Crash in termination error detection.

[mjp41]

The following file

# pragma_disable_implicit_freezing()
x = {}
x.f = Region()
x.f.f = {}
x.f.f.f = x.f
y = Region()
y.f = x.f.f

This causes an error inside snmalloc that the object it deallocs is bad.

  * frame #0: 0x00007ffff7bd29fc libc.so.6`pthread_kill + 300
    frame #1: 0x00007ffff7b7e476 libc.so.6`raise + 22
    frame #2: 0x00007ffff7b647f3 libc.so.6`abort + 211
    frame #3: 0x000055555571ad1b frankenscript`snmalloc::PALPOSIX<snmalloc::PALLinux, &(writev), &(fsync)>::error(str="assert fail: is_start_of_object( sizeclass_t::from_small_class(i), address_cast(p)) in /home/mjp41/frankenscript/build/_deps/snmalloc-src/src/snmalloc/backend_helpers/../mem/localcache.h on 82 \n") at pal_posix.h:191:12
    frame #4: 0x000055555571aa72 frankenscript`void snmalloc::report_fatal_error<1024ul, char const*, char const*, char const*, char const*>((null)="assert fail: {} in {} on {} \n", (null)="is_start_of_object( sizeclass_t::from_small_class(i), address_cast(p))", (null)="/home/mjp41/frankenscript/build/_deps/snmalloc-src/src/snmalloc/backend_helpers/../mem/localcache.h", (null)="82") at pal.h:174:22
    frame #5: 0x00005555557218e0 frankenscript`bool snmalloc::LocalCache::flush<1792ul, snmalloc::StandardConfigClientMeta<snmalloc::NoClientMetaDataProvider>, snmalloc::CoreAllocator<snmalloc::StandardConfigClientMeta<snmalloc::NoClientMetaDataProvider> >::flush(bool)::'lambda2'(snmalloc::CapPtr<void, snmalloc::capptr::bound<(snmalloc::capptr::dimension::Spatial)0, (snmalloc::capptr::dimension::AddressSpaceControl)0, (snmalloc::capptr::dimension::Wildness)1> >)>(this=0x00007ffff7a4f760, local_state=0x00007fbff7a48600, dealloc=(unnamed struct) @ 0x00007fffffffa678)::'lambda2'(snmalloc::CapPtr<void, snmalloc::capptr::bound<(snmalloc::capptr::dimension::Spatial)0, (snmalloc::capptr::dimension::AddressSpaceControl)0, (snmalloc::capptr::dimension::Wildness)1> >)) at localcache.h:82:11
    frame #6: 0x000055555571ee1d frankenscript`snmalloc::CoreAllocator<snmalloc::StandardConfigClientMeta<snmalloc::NoClientMetaDataProvider> >::flush(this=0x00007fbff7a48000, destroy_queue=false) at corealloc.h:872:73
    frame #7: 0x000055555571b91d frankenscript`snmalloc::LocalAllocator<snmalloc::StandardConfigClientMeta<snmalloc::NoClientMetaDataProvider> >::flush(this=0x00007ffff7a4f760) at localalloc.h:408:26
    frame #8: 0x000055555571b725 frankenscript`snmalloc::LocalAllocator<snmalloc::StandardConfigClientMeta<snmalloc::NoClientMetaDataProvider> >::teardown(this=0x00007ffff7a4f760) at localalloc.h:754:14
    frame #9: 0x00005555557133fa frankenscript`snmalloc::pthread_cleanup_main_thread() at threadalloc.h:109:32
    frame #10: 0x00007ffff7b81495 libc.so.6`___lldb_unnamed_symbol3242 + 261
    frame #11: 0x00007ffff7b81610 libc.so.6`exit + 32
    frame #12: 0x000055555556977e frankenscript`rt::post_run(initial_count=33, ui=0x00007fbff6ab0a80) at rt.cc:254:16
    frame #13: 0x0000555555651bf4 frankenscript`verona::interpreter::start(main_body=trieste::Node @ 0x00007fffffffaa50, step_counter=2147483647) at interpreter.cc:520:17
    frame #14: 0x00005555555991df frankenscript`load_trieste(argc=3, argv=0x00007fffffffdd88) at lang.cc:58:31
    frame #15: 0x00005555556b4c43 frankenscript`main(argc=3, argv=0x00007fffffffdd88) at main.cc:9:22
    frame #16: 0x00007ffff7b65d90 libc.so.6`___lldb_unnamed_symbol3139 + 128
    frame #17: 0x00007ffff7b65e40 libc.so.6`__libc_start_main + 128
    frame #18: 0x0000555555568455 frankenscript`_start + 37

