<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:1402631810;
mso-list-type:hybrid;
mso-list-template-ids:1052429076 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1
{mso-list-id:1587838729;
mso-list-type:hybrid;
mso-list-template-ids:-2130908482 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='color:#1F497D'>Ok, I managed to analyze this a
bit better during my flight from Boston to SF.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>What is happening is this:<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='color:#1F497D'><span style='mso-list:Ignore'>1)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='color:#1F497D'>A tasklet with a C
stack is sleeping in blue.pyos.Yield. It does a receive on a channel. It does
not increment any references to that channel.<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='color:#1F497D'><span style='mso-list:Ignore'>2)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='color:#1F497D'>We start shutting
down and as part of that, we release the channel. It gets destroyed, in the
process it unlinks the sleeping tasklet which is now unlinked (with next and
prev pointers being NULL(<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='color:#1F497D'><span style='mso-list:Ignore'>3)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='color:#1F497D'>We enter PyStackless_kill_tasks_with_stacks.
It finds the tasklet and tries to unlink it in order to relink it. But it is
nowhere linked so the unlink crashes.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Now, I tried fixing it by
checking for NULL in step 3 and skipping the unlink. But I then got a crash,
because a subsequent PyTasklet_Kill() call effectively steals the reference to
the tasklet (it does a decref after killing it) and this causes a crash during
GC. <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Increfing the tasklet before
calling KILL fixes that.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Now, here are some questions,
mostly for our chief Guru:<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l1 level1 lfo2'><![if !supportLists]><span
style='color:#1F497D'><span style='mso-list:Ignore'>1)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='color:#1F497D'>Is this scenario
supposed to be possible? I tried reproing it with pure python but I found no
way to let a tasklet sleep on a channel without increfing the channel. See the
attached .py file. On the other hand, the code that deletes a channel does
unlink any sleeping tasklets, so it would appear that the design is intended to
cope with that. At any rate, we probably don’t want a sleeping tasklet
to hold a reference to a channel since then we have a reference cycle.<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l1 level1 lfo2'><![if !supportLists]><span
style='color:#1F497D'><span style='mso-list:Ignore'>2)<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='color:#1F497D'>Assuming it is
possible, and the only way to trigger it is within the context of eve, are my
bugfixes correct? I.e. checking for NULL and not unlinking, and increfing
before the PyTasklet_Kill?<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Also, any help in reproing the
case in pure python would be appreciated. <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>N.b. I get the expected behavior
(no incref in sleep) if I run in softswitching mode. Only then the bug isn’t
encountered because only tasklets with cstacks matter here.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Again, please see the attached
file for info.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>K<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
stackless-bounces@stackless.com [mailto:stackless-bounces@stackless.com] <b>On
Behalf Of </b>Kristján Valur Jónsson<br>
<b>Sent:</b> Friday, October 26, 2007 14:16<br>
<b>To:</b> Stackless mailing list<br>
<b>Subject:</b> [Stackless] a stackless crash<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span lang=IS>Hello there.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>I have a crash case during early exit of
stackless. The call stack is:<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=IS>>
python25_d.dll!slp_kill_tasks_with_stacks(_ts * ts=0x00000000) Line 344 +
0x31 bytes C<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
python25_d.dll!PyStackless_kill_tasks_with_stacks(int allthreads=1) Line
369 + 0x12 bytes C<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
python25_d.dll!Py_Finalize() Line 379 + 0x7
bytes C<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
blueD.dll!BluePyOS::Shutdown(int level=2) Line 899 + 0x8
bytes
C++<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
blueD.dll!BlueOS::Shutdown() Line 554 + 0x17
bytes C++<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
ExeFileD.exe!ExeFile::Run() Line 286 + 0x19
bytes C++<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
ExeFileD.exe!WinMain_Guarded(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ *
__formal=0x00000000, char * cmdline=0x00152325, HINSTANCE__ *
__formal=0x00000000) Line 218 C++<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
ExeFileD.exe!WinMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ *
hi2=0x00000000, char * cmdline=0x00152325, int arg=10) Line 146 + 0x15
bytes C++<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
ExeFileD.exe!__tmainCRTStartup() Line 589 + 0x35
bytes C<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
ExeFileD.exe!WinMainCRTStartup() Line 414 C<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>
kernel32.dll!_BaseProcessStart@4() + 0x23 bytes
<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=IS>And I am in the SLP_CHAIN_REMOVE macro.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>the l and r variables are both null.
That is why it crashes, it is trying to unlink a tasklet that has prev and next
both equal to NULL.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=IS>Now, why does this happen? What is this
code trying to do and is this a valid state for the tasklet object?<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=IS>Cheers,<o:p></o:p></span></p>
<p class=MsoNormal><span lang=IS>Kristján<o:p></o:p></span></p>
</div>
</div>
</body>
</html>