Erlang segfaults in beam/erl_bestfit_alloc.c:654

[Daniël van Eeden]

Binary package hint: erlang-base

$ gdb /usr/lib/erlang/erts-5.7.4/bin/beam.smp
GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show
copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/lib/erlang/erts-5.7.4/bin/beam.smp...Reading
symbols
from /usr/lib/debug/usr/lib/erlang/erts-5.7.4/bin/beam.smp...done.
done.
(gdb) r
Starting program: /usr/lib/erlang/erts-5.7.4/bin/beam.smp
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
aobf_get_free_block (allctr=0x8201000, size=88144, cand_blk=0x0,
cand_size=0) at beam/erl_bestfit_alloc.c:654
654 beam/erl_bestfit_alloc.c: No such file or directory.
        in beam/erl_bestfit_alloc.c
(gdb) q
A debugging session is active.

        Inferior 1 [process 1750] will be killed.

Quit anyway? (y or n) y
$ apt-cache
policy /usr/lib/erlang/erts-5.7.4/bin/beam.smp
W: Unable to locate package /usr/lib/erlang/erts-5.7.4/bin/beam.smp
helga@helga:~$ dpkg -S /usr/lib/erlang/erts-5.7.4/bin/beam.smp
erlang-base-hipe: /usr/lib/erlang/erts-5.7.4/bin/beam.smp
helga@helga:~$ apt-cache policy erlang-base-hipe
erlang-base-hipe:
  Installed: 1:13.b.3-dfsg-2ubuntu2
  Candidate: 1:13.b.3-dfsg-2ubuntu2
  Version table:
 *** 1:13.b.3-dfsg-2ubuntu2 0
        500 http://nl.archive.ubuntu.com/ubuntu/ lucid/universe Packages
        100 /var/lib/dpkg/status

[Daniël van Eeden (dveeden)]

This happened with both erlang-base and erlang-base-hipe.

I suspect that value 0x0 is not correct for cand_blk?

This is the code where the segfault happens:
static Block_t *
aobf_get_free_block(Allctr_t *allctr, Uint size,
                    Block_t *cand_blk, Uint cand_size)
{
    BFAllctr_t *bfallctr = (BFAllctr_t *) allctr;
    RBTree_t *x = bfallctr->root;
    RBTree_t *blk = NULL;
    Uint blk_sz;

    ASSERT(!cand_blk || cand_size >= size);

    while (x) {
        blk_sz = BLK_SZ(x);
        if (blk_sz < size) {
            x = x->right;
        }
        else {
            blk = x;
            x = x->left;
        }
    }

    if (!blk)
        return NULL;

#ifdef HARD_DEBUG
    ASSERT(blk == check_tree(bfallctr, size));
#endif

    if (cand_blk) {
        blk_sz = BLK_SZ(blk);
        if (cand_size < blk_sz)
            return NULL; /* cand_blk was better */
        if (cand_size == blk_sz && ((void *) cand_blk) < ((void *) blk))
            return NULL; /* cand_blk was better */
    }

    aobf_unlink_free_block(allctr, (Block_t *) blk);

    return (Block_t *) blk;
}