So I switched on ASAN and got

=================================================================
==10830==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000009720 at pc 0x5555555cc21d bp 0x7fffffff8e00 sp 0x7fffffff8df0
READ of size 8 at 0x608000009720 thread T0
    #0 0x5555555cc21c in rt::objects::Region::dec_lrc(rt::objects::Region*) /home/mjp41/frankenscript/src/rt/objects/region.h:75
    #1 0x5555555c5f00 in rt::objects::remove_region_reference(rt::objects::Region*, rt::objects::Region*) /home/mjp41/frankenscript/src/rt/objects/region.cc:134
    #2 0x5555555c72aa in rt::objects::move_reference(rt::objects::DynObject*, rt::objects::DynObject*, rt::objects::DynObject*) /home/mjp41/frankenscript/src/rt/objects/region.cc:262
    #3 0x55555559a2f4 in rt::move_reference(rt::objects::DynObject*, rt::objects::DynObject*, rt::objects::DynObject*) /home/mjp41/frankenscript/src/rt/rt.cc:188
    #4 0x5555557a9d3c in verona::interpreter::Interpreter::run_stmt(trieste::intrusive_ptr<trieste::NodeDef>&) /home/mjp41/frankenscript/src/lang/interpreter.cc:273
    #5 0x5555557ac67f in verona::interpreter::Interpreter::run(trieste::intrusive_ptr<trieste::NodeDef>) /home/mjp41/frankenscript/src/lang/interpreter.cc:443
    #6 0x5555557a2518 in verona::interpreter::start(trieste::intrusive_ptr<trieste::NodeDef>, int) /home/mjp41/frankenscript/src/lang/interpreter.cc:518
    #7 0x5555556042f9 in load_trieste(int, char**) /home/mjp41/frankenscript/src/lang/lang.cc:58
    #8 0x5555558ab724 in main /home/mjp41/frankenscript/src/main.cc:9
    #9 0x7ffff7089d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #10 0x7ffff7089e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #11 0x555555598814 in _start (/home/mjp41/frankenscript/build/frankenscript+0x44814)

0x608000009720 is located 0 bytes inside of 88-byte region [0x608000009720,0x608000009778)
freed by thread T0 here:
    #0 0x7ffff767f24f in operator delete(void*, unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:172
    #1 0x55555559f16f in rt::objects::Region::collect() (/home/mjp41/frankenscript/build/frankenscript+0x4b16f)
    #2 0x55555559e8c0 in rt::objects::Region::terminate_region() /home/mjp41/frankenscript/src/rt/objects/region.h:182
    #3 0x5555555a0e4b in rt::objects::DynObject::freeze() (/home/mjp41/frankenscript/build/frankenscript+0x4ce4b)
    #4 0x5555555c4789 in rt::objects::implicit_freeze(rt::objects::DynObject*) /home/mjp41/frankenscript/src/rt/objects/region.cc:31
    #5 0x5555555c632e in rt::objects::add_region_reference(rt::objects::Region*, rt::objects::DynObject*, rt::objects::DynObject*) /home/mjp41/frankenscript/src/rt/objects/region.cc:190
    #6 0x5555555c7297 in rt::objects::move_reference(rt::objects::DynObject*, rt::objects::DynObject*, rt::objects::DynObject*) /home/mjp41/frankenscript/src/rt/objects/region.cc:259
    #7 0x55555559a2f4 in rt::move_reference(rt::objects::DynObject*, rt::objects::DynObject*, rt::objects::DynObject*) /home/mjp41/frankenscript/src/rt/rt.cc:188
    #8 0x5555557a9d3c in verona::interpreter::Interpreter::run_stmt(trieste::intrusive_ptr<trieste::NodeDef>&) /home/mjp41/frankenscript/src/lang/interpreter.cc:273
    #9 0x5555557ac67f in verona::interpreter::Interpreter::run(trieste::intrusive_ptr<trieste::NodeDef>) /home/mjp41/frankenscript/src/lang/interpreter.cc:443
    #10 0x5555557a2518 in verona::interpreter::start(trieste::intrusive_ptr<trieste::NodeDef>, int) /home/mjp41/frankenscript/src/lang/interpreter.cc:518
    #11 0x5555556042f9 in load_trieste(int, char**) /home/mjp41/frankenscript/src/lang/lang.cc:58
    #12 0x5555558ab724 in main /home/mjp41/frankenscript/src/main.cc:9
    #13 0x7ffff7089d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

