Crash during calling os.exit()

[kevinhwang91]

lua -v output: Lua 5.4.4 Copyright (C) 1994-2022 Lua.org, PUC-Rio.

local uv = require('luv')

local function setTimeout(callback, ms)
    local timer = uv.new_timer()
    timer:start(ms, 0, function()
        timer:stop()
        timer:close()
        callback()
    end)
    return timer
end

setTimeout(function()
    os.exit(5, true)
end, 1000)

uv.run()

coredumpctl debug:

gdb bt
#0  luv_close_cb (handle=0x55c11a041190) at /home/kevin/WorkSpaces/lua/luv/src/handle.c:80
#1  0x00007f7bb506d809 in uv__finish_close (handle=0x55c11a041190) at /home/kevin/WorkSpaces/lua/luv/deps/libuv/src/unix/core.c:308
#2  uv__run_closing_handles (loop=0x55c11a0439c8) at /home/kevin/WorkSpaces/lua/luv/deps/libuv/src/unix/core.c:322
#3  uv_run (loop=loop@entry=0x55c11a0439c8, mode=mode@entry=UV_RUN_DEFAULT) at /home/kevin/WorkSpaces/lua/luv/deps/libuv/src/unix/core.c:401
#4  0x00007f7bb505cba2 in loop_gc (L=<optimized out>) at /home/kevin/WorkSpaces/lua/luv/src/luv.c:788
#5  0x000055c118105cf6 in precallC (f=<optimized out>, nresults=<optimized out>, func=<optimized out>, L=<optimized out>) at ldo.c:506
#6  luaD_precall (L=L@entry=0x55c11a0362a8, func=0x55c11a036a10, nresults=0) at ldo.c:572
#7  0x000055c1181060f7 in ccall (inc=65537, nResults=<optimized out>, func=<optimized out>, L=0x55c11a0362a8) at ldo.c:607
#8  luaD_callnoyield (L=0x55c11a0362a8, func=<optimized out>, nResults=<optimized out>) at ldo.c:627
#9  0x000055c118104f1a in luaD_rawrunprotected (L=L@entry=0x55c11a0362a8, f=f@entry=0x55c118107770 <dothecall>, ud=ud@entry=0x0) at ldo.c:144
#10 0x000055c118106470 in luaD_pcall (L=L@entry=0x55c11a0362a8, func=func@entry=0x55c118107770 <dothecall>, u=u@entry=0x0, old_top=272, ef=ef@entry=0) at ldo.c:926
#11 0x000055c118107736 in GCTM (L=L@entry=0x55c11a0362a8) at lgc.c:915
#12 0x000055c118109508 in callallpendingfinalizers (L=0x55c11a0362a8) at lgc.c:945
#13 luaC_freeallobjects (L=L@entry=0x55c11a0362a8) at lgc.c:1510
#14 0x000055c11810ec8f in close_state (L=0x55c11a0362a8) at lstate.c:276
#15 0x000055c11810f420 in lua_close (L=<optimized out>) at lstate.c:414
#16 0x000055c118122778 in os_exit (L=0x55c11a0362a8) at loslib.c:401
#17 0x000055c118105cf6 in precallC (f=<optimized out>, nresults=<optimized out>, func=<optimized out>, L=<optimized out>) at ldo.c:506
#18 luaD_precall (L=L@entry=0x55c11a0362a8, func=0x55c11a0369e0, nresults=0) at ldo.c:572
#19 0x000055c118113e57 in luaV_execute (L=L@entry=0x55c11a0362a8, ci=<optimized out>) at lvm.c:1680
#20 0x000055c118106110 in ccall (inc=65537, nResults=<optimized out>, func=<optimized out>, L=0x55c11a0362a8) at ldo.c:609
#21 luaD_callnoyield (L=0x55c11a0362a8, func=<optimized out>, nResults=<optimized out>) at ldo.c:627
#22 0x000055c118104f1a in luaD_rawrunprotected (L=L@entry=0x55c11a0362a8, f=f@entry=0x55c1181008f0 <f_call>, ud=ud@entry=0x7ffc23225130) at ldo.c:144
#23 0x000055c118106470 in luaD_pcall (L=L@entry=0x55c11a0362a8, func=func@entry=0x55c1181008f0 <f_call>, u=u@entry=0x7ffc23225130, old_top=192, ef=<optimized out>) at ldo.c:926
#24 0x000055c118102c4c in lua_pcallk (L=L@entry=0x55c11a0362a8, nargs=nargs@entry=0, nresults=nresults@entry=0, errfunc=errfunc@entry=1, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:1067
