ghc double free or corruption

[dmbarbour]

I'm receiving some strange errors, when importing a dictionary file into Wikilon:

*** Error in `wikilon': double free or corruption (out): 0x00007f59cc002b10 ***
Aborted (core dumped)

OR (rarely)

*** Error in `wikilon': corrupted double-linked list: 0x00007f8878018c90 ***
Aborted (core dumped)

Observations:

• This happens when I import an AO dictionary
• It can happen on the first try or later
• The problem exists for both the stackage-2.8 and stackage-2.12 builds.

Hypothesis:

The error happens due to interaction between GC and VCache. VCache uses weak pointers, which I'm not entirely inclined to trust.

[dmbarbour]

Testing ideas: I could try to disable use of the VCache cache and see if this helps. I might also test whether it happens for empty AO files, or if there is a specific kind of AO file that makes it more likely (e.g. due to deep names).

[dmbarbour]

Okay, so some basic tests demonstrate this can happen with a very simple file, containing just one word having a very large text. In my current dictionary model, definitions are stored with a ref to a lazy bytestring that encodes our ABC. So the VCache only sees a lazy bytestring. This makes me wonder whether there is an issue with large bytestrings.

Alternatively, the problem could be upstream of VCache, in Warp/WAI. I'll need to test further to isolate the issue.

[dmbarbour]

New error result!

*** Error in `wikilon': realloc(): invalid pointer: 0x00007feb5c00e310 ***
Aborted (core dumped)

[dmbarbour]

Yikes: VCache background thread has failed.
user error (VCache bug: time traveling allocator)

This suggests an LMDB-layer failure. Or a buffer overwrite somewhere.

[dmbarbour]

Okay, I've been able to narrow it down to:

    vc <- openVCache 100000 "db"
    let s = replicate 10000 'x'
    vref' vs $ deref' $ vref' vs s

This almost always crashes my GHCI with the "double free or corruption (out)" error. So it's a problem with VCache. I'll take the error over there.