previously allocated by thread T0 here:
    #0 0x7ffff767e1e7 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x5555555c8b48 in rt::objects::create_region() /home/mjp41/frankenscript/src/rt/objects/region.cc:425
    #2 0x55555559929e in rt::create_region() /home/mjp41/frankenscript/src/rt/rt.cc:80
    #3 0x5555555f3f67 in operator()<verona::interpreter::FrameObj*, long unsigned int> /home/mjp41/frankenscript/src/rt/core/builtin.cc:202
    #4 0x555555600899 in __invoke_impl<rt::objects::DynObject*, rt::core::ctor_builtins()::<lambda(auto:39, auto:40)>&, verona::interpreter::FrameObj*, long unsigned int> /usr/include/c++/11/bits/invoke.h:61
    #5 0x5555555fdcca in __invoke_r<std::optional<rt::objects::DynObject*>, rt::core::ctor_builtins()::<lambda(auto:39, auto:40)>&, verona::interpreter::FrameObj*, long unsigned int> /usr/include/c++/11/bits/invoke.h:114
    #6 0x5555555fa001 in _M_invoke /usr/include/c++/11/bits/std_function.h:290
    #7 0x5555557ae333 in std::function<std::optional<rt::objects::DynObject*> (verona::interpreter::FrameObj*, unsigned long)>::operator()(verona::interpreter::FrameObj*, unsigned long) const /usr/include/c++/11/bits/std_function.h:590
    #8 0x5555557ab2de in verona::interpreter::Interpreter::run_stmt(trieste::intrusive_ptr<trieste::NodeDef>&) /home/mjp41/frankenscript/src/lang/interpreter.cc:386
    #9 0x5555557ac67f in verona::interpreter::Interpreter::run(trieste::intrusive_ptr<trieste::NodeDef>) /home/mjp41/frankenscript/src/lang/interpreter.cc:443
    #10 0x5555557a2518 in verona::interpreter::start(trieste::intrusive_ptr<trieste::NodeDef>, int) /home/mjp41/frankenscript/src/lang/interpreter.cc:518
    #11 0x5555556042f9 in load_trieste(int, char**) /home/mjp41/frankenscript/src/lang/lang.cc:58
    #12 0x5555558ab724 in main /home/mjp41/frankenscript/src/main.cc:9
    #13 0x7ffff7089d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

SUMMARY: AddressSanitizer: heap-use-after-free /home/mjp41/frankenscript/src/rt/objects/region.h:75 in rt::objects::Region::dec_lrc(rt::objects::Region*)
Shadow bytes around the buggy address:
  0x0c107fff9290: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff92a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff92b0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff92c0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff92d0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c107fff92e0: fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd fd fa
  0x0c107fff92f0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff9300: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff9310: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff9320: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff9330: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==10830==ABORTING
(lldb) AddressSanitizer report breakpoint hit. Use 'thread info -s' to get extended information about the report.
Process 10830 stopped
* thread #1, name = 'frankenscript', stop reason = Use of deallocated memory
    frame #0: 0x00007ffff76859d0 libasan.so.6`__asan::(anonymous)() at asan_rtl.cpp:42:23
(lldb) bt
* thread #1, name = 'frankenscript', stop reason = Use of deallocated memory
  * frame #0: 0x00007ffff76859d0 libasan.so.6`__asan::(anonymous)() at asan_rtl.cpp:42:23
    frame #1: 0x00007ffff76a62ae libasan.so.6`__sanitizer::Die() at sanitizer_termination.cpp:55:30
    frame #2: 0x00007ffff768577c libasan.so.6`__asan::ScopedInErrorReport::~ScopedInErrorReport(this=0x00007fffffff8186) at asan_report.cpp:190:10
    frame #3: 0x00007ffff7685015 libasan.so.6`__asan::ReportGenericError(pc=93824992723485, bp=140737488326144, sp=140737488326128, addr=106102872119072, is_write=false, access_size=8, exp=0, fatal=true) at asan_report.cpp:478:1
    frame #4: 0x00007ffff7685e5b libasan.so.6`__asan::__asan_report_load8(addr=<unavailable>) at asan_rtl.cpp:121:1
    frame #5: 0x00005555555cc21d frankenscript`rt::objects::Region::dec_lrc(r=0x0000608000009720) at region.h:75:7
    frame #6: 0x00005555555c5f01 frankenscript`rt::objects::remove_region_reference(src=0x0000608000009420, target=0x0000608000009720) at region.cc:134:22
    frame #7: 0x00005555555c72ab frankenscript`rt::objects::move_reference(src=0x00006080000094a0, dst=0x000060700000a890, target=0x0000607000009f60) at region.cc:262:28
    frame #8: 0x000055555559a2f5 frankenscript`rt::move_reference(src=0x00006080000094a0, dst=0x000060700000a890, target=0x0000607000009f60) at rt.cc:188:28
    frame #9: 0x00005555557a9d3d frankenscript`verona::interpreter::Interpreter::run_stmt(this=0x00007fffffff9f30, node=0x0000614000003f70) at interpreter.cc:273:27
    frame #10: 0x00005555557ac680 frankenscript`verona::interpreter::Interpreter::run(this=0x00007fffffff9f30, main=trieste::Node @ 0x00007fffffff9f10) at interpreter.cc:443:48
    frame #11: 0x00005555557a2519 frankenscript`verona::interpreter::start(main_body=trieste::Node @ 0x00007fffffffa040, step_counter=2147483647) at interpreter.cc:518:14
    frame #12: 0x00005555556042fa frankenscript`load_trieste(argc=3, argv=0x00007fffffffdd88) at lang.cc:58:31
    frame #13: 0x00005555558ab725 frankenscript`main(argc=3, argv=0x00007fffffffdd88) at main.cc:9:22
    frame #14: 0x00007ffff7089d90 libc.so.6`___lldb_unnamed_symbol3139 + 128
    frame #15: 0x00007ffff7089e40 libc.so.6`__libc_start_main + 128
    frame #16: 0x0000555555598815 frankenscript`_start + 37

[xFrednet]

When I ran this, it looks like this error originates by something in the code that print the error message "Cycle detected in local region"