Hi,
ro...@web.de writes:
> Hello,
>
> The attached simple test calls free functions with bad smob_tag.
> I see the same stuff with 2.2.0
> There are no errors using the stable 2.0.11 version.
>
> static size_t
> free_box (SCM box_smob)
> {
> if (SCM_TYP16(box_smob) != scm_tc16_box) {
> // bad type, do not free it
> fprintf (stderr, "[free] error: bad smob 0x%x\n",
> (int)SCM_TYP16(box_smob));
> exit (-1);
> }
> return 0;
> }
I believe this is fallout from this bug fix in which markers and
finalizers could race each other:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=19883
The basic issue is that finalizers run asynchronously on values that are
still live, yet they can invalidate invariants on those live values.
Concurrent markers can then see objects which are being concurrently
finalized, causing intermittent hard-to-debug crashes that couldn't be
properly fixed.
The fix was to "null out" the SMOB tag before calling the finalizer, in
such a way to prevent future GCs from invoking the SMOB mark function on
an object that was being finalized. So the new expectation is that
finalizers see the SMOB tag as being scm_tc7_smob + SMOB number 0,
indicating the "finalized" smob type.
I guess we weren't aware of how this might affect other users that check
the SMOB tag during the free function. Apologies for that undocumented
change. It was necessary though to fix 19883.
Andy
