search

salsa-rs / salsa

A generic framework for on-demand, incrementalized computation. Inspired by adapton, glimmer, and rustc's query system.
https://salsa-rs.netlify.app/
Apache License 2.0
2.14k stars 152 forks source link

Bad memory access #462

Open s-panferov opened 1 year ago

s-panferov commented 1 year ago

Hi, I was able to catch an invalid memory access in Salsa that is reproducible on database Drop:

__pthread_kill (@__pthread_kill:5)
pthread_kill (@pthread_kill:75)
abort (@abort:48)
malloc_vreport (@malloc_vreport:230)
malloc_zone_error (@malloc_zone_error:29)
tiny_free_list_remove_ptr (@tiny_free_list_remove_ptr:128)
tiny_free_no_lock (@tiny_free_no_lock:112)
free_tiny (@free_tiny:127)
alloc::alloc::dealloc (@<alloc::alloc::Global as core::alloc::Allocator>::deallocate:36)
<alloc::alloc::Global as core::alloc::Allocator>::deallocate (@<alloc::alloc::Global as core::alloc::Allocator>::deallocate:27)
<&A as core::alloc::Allocator>::deallocate (@<&A as core::alloc::Allocator>::deallocate:14)
<alloc::sync::Weak<T,A> as core::ops::drop::Drop>::drop (@<alloc::sync::Weak<T,A> as core::ops::drop::Drop>::drop:95)
core::ptr::drop_in_place<alloc::sync::Weak<salsa_2022::function::memo::Memo<uuid::Uuid>,&alloc::alloc::Global>> (@core::ptr::drop_in_place<alloc::sync::Weak<salsa_2022::function::memo::Memo<uuid::Uuid>,&alloc::alloc::Global>>:9)
core::mem::drop (@alloc::sync::Arc<T,A>::drop_slow:20)
alloc::sync::Arc<T,A>::drop_slow (@alloc::sync::Arc<T,A>::drop_slow:19)
<alloc::sync::Arc<T,A> as core::ops::drop::Drop>::drop (@<alloc::sync::Arc<T,A> as core::ops::drop::Drop>::drop:41)
core::ptr::drop_in_place<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>> (@core::ptr::drop_in_place<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>:9)
core::mem::drop (@core::mem::drop:10)
arc_swap::ref_cnt::RefCnt::dec (/Users/stanislav/.cargo/registry/src/index.crates.io-6f17d22bba15001f/arc-swap-1.6.0/src/ref_cnt.rs:86)
<arc_swap::ArcSwapAny<T,S> as core::ops::drop::Drop>::drop (/Users/stanislav/.cargo/registry/src/index.crates.io-6f17d22bba15001f/arc-swap-1.6.0/src/lib.rs:328)
core::ptr::drop_in_place<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>> (@core::ptr::drop_in_place<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>:9)
core::ptr::drop_in_place<core::cell::UnsafeCell<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>> (@core::ptr::drop_in_place<core::cell::UnsafeCell<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>>:9)
core::ptr::drop_in_place<dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>> (@core::ptr::drop_in_place<dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>>:9)
core::ptr::drop_in_place<(test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>)> (@core::ptr::drop_in_place<(test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>)>:9)
core::ptr::mut_ptr::<impl *mut T>::drop_in_place (@hashbrown::raw::inner::Bucket<T>::drop:12)
hashbrown::raw::inner::Bucket<T>::drop (/Users/stanislav/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hashbrown-0.14.2/src/raw/mod.rs:592)
hashbrown::raw::inner::RawTableInner::drop_elements (/Users/stanislav/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hashbrown-0.14.2/src/raw/mod.rs:2381)
hashbrown::raw::inner::RawTableInner::drop_inner_table (/Users/stanislav/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hashbrown-0.14.2/src/raw/mod.rs:2436)
<hashbrown::raw::inner::RawTable<T,A> as core::ops::drop::Drop>::drop (/Users/stanislav/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hashbrown-0.14.2/src/raw/mod.rs:3697)
core::ptr::drop_in_place<hashbrown::raw::inner::RawTable<(test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>)>> (@core::ptr::drop_in_place<hashbrown::raw::inner::RawTable<(test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>)>>:9)
core::ptr::drop_in_place<hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>> (@core::ptr::drop_in_place<hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>:9)
core::ptr::drop_in_place<core::cell::UnsafeCell<hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>> (@core::ptr::drop_in_place<core::cell::UnsafeCell<hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>>:9)
core::ptr::drop_in_place<lock_api::rwlock::RwLock<dashmap::lock::RawRwLock,hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>> (@core::ptr::drop_in_place<lock_api::rwlock::RwLock<dashmap::lock::RawRwLock,hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>>:9)
