[Python-Dev] Messy gc death

[Tim Peters]

With the latest CVS (as of 6:30pm EDT), the std test suite blows up under
Windows release & debug builds, like so (this is debug):

Adding parser accelerators ...
Done.
test_grammar
test_opcodes
test_operations
test_builtin
test_exceptions
test_types
test_MimeWriter
test_al
test test_al skipped -- an optional feature could not be imported
test_array
test_atexit

with a memory error.  However, test_atexit works fine in isolation, so this
isn't a nice little local bug.  The death is in this function from
gcmodule.c:

static int
visit_decref(PyObject *op, void *data)
{
	if (op && PyObject_IS_GC(op)) {   ***********this line**************
		PyObject_AS_GC(op)->gc_refs--;
	}
	return 0;
}

data is NULL at this point, and op appears to be a legit memory address, but
the fields in op make no sense:  _ob_next is 0x24, _ob_prev is 1, and
ob_type is the MS "landfill" value 0xfdfdfdfd (MS debug libraries set
malloc'ed memory to that).  Chasing the bogus ob_type address is the cause
of the meltdown.

Here's the traceback:

visit_decref(_object * 0x0082ad60, void * 0x00000000) line 151 + 12 bytes
list_traverse(PyListObject * 0x0082af7c, int (_object *, void *)* 0x1e14ee2d
visit_decref(_object *, void *), void * 0x00000000) line 1339 + 11 bytes
subtract_refs(_gc_head * 0x1e1dae18 generation0) line 167 + 17 bytes
collect(_gc_head * 0x1e1dae18 generation0, _gc_head * 0x1e1dae28
generation1) line 383 + 9 bytes
collect_generations() line 481 + 15 bytes
_PyGC_Insert(_object * 0x0082ca6c) line 501
PyDict_New() line 111 + 9 bytes
PyModule_New(char * 0x0063f160) line 29 + 5 bytes
PyImport_AddModule(char * 0x0063f160) line 449 + 9 bytes
PyImport_ExecCodeModuleEx(char * 0x0063f160, _object * 0x0082b4c0, char *
0x0063eea8) line 482 + 9 bytes
load_source_module() line 758 + 17 bytes
load_module(char * 0x0063f160, _iobuf * 0x1025a908, char * 0x0063f004, int
1) line 1240 + 17 bytes
import_submodule(_object * 0x1e1e5bc0 __Py_NoneStruct, char * 0x0063f160,
char * 0x0063f160) line 1793 + 33 bytes
load_next(_object * 0x1e1e5bc0 __Py_NoneStruct, _object * 0x1e1e5bc0
__Py_NoneStruct, char * * 0x0063f274, char * 0x0063f160, int * 0x0063f15c)
line 1641 + 17 bytes
import_module_ex() line 1483 + 35 bytes
PyImport_ImportModuleEx(char * 0x007d0eec, _object * 0x007e541c, _object *
0x007e541c, _object * 0x1e1e5bc0 __Py_NoneStruct) line 1527 + 21 bytes
builtin___import__() line 47 + 21 bytes
call_builtin(_object * 0x00761fd0, _object * 0x008033ac, _object *
0x00000000) line 2404 + 11 bytes
PyEval_CallObjectWithKeywords(_object * 0x00761fd0, _object * 0x008033ac,
_object * 0x00000000) line 2369 + 17 bytes
eval_code2(PyCodeObject * 0x007e34f0, _object * 0x007e541c, _object *
0x007e541c, _object * * 0x00000000, int 0, _object * * 0x00000000, int 0,
_object * * 0x00000000, int 0, _object * 0x00000000) line 1425 + 15 bytes
PyEval_EvalCode(PyCodeObject * 0x007e34f0, _object * 0x007e541c, _object *
0x007e541c) line 303 + 31 bytes
PyImport_ExecCodeModuleEx(char * 0x0063f75c, _object * 0x007e34f0, char *
0x0063f4a4) line 506 + 17 bytes
load_source_module() line 758 + 17 bytes
load_module(char * 0x0063f75c, _iobuf * 0x1025a8e8, char * 0x0063f600, int
1) line 1240 + 17 bytes
import_submodule(_object * 0x1e1e5bc0 __Py_NoneStruct, char * 0x0063f75c,
char * 0x0063f75c) line 1793 + 33 bytes
load_next(_object * 0x1e1e5bc0 __Py_NoneStruct, _object * 0x1e1e5bc0
__Py_NoneStruct, char * * 0x0063f870, char * 0x0063f75c, int * 0x0063f758)
line 1641 + 17 bytes
import_module_ex() line 1483 + 35 bytes
PyImport_ImportModuleEx(char * 0x007da7dc, _object * 0x0076edbc, _object *
0x0079f59c, _object * 0x0079942c) line 1527 + 21 bytes
builtin___import__() line 47 + 21 bytes
call_builtin(_object * 0x00761fd0, _object * 0x007e987c, _object *
0x00000000) line 2404 + 11 bytes
PyEval_CallObjectWithKeywords(_object * 0x00761fd0, _object * 0x007e987c,
_object * 0x00000000) line 2369 + 17 bytes
eval_code2(PyCodeObject * 0x00854060, _object * 0x0076edbc, _object *
0x00000000, _object * * 0x0084cee4, int 4, _object * * 0x0084cef4, int 0,
_object * * 0x0084a3e0, int 1, _object * 0x00000000) line 1690 + 26 bytes
eval_code2(PyCodeObject * 0x00854fb0, _object * 0x0076edbc, _object *
0x00000000, _object * * 0x00771e6c, int 0, _object * * 0x00771e6c, int 0,
_object * * 0x008493d0, int 8, _object * 0x00000000) line 1590 + 88 bytes
eval_code2(PyCodeObject * 0x00854990, _object * 0x0076edbc, _object *
0x0076edbc, _object * * 0x00000000, int 0, _object * * 0x00000000, int 0,
_object * * 0x00000000, int 0, _object * 0x00000000) line 1590 + 88 bytes
PyEval_EvalCode(PyCodeObject * 0x00854990, _object * 0x0076edbc, _object *
0x0076edbc) line 303 + 31 bytes
run_node(_node * 0x007d25d0, char * 0x00760dd9, _object * 0x0076edbc,
_object * 0x0076edbc) line 895 + 17 bytes
run_err_node(_node * 0x007d25d0, char * 0x00760dd9, _object * 0x0076edbc,
_object * 0x0076edbc) line 880 + 21 bytes
PyRun_File(_iobuf * 0x1025a888, char * 0x00760dd9, int 257, _object *
0x0076edbc, _object * 0x0076edbc) line 869 + 38 bytes
PyRun_SimpleFile(_iobuf * 0x1025a888, char * 0x00760dd9) line 578 + 26 bytes
PyRun_AnyFile(_iobuf * 0x1025a888, char * 0x00760dd9) line 459 + 13 bytes
Py_Main(int 2, char * * 0x00760da0) line 273 + 34 bytes
main(int 2, char * * 0x00760da0) line 10 + 13 bytes
mainCRTStartup() line 338 + 17 bytes

No wonder Python needs Stackless to run on a Palm <wink>.

anyone-got-a-clue?-ly y'rs  - tim