Debugging crashes on GC

["Alexander Gladysh" <agladysh@...>]

Hi, all!

MSVC 8, Lua 5.1.1 (compiled as C++ DLL, with some C++-exception-safety
patches from this list), Luabind latest CVS (sorry to post here
instead of Luabind list).

We're experiencing mysterious crashes on garbage collection in debug
build (*looks like* there are no such crushes in release). The state,
passed to lua_rawgeti (see below), seems to be invalid. Our code
actively uses coroutines.

Call stack and state dump are at the end of this post.

*ANY* hints on how to start debugging this issue are more than
welcome. I guess I would have to somehow find origin of that
0x024bc7e0 state. This seems to be some coroutine, as the main state
is 0x020e93e8, and we do not create any additional states from C++
code.

About modifications to Lua: we've experienced similar crashes on
unpatched 5.0.2 -- so I guess this problem is not related to them.

Thanks in advance,
Alexander.

--

First-chance exception at 0x1001f1f8 (liblua-d.dll) in GameTI-d.exe:
0xC0000005: Access violation reading location 0x0004ff58.

=== Lua state, passed to lua_rawgeti() ===

- L 0x024bc7e0 {next=0x00000000 tt=0 marked=0 ...} lua_State *
+ next 0x00000000 {gch={...} ts={...} u={...} ...} GCObject *
tt 0 unsigned char
marked 0 unsigned char
status 0 unsigned char
+ top 0x00000010 {value={...} tt=??? } lua_TValue *
+ base 0x00000001 {value={...} tt=??? } lua_TValue *
+ l_G 0x0004fef8 {strt={...} frealloc=??? ud=??? ...} global_State *
+ ci 0xfdfdfdfd {base=??? func=??? top=??? ...} CallInfo *
+ savedpc 0x02125ae8 const unsigned int *
+ stack_last 0xcdcdcdcd {value={...} tt=??? } lua_TValue *
+ stack 0x00000007 {value={...} tt=??? } lua_TValue *
+ end_ci 0xcdcdcdcd {base=??? func=??? top=??? ...} CallInfo *
+ base_ci 0xfdfdfdfd {base=??? func=??? top=??? ...} CallInfo *
stacksize -1414812757 int
size_ci -1414812757 int
nCcalls 65262 unsigned short
hookmask 238 'о' unsigned char
allowhook 254 'ю' unsigned char
basehookcount 0 int
hookcount 0 int
hook 0x000a0008 void (lua_State *, lua_Debug *)*
+ l_gt {value={...} tt=273762808 } lua_TValue
+ env {value={...} tt=327441 } lua_TValue
+ openupval 0x003e5e90 {gch={...} ts={...} u={...} ...} GCObject *
+ gclist 0xfdfdfdfd {gch={...} ts={...} u={...} ...} GCObject *
+ errorJmp 0xabababab {previous=??? b=??? status=??? } lua_longjmp *
errfunc -1414812757 int

=== Call stack ===

> liblua-d.dll!lua_rawgeti(lua_State * L=0x024bc7e0, int idx=-10000, int n=1)  Line 568 + 0x7 bytes C++
GameTI-d.exe!luabind::detail::unref(lua_State * L=0x024bc7e0, int
ref=456)  Line 169 + 0xf bytes C++
GameTI-d.exe!luabind::detail::lua_reference::reset()  Line 110 + 0x23 bytes C++
GameTI-d.exe!luabind::detail::lua_reference::~lua_reference()  Line 69
+ 0x2b bytes C++
GameTI-d.exe!luabind::detail::object_rep::~object_rep()  Line 54 + 0xf bytes C++
GameTI-d.exe!luabind::detail::object_rep::`scalar deleting
destructor'()  + 0x2b bytes C++
GameTI-d.exe!luabind::detail::object_rep::garbage_collector(lua_State
* L=0x03133660)  Line 108 C++
liblua-d.dll!luaD_precall(lua_State * L=0x03133660, lua_TValue *
func=0x0341a718, int nresults=0)  Line 374 + 0x16 bytes C++
liblua-d.dll!luaD_call(lua_State * L=0x03133660, lua_TValue *
func=0x0341a718, int nResults=0)  Line 431 + 0x11 bytes C++
liblua-d.dll!GCTM(lua_State * L=0x03133660)  Line 467 + 0x15 bytes C++
liblua-d.dll!singlestep(lua_State * L=0x03133660)  Line 594 + 0x9 bytes C++
liblua-d.dll!luaC_step(lua_State * L=0x03133660)  Line 617 + 0x9 bytes C++
liblua-d.dll!lua_gc(lua_State * L=0x03133660, int what=5, int data=0)
Line 929 + 0x9 bytes C++
liblua-d.dll!luaB_collectgarbage(lua_State * L=0x03133660)  Line 200 +
0x18 bytes C++
liblua-d.dll!luaD_precall(lua_State * L=0x03133660, lua_TValue *
func=0x0341a6f8, int nresults=0)  Line 374 + 0x16 bytes C++
liblua-d.dll!luaV_execute(lua_State * L=0x03133660, int nexeccalls=1)
Line 587 + 0x14 bytes C++
liblua-d.dll!resume(lua_State * L=0x03133660, void * ud=0x0341a708)
Line 459 + 0x1e bytes C++
liblua-d.dll!luaD_rawrunprotected(lua_State * L=0x03133660, void
(lua_State *, void *)* f=0x1002e540, void * ud=0x0341a708)  Line 127 +
0xd bytes C++
liblua-d.dll!lua_resume(lua_State * L=0x03133660, int nargs=1)  Line
483 + 0x1d bytes C++