE_I386 i386

$ cat bug.lua
local m = require "test"
print(m.func())

$ cat test.c

#include <lauxlib.h>
#include <lua.h>
#include <lualib.h>

static int
fn_func(lua_State *L)
{
   //return 0; // uncomment to prevent abort trap
   lua_newtable(L); // <<<<< problem origin here
   return 1;
}

static const luaL_Reg lib[] = {
   { "func", fn_func },
   { NULL, NULL },
};

int
luaopen_test(lua_State *L)
{
   lua_newtable(L);
   luaL_setfuncs(L, lib, 0);
   return 1;
}


$ gdb --args lua bug.lua
...
(gdb) r
Starting program: /usr/local/bin/lua bug.lua
Reading symbols for shared libraries ++.. done
Reading symbols for shared libraries . done
table: 0x100105290
lua(2120) malloc: *** error for object 0x1000a8ea0: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug

Program received signal SIGABRT, Aborted.
0x00007fff85ca80b6 in __kill ()
(gdb) bt
#0  0x00007fff85ca80b6 in __kill ()
#1  0x00007fff85d489f6 in abort ()
#2  0x00007fff85c60195 in free ()
#3  0x000000010001460a in l_alloc ()
#4  0x000000010000c07d in luaM_realloc_ ()
#5  0x0000000100010aaa in luaH_free ()
#6  0x0000000100009e84 in sweeplist ()
#7  0x0000000100009f66 in luaC_freeallobjects ()
#8  0x000000010000fc1f in close_state ()
#9  0x000000010000150c in main ()
(gdb)