#25 0x00007f7bb505266e in luv_cfpcall (L=0x55c11a0362a8, nargs=0, nresult=0, flags=0) at /home/kevin/WorkSpaces/lua/luv/src/luv.c:671
#26 0x00007f7bb5069dee in uv__run_timers (loop=loop@entry=0x55c11a0439c8) at /home/kevin/WorkSpaces/lua/luv/deps/libuv/src/timer.c:178
#27 0x00007f7bb506d6ae in uv_run (loop=0x55c11a0439c8, mode=mode@entry=UV_RUN_DEFAULT) at /home/kevin/WorkSpaces/lua/luv/deps/libuv/src/unix/core.c:382
#28 0x00007f7bb5065acc in luv_run (L=0x55c11a0362a8) at /home/kevin/WorkSpaces/lua/luv/src/loop.c:36
#29 0x000055c118105cf6 in precallC (f=<optimized out>, nresults=<optimized out>, func=<optimized out>, L=<optimized out>) at ldo.c:506
#30 luaD_precall (L=L@entry=0x55c11a0362a8, func=0x55c11a0369a0, nresults=0) at ldo.c:572
#31 0x000055c118113e57 in luaV_execute (L=L@entry=0x55c11a0362a8, ci=<optimized out>) at lvm.c:1680
#32 0x000055c118106110 in ccall (inc=65537, nResults=<optimized out>, func=<optimized out>, L=0x55c11a0362a8) at ldo.c:609
#33 luaD_callnoyield (L=0x55c11a0362a8, func=<optimized out>, nResults=<optimized out>) at ldo.c:627
#34 0x000055c118104f1a in luaD_rawrunprotected (L=L@entry=0x55c11a0362a8, f=f@entry=0x55c1181008f0 <f_call>, ud=ud@entry=0x7ffc232254e0) at ldo.c:144
#35 0x000055c118106470 in luaD_pcall (L=L@entry=0x55c11a0362a8, func=func@entry=0x55c1181008f0 <f_call>, u=u@entry=0x7ffc232254e0, old_top=80, ef=<optimized out>) at ldo.c:926
#36 0x000055c118102c4c in lua_pcallk (L=L@entry=0x55c11a0362a8, nargs=nargs@entry=0, nresults=nresults@entry=-1, errfunc=errfunc@entry=3, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:1067
#37 0x000055c1180ffb06 in docall (L=L@entry=0x55c11a0362a8, narg=narg@entry=0, nres=nres@entry=-1) at lua.c:160
#38 0x000055c1181005b2 in handle_script (argv=<optimized out>, L=0x55c11a0362a8) at lua.c:256
#39 pmain (L=0x55c11a0362a8) at lua.c:644
#40 0x000055c118105cf6 in precallC (f=<optimized out>, nresults=<optimized out>, func=<optimized out>, L=<optimized out>) at ldo.c:506
#41 luaD_precall (L=L@entry=0x55c11a0362a8, func=0x55c11a036910, nresults=1) at ldo.c:572
#42 0x000055c1181060f7 in ccall (inc=65537, nResults=<optimized out>, func=<optimized out>, L=0x55c11a0362a8) at ldo.c:607
#43 luaD_callnoyield (L=0x55c11a0362a8, func=<optimized out>, nResults=<optimized out>) at ldo.c:627
#44 0x000055c118104f1a in luaD_rawrunprotected (L=L@entry=0x55c11a0362a8, f=f@entry=0x55c1181008f0 <f_call>, ud=ud@entry=0x7ffc23225830) at ldo.c:144
#45 0x000055c118106470 in luaD_pcall (L=L@entry=0x55c11a0362a8, func=func@entry=0x55c1181008f0 <f_call>, u=u@entry=0x7ffc23225830, old_top=16, ef=<optimized out>) at ldo.c:926
#46 0x000055c118102c4c in lua_pcallk (L=L@entry=0x55c11a0362a8, nargs=nargs@entry=2, nresults=nresults@entry=1, errfunc=errfunc@entry=0, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:1067
#47 0x000055c1180ff64b in main (argc=2, argv=0x7ffc23225988) at lua.c:671
gdb p data
$2 = (luv_handle_t *) 0x55c11a041
gdb p data->ctx
Cannot access memory at address 0x55c11a051
gdb

[kevinhwang91]

Look like data stored in LUA_REGISTRYINDEX have been free after on_exit and before loop_gc.

[squeek502]

Seems related to #437