This fills uninitialized memory with repeated patterns, so you get a crash if you try to (in this case) free an uninitialized pointer.
When I do this, some plugins crash in thread_detach_from_runtime → caml_free_signal_stack, apparently freeing the uninitialized th->signal_stack field.
The call trace goes through this function:
I believe what is happening in that close_wrapper function is that we are calling caml_c_thread_unregister on the “main thread” (not sure of the correct terminology) that is allocated by OCaml here:
The question is how I can “know” somehow that this is the main thread and so it shouldn’t be unregistered?
Or maybe caml_c_thread_unregister should be a no-op if called on the main thread?
Or maybe new_thread->signal_stack should be explicitly intialized to NULL rather than being left uninitialized on the main thread?
(gdb) bt
#0 __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1 0x00007ffff7d34793 in __pthread_kill_internal (threadid=<optimized out>,
signo=6) at pthread_kill.c:78
#2 0x00007ffff7cdbd0e in __GI_raise (sig=sig@entry=6)
at ../sysdeps/posix/raise.c:26
#3 0x00007ffff7cc3942 in __GI_abort () at abort.c:79
#4 0x00007ffff7cc47a7 in __libc_message_impl (
fmt=fmt@entry=0x7ffff7e760a0 "%s") at ../sysdeps/posix/libc_fatal.c:132
#5 0x00007ffff7d279c9 in __GI___libc_fatal (
message=message@entry=0x7ffff7fa4a71 "free(): invalid pointer")
at ../sysdeps/posix/libc_fatal.c:141
#6 0x00007ffff7f9dc66 in malloc_printerr (
str=0x7ffff7fa4a71 "free(): invalid pointer")
at /usr/src/debug/glibc-2.40-3.fc41.x86_64/malloc/malloc.c:5774
#7 free_check (mem=mem@entry=0xd5d5d5d5d5d5d5d5)
at /usr/src/debug/glibc-2.40-3.fc41.x86_64/malloc/malloc-check.c:228
#8 0x00007ffff7fa0111 in free_check (mem=0xd5d5d5d5d5d5d5d5)
at /usr/src/debug/glibc-2.40-3.fc41.x86_64/malloc/malloc-check.c:215
#9 __debug_free (mem=0xd5d5d5d5d5d5d5d5) at malloc-debug.c:208
#10 0x000000000044fc85 in thread_detach_from_runtime ()
#11 0x000000000045004a in caml_c_thread_unregister ()
#12 0x00000000004020d0 in main (argc=1, argv=0x7fffffffe0d8) at test.c:10