core::ptr::drop_in_place<[lock_api::rwlock::RwLock<dashmap::lock::RawRwLock,hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>]> (@core::ptr::drop_in_place<[lock_api::rwlock::RwLock<dashmap::lock::RawRwLock,hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>]>:27)
core::ptr::drop_in_place<alloc::boxed::Box<[lock_api::rwlock::RwLock<dashmap::lock::RawRwLock,hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>]>> (@core::ptr::drop_in_place<alloc::boxed::Box<[lock_api::rwlock::RwLock<dashmap::lock::RawRwLock,hashbrown::map::HashMap<test_db::query::meta::WellKnownMetadata,dashmap::util::SharedValue<arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>]>>:13)
core::ptr::drop_in_place<dashmap::DashMap<test_db::query::meta::WellKnownMetadata,arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>> (@core::ptr::drop_in_place<dashmap::DashMap<test_db::query::meta::WellKnownMetadata,arc_swap::ArcSwapAny<alloc::sync::Arc<salsa_2022::function::memo::Memo<uuid::Uuid>>>,core::hash::BuildHasherDefault<rustc_hash::FxHasher>>>:9)
core::ptr::drop_in_place<salsa_2022::function::memo::MemoMap<test_db::query::meta::WellKnownMetadata,uuid::Uuid>> (@core::ptr::drop_in_place<salsa_2022::function::memo::MemoMap<test_db::query::meta::WellKnownMetadata,uuid::Uuid>>:9)
core::ptr::drop_in_place<salsa_2022::function::FunctionIngredient<test_db::query::meta::__WellKnownMetadataId>> (@core::ptr::drop_in_place<salsa_2022::function::FunctionIngredient<test_db::query::meta::__WellKnownMetadataId>>:10)
core::ptr::drop_in_place<(salsa_2022::function::FunctionIngredient<test_db::query::meta::__WellKnownMetadataId>,salsa_2022::function::FunctionIngredient<test_db::query::meta::__WellKnownMetadataSlug>,salsa_2022::tracked_struct::TrackedStructIngredient<test_db::query::meta::WellKnownMetadata,()>)> (@core::ptr::drop_in_place<(salsa_2022::function::FunctionIngredient<test_db::query::meta::__WellKnownMetadataId>,salsa_2022::function::FunctionIngredient<test_db::query::meta::__WellKnownMetadataSlug>,salsa_2022::tracked_struct::TrackedStructIngredient<test_db::query::meta::WellKnownMetadata,()>)>:9)
core::ptr::drop_in_place<test_db::db::Jar> (@core::ptr::drop_in_place<test_db::db::Jar>:85)
core::ptr::drop_in_place<(test_db::db::Jar,)> (@core::ptr::drop_in_place<(test_db::db::Jar,)>:9)
alloc::sync::Arc<T,A>::drop_slow (@alloc::sync::Arc<T,A>::drop_slow:13)
<alloc::sync::Arc<T,A> as core::ops::drop::Drop>::drop (@<alloc::sync::Arc<T,A> as core::ops::drop::Drop>::drop:41)
core::ptr::drop_in_place<alloc::sync::Arc<(test_db::db::Jar,)>> (@core::ptr::drop_in_place<alloc::sync::Arc<(test_db::db::Jar,)>>:9)
core::ptr::drop_in_place<core::option::Option<alloc::sync::Arc<(test_db::db::Jar,)>>> (@core::ptr::drop_in_place<core::option::Option<alloc::sync::Arc<(test_db::db::Jar,)>>>:24)
core::mem::drop (@core::mem::drop:10)
<salsa_2022::storage::Storage<DB> as core::ops::drop::Drop>::drop (/Users/stanislav/.cargo/git/checkouts/salsa-61760caba2b17ca5/d4a94fb/components/salsa-2022/src/storage.rs:181)
core::ptr::drop_in_place<salsa_2022::storage::Storage<test_db::db::Database>> (@core::ptr::drop_in_place<salsa_2022::storage::Storage<test_db::db::Database>>:9)
core::ptr::drop_in_place<test_db::db::Database> (@core::ptr::drop_in_place<test_db::db::Database>:9)
core::ptr::drop_in_place<test_db::workspace::WorkspaceDatabase> (@core::ptr::drop_in_place<test_db::workspace::WorkspaceDatabase>:21)
core::ptr::drop_in_place<test_workspace::workspace::WorkspaceActor> (@core::ptr::drop_in_place<test_workspace::workspace::WorkspaceActor>:22)
core::ptr::drop_in_place<test_test::TestWorkspace> (@core::ptr::drop_in_place<test_test::TestWorkspace>:9)
core::mem::drop (@core::mem::drop:6)
load_fs::workspace_load_with_files (/Users/stanislav/Workspace/monorepo/packages/test/test-test/tests/load-fs.rs:32)
load_fs::workspace_load_with_files::{{closure}} (/Users/stanislav/Workspace/monorepo/packages/test/test-test/tests/load-fs.rs:7)
core::ops::function::FnOnce::call_once (@core::ops::function::FnOnce::call_once:8)
core::ops::function::FnOnce::call_once (@test::__rust_begin_short_backtrace:10)
test::__rust_begin_short_backtrace (@test::__rust_begin_short_backtrace:8)
test::run_test_in_process::{{closure}} (@test::run_test::{{closure}}:146)
<core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once (@test::run_test::{{closure}}:143)

I'm working on some minimal example, but maybe you can extract some useful information from this debugger stacktrace.

DropDemBits commented 1 year ago

Wondering if miri catches the invalid memory access?

This looks like a double-free looking at the backtrace, so once you find the alloc id in miri, you can use MIRIFLAGS="-Zmiri-track-alloc-id=<alloc-id>" to find where the first free happens.