SBCL crashes when saving a core

[Vasily Postnicov]

Hi! I use FreeBSD 13.1 on x86-64.

When trying to compile nyxt I get the following error:
* (ql:quickload :nyxt/gtk)
<output stripped>
* (asdf:make :nyxt/gtk-application)
[undoing binding stack and other enclosing state... done]
[performing final GC... done]
[defragmenting immobile space... fatal error encountered in SBCL pid 70097 pthread 0x800a12000:
GC invariant lost, file "gencgc.c", line 1265

(fin,inst,fdefn,code,sym)=7831+3286+50293+44938+33310... Welcome to LDB, a low-level debugger for the Lisp runtime environment.
ldb> q
Really quit? [y] y

I bisected the error to 609a19b, but this error appears even after the fix 48d686f. Only the message changes from "Ptr ... sees junk" to "GC invariant lost"

Related report:
https://bugs.launchpad.net/sbcl/+bug/1983218

UPD: I am building with sh make.sh --with-sb-thread

[Douglas Katzman (dougk)]

it worked for me on linux:
* (asdf:make :nyxt/gtk-application)
[undoing binding stack and other enclosing state... done]
[performing final GC... done]
[defragmenting immobile space... (fin,inst,fdefn,code,sym)=7792+3353+50025+44604+33436... done]
[saving current Lisp image into /home/dougk/quicklisp/dists/quicklisp/software/nyxt-20220331-git/nyxt:
writing 26884432 bytes from the read-only space at 0xffe658000
writing 9184 bytes from the static space at 0x50100000
writing 84738048 bytes from the dynamic space at 0x1000000000
writing 3989504 bytes from the immobile space at 0x50200000
writing 30097408 bytes from the immobile space at 0x52a00000
done]

I'll have to install freeBSD to see if I can repro it. Do you know if you configured the OS with ASLR enabled by default? That looks new for 13 but not enabled.

[Douglas Katzman (dougk)]

Building gtk failed on FreeBSD for me.
Maybe as a user of nyxt/gtk you have some idea about how to proceed past this.
Meanwhile I'll checkin a patch to avoid read-only strings on FreeBSD (similar to https://sourceforge.net/p/sbcl/sbcl/ci/625ebdb9ba)

* (ql:quickload :nyxt/gtk)
<lots of stuff that seemed to work>
[package gtk].....................................
..................................................
..................................................
..................................................
...................................
(sbcl:6688): GLib-GObject-WARNING **: 09:52:47.762: specified class size for type 'WebKitWebViewBase' is smaller than the parent type's 'GtkWidget' class size

(sbcl:6688): GLib-CRITICAL **: 09:52:47.762: g_once_init_leave: assertion 'result != 0' failed

(sbcl:6688): GLib-GObject-CRITICAL **: 09:52:47.763: g_type_register_static: assertion 'parent_type > 0' failed

(sbcl:6688): GLib-CRITICAL **: 09:52:47.763: g_once_init_leave: assertion 'result != 0' failed

debugger invoked on a TYPE-ERROR @232F13C4 in thread
#<THREAD "main thread" RUNNING {1043358003}>:
  The value
    NIL
  is not of type
    GOBJECT:GTYPE

Type HELP for debugger help, or (SB-EXT:EXIT) to exit from SBCL.

restarts (invokable by number or by possibly-abbreviated name):
  0: [TRY-RECOMPILING ] Recompile webkit2.web-view and try loading it again

[Vasily Postnicov (shamaz-mazum)]

> Do you know if you configured the OS with ASLR enabled by default?

It seems not.

vasily@vonbraun:~ % sysctl kern.elf64
kern.elf64.allow_wx: 1
kern.elf64.sigfastblock: 1
kern.elf64.aslr.stack: 0
kern.elf64.aslr.honor_sbrk: 1
kern.elf64.aslr.pie_enable: 0
kern.elf64.aslr.enable: 0
kern.elf64.pie_base: 16912384
kern.elf64.vdso: 1
kern.elf64.nxstack: 1
kern.elf64.fallback_brand: -1

Also SBCL's memory map does not look randomized:

vasily@vonbraun:~ % cat /proc/XXXX/map
0x200000 0x21c000 28 0 0xfffff8012557e528 r-- 4 2 0x1000 COW NC vnode /home/vasily/sbcl/src/runtime/sbcl NCH -1
0x21c000 0x250000 52 0 0xfffff8012557e528 r-x 4 2 0x1000 COW NC vnode /home/vasily/sbcl/src/runtime/sbcl NCH -1
0x250000 0x252000 2 0 0xfffff8006cf71528 r-- 1 0 0x3010 COW NC vnode /home/vasily/sbcl/src/runtime/sbcl CH 1001
0x252000 0x253000 1 0 0xfffff8006d059630 rw- 1 0 0x3010 COW NNC vnode /home/vasily/sbcl/src/runtime/sbcl CH 1001
0x253000 0x25b000 8 0 0xfffff8006f669a50 rw- 1 0 0x3010 COW NNC swap - CH 1001
0x20000000 0x20100000 15 0 0xfffff807ae7a2738 rwx 1 0 0x3010 COW NNC swap - CH 1001
0x20100000 0x20108000 8 0 0xfffff807861c0948 rwx 1 0 0x3010 COW NNC vnode /home/vasily/sbcl/output/sbcl.core CH 1001
0x20108000 0x20200000 0 0 0xfffff80070689630 rwx 1 0 0x2010 COW NC swap - CH 1001
0x20200000 0x20201000 1 0 0xfffff800704fb108 rwx 1 0 0x3010 COW NNC vnode /home/vasily/sbcl/output/sbcl.core CH 1001
<output skipped>

> Building gtk failed on FreeBSD for me.

