--gc:arc SIGSEGV (double free?)

[napalu]

The following code provokes a SIGSEV when compiled with --gc:arc

Example test_arc.nim

import streams

var m = newStringStream("Hello world")
let buffer = m.readStr(5)
echo buffer
m.close

Current Output using nim c -d:debug --gc:arc -d:traceArc

[Allocated] 0x7fa600b6a048
[Freed] 0x7fa600b6a048
Hello
[Freed] 0x7fa600b6a048
Traceback (most recent call last)
/data/Projects/nimdex/test_arc.nim(6) test_arc
/data/Projects/Nim/lib/pure/streams.nim(178) close
/data/Projects/Nim/lib/pure/streams.nim(1100) ssClose
/data/Projects/Nim/lib/system/refs_v2.nim(124) nimDestroyAndDispose
/data/Projects/Nim/lib/system/refs_v2.nim(101) nimRawDispose
/data/Projects/Nim/lib/system/alloc.nim(945) dealloc
/data/Projects/Nim/lib/system/alloc.nim(860) rawDealloc
/data/Projects/Nim/lib/system/avltree.nim(74) del
SIGSEGV: Illegal storage access. (Attempt to read from nil?)

$ nim -v
Nim Compiler Version 1.1.1 [Linux: amd64]
Compiled at 2020-01-12
Copyright (c) 2006-2019 by Andreas Rumpf

git hash: 01a89cc473c7b98a92c6c6f9c17d294829d3858d
active boot switches: -d:release

[napalu]

The following patch which adds a field to refs_v2.nim to mark calls to nimRawDispose confirms my initial suspicion: it's a double-free problem. Patching Nim devel with the attached file, the example test code compiled with nim c -d:debug --gc:arc -d:traceArc ./test_arc.nim will output:

[Allocated] 0x562cb03a82a0
[Freed] 0x562cb03a82a0
Hello
[WARN] attempt to double-free 0x562cb03a82b0
[WARN] attempt to double-free 0x562cb03a82b0

instead of dumping code. This issue is related to #13102, #13110 and #12957 which run fine (with double-free warnings) with the patch applied.

[Araq]

That's not how to fix this problem. :-)

[napalu]

That's not how to fix this problem. :-)

That's not a proposed solution - just a patch which illustrates the problem and allows the crashing code to trace and run while you and/or other contributors figure out how to fix it...

[napalu]

@Araq - good one - testing on my sources this solves #13119 and #13110. However #12957 still SIGSEGV's on second test [update 2019-01-14 16:20 GMT+1]: and #13102 is still not solved

import pegs
discard peg(r"{\ident}?")