>
I presume you are getting closer to the mysterious segfault?
Yes.
I have identified what I believe to be the root cause of the crashes I am seeing on your loader (dated from last week - I don't want to lose my test case).
It's a quite interesting bug. In GPSEE, you can attach finalizers to FFI'd C functions, with a sort of C Function closure. (BTW - this is a feature completely unique to GPSEE AFAIK.) This closure contains the arguments to pass to the C function, and a reference to a piece of memory which is tied to the JS CFunction instance representing the function which gets run upon finalization. You can think of this as ... a sort of JS weak reference which is implemented in C.
And this is the crux of the issue - it's a weak reference which we are treating a strong reference. This is normally not a problem, as CFunction instances are normally declared as globals, and finalization of active FFI return value objects happens long before the program terminates.
The PINF loader *really* churns the garbage collector around FFI'd functions, in particular, the ones related to opening and closing fs-base Streams. When GSR shuts down the JS engine, we release the global object and trigger a GC. This in turn triggers Stream finalization, which uses the C function closures, which use the weak references to the CFunction instances.
But JS GC is unordered, like Java and unlike Cedar. This means that even if there is a defined relationship in the object graph between two objects, they can be collected in arbitrary order when neither is reachable from any GC root.
So, in some cases during GSR shutdown, we collect the CFunction instance, free() the memory it was occupying, and then try to use that same memory when finalizing an fs-base Stream instance (or other FFI return object with a finalizer). This memory may now have been overwritten by other operations, resulting in garbage. When we use pointers stored here, they then point to random addresses; hence the segmentation violation.
The fix is to let the garbage collector know about this C-side relationship, making it a strong reference that just happens to be invisible from JS-land, and then to finalize any pending-finalization FFI objects before dropping the global object's GC root and shutting down the JS runtime.
That fix is underway now.
Incidentally - thank you VERY MUCH for both the test case and the bug
report. This has been a long, arduous hunt but it helps everybody in
the long run.
Wes
--
Wesley W. Garland
Director, Product Development
PageMail, Inc.
+1 613 542 2787 x 102