I forgot to say I use Ultralisp. Will this help?

[Douglas Katzman (dougk)]

I reinstalled a different release of webkit2-gtk. Then it succeeded, just the same as on linux.

Can you give me the complete command you used to build SBCL with any local customizations?
Most importantly, the --dynamic-space-size for building nyxt.
And then the exact steps to build using ultralisp please.

[Vasily Postnicov (shamaz-mazum)]

O_o I tried again in a fresh jail with the same result. The recipe:

1) Download FreeBSD 13.1 base from here:
https://download.freebsd.org/ftp/releases/amd64/13.1-RELEASE/base.txz
2) Extract the archive somewhere (like /jails/sbcl).
3) Create /etc/jail.conf with the following content:

sbcl {
    host.hostname = sbcl.local; # Hostname
    path = "/jails/sbcl"; # Path to the jail
    ip4 = inherit;
    ip6 = inherit;
    mount.devfs; # Mount devfs inside the jail
    exec.start = "/bin/sh /etc/rc"; # Start command
    exec.stop = "/bin/sh /etc/rc.shutdown"; # Stop command
}

4) From root do "service jail onestart sbcl"
5) jls and jexec <the number jls shows you> tcsh
6) In the jail exec "pkg install sbcl gmake git webkit2-gtk3 pkgconf libfixposix" (I hope I didn't miss anything)
6.5) Comment the line in /usr/local/etc/sbclrc
7) Create a new user with adduser and exec "su <new-user-name>"
8) Install quicklisp as usual. Cd to local-projects and exec "git clone https://github.com/atlas-engineer/nyxt". In nyxt directory do "git checkout 07f2a69 && git submodule update --init". This way we make sure we work with the same version.
9) Clone sbcl and checkout commit aaa1ff5 (the most recent commit now).
10) Exec "sh make.sh --with-sb-thread"
11) Exec "sh run-sbcl.sh --dynamic-space-size 16gb"
12) Run "(asdf:make :nyxt/gtk-application)"

You will see the bug (I hope):
* vasily@sbcl:~/sbcl % sh run-sbcl.sh --dynamic-space-size 16gb
This is SBCL 2.2.7.16-aaa1ff57f, an implementation of ANSI Common Lisp.
More information about SBCL is available at <http://www.sbcl.org/>.

SBCL is free software, provided as is, with absolutely no warranty.
It is mostly in the public domain; some portions are provided under
BSD-style licenses. See the CREDITS and COPYING files in the
distribution for more information.

; file: /usr/home/vasily/quicklisp/quicklisp/dist.lisp
; in: DEFUN CONFIG-FILE-INITARGS
; (INTERN (FUNCALL QL-DIST::*INITARG-CASE-CONVERTER* STRING) 'KEYWORD)
;
; note: deleting unreachable code
;
; compilation unit finished
; printed 1 note
* *features*
(:QUICKLISP :ASDF3.3 :ASDF3.2 :ASDF3.1 :ASDF3 :ASDF2 :ASDF :OS-UNIX
 :NON-BASE-CHARS-EXIST-P :ASDF-UNICODE :X86-64 :GENCGC :64-BIT :ANSI-CL :BSD
 :COMMON-LISP :ELF :FREEBSD :IEEE-FLOATING-POINT :LITTLE-ENDIAN
 :PACKAGE-LOCAL-NICKNAMES :SB-LDB :SB-PACKAGE-LOCKS :SB-THREAD :SB-UNICODE
 :SBCL :UNIX)
* (asdf:make :nyxt/gtk-application)
<output-skipped>
; wrote /usr/home/vasily/.cache/common-lisp/sbcl-2.2.7.16-aaa1ff57f-bsd-x64/usr/home/vasily/quicklisp/local-projects/nyxt/source/renderer/gtk-tmp9CVQRK5N.fasl
; compilation finished in 0:00:03.237
[undoing binding stack and other enclosing state... done]
[performing final GC... done]
[defragmenting immobile space... fatal error encountered in SBCL pid 16618:
GC invariant lost, file "gencgc.c", line 1265

(fin,inst,fdefn,code,sym)=8499+3372+52694+46238+33493... Welcome to LDB, a low-level debugger for the Lisp runtime environment.
ldb>

I did this in a jail on purpose (to be sure the process is not affected by anything in my home directory or the main system). If you are not familiar with...

[Douglas Katzman (dougk)]

Thank you for that recipe. I can now make progress on the invariant lossage.

[Douglas Katzman (dougk)]

Your instructions were great, thank you again!

You observed two different bugs. The first was (probably) the other one that you referenced, but I didn't go back and check, because current head doesn't have that problem. However, I incorrectly inferred that you meant you built at the released (broken) SBCL plus *only* the patch for the other bug. In fact what happened is you built at head which had a completely different bug from after the release, which is fixed by https://sourceforge.net/p/sbcl/sbcl/ci/cd6e8273d

[Vasily Postnicov (shamaz-mazum)]

Thanks, it works! I changed the status to "Fix Committed". I hope this is what I need to do ;)