Re: PATCH fix heisenbug in cp/spew.c

[Richard Earnshaw <rearnsha at arm dot com>]

> > 3) When checking is enabled can we make the tree marking code check 
> > (cheaply) that memory it is marking is not marked as unallocated -- I 
> > don't know if it would have found this bug, but it might have caused a 
> > diagnostic fault to have triggered more often than the above conditions 
> > would have occurred.
> 
> That seems to be tricky, because we don't save the old use counts of
> the page.

The 'use' bits are also used by the allocator to indicate which bits in a 
page have already been allocated, so all we have to do is copy the bits 
into a separate field (which need not be present if we aren't doing the 
checks) before we clear them at the start of a GC pass.  Then when we mark 
a bit we can also check the old bits to see if it was previously allocated 
and abort if not.  I'll see if I can knock up a patch to do this -- I 
doubt if the cost would be noticeable.

> 
> This is supposed to be dealt with by having the freeing code set all
> free memory to a bit pattern that should cause a crash.  I wonder why
> that didn't find this bug earlier?

No, that fails to catch this case because toks[n].yychar has also been 
poisoned, and no-longer matches any of NSNAME, PTYPENAME_DEFN, 
TYPENAME_DEFN, IDENTIFIER_DEFN etc, hence we go through all of the if 
statements and fail to match.

R.