Memory corruption in Pair

[andreasnoack]

On lastest master I get

julia> Pair{Union{Float64,Int},Int}(1,1)
Pair{Union{Float64, Int64},Int64}(1, 4696029064)

julia> Pair{Union{Void,Int},Int}(1,1)
Pair{Union{Void, Int64},Int64}(1, 4707506520)

julia> Pair{Union{Void,Int},Int}(nothing,1)

signal (11): Segmentation fault: 11
while loading no file, in expression starting on line 0
has_tight_type at ./show.jl:290
show at ./show.jl:301
show at ./replutil.jl:4
unknown function (ip: 0x111bd47f6)
display at ./repl/REPL.jl:125
unknown function (ip: 0x111bd4756)
display at ./repl/REPL.jl:128
unknown function (ip: 0x111bd4456)
display at ./multimedia.jl:277
inner at ./essentials.jl:605
jl_apply at /Users/andreasnoack/julia-dev/src/./julia.h:1447 [inlined]
jl_f__apply at /Users/andreasnoack/julia-dev/src/builtins.c:440
jl_f__apply_latest at /Users/andreasnoack/julia-dev/src/builtins.c:478
print_response at ./repl/REPL.jl:146
jlcall_print_response_20800 at /Users/andreasnoack/julia-dev/usr/lib/julia/sys.dylib (unknown line)
print_response at ./repl/REPL.jl:132
jlcall_print_response_20796 at /Users/andreasnoack/julia-dev/usr/lib/julia/sys.dylib (unknown line)
do_respond at ./repl/REPL.jl:658
unknown function (ip: 0x111bcf381)
do_call at /Users/andreasnoack/julia-dev/src/interpreter.c:70
eval at /Users/andreasnoack/julia-dev/src/interpreter.c:262
eval_body at /Users/andreasnoack/julia-dev/src/interpreter.c:539
jl_toplevel_eval_body at /Users/andreasnoack/julia-dev/src/interpreter.c:511
jl_toplevel_eval_flex at /Users/andreasnoack/julia-dev/src/toplevel.c:601
jl_toplevel_eval_in at /Users/andreasnoack/julia-dev/src/builtins.c:510
eval at ./repl/LineEdit.jl:3
run_interface at ./repl/LineEdit.jl:1646
run_frontend at ./repl/REPL.jl:961
run_repl at ./repl/REPL.jl:182
_start at ./client.jl:425
true_main at /Users/andreasnoack/julia-dev/./julia (unknown line)
main at /Users/andreasnoack/julia-dev/./julia (unknown line)
Allocations: 3286156 (Pool: 3285956; Big: 200); GC: 6
[1]    50893 segmentation fault  ./julia

It works on 0.6

[andreasnoack]

Looks like it was introduced by #22441

[quinnj]

Here's what I've tracked down so far:

• The failure is on assert(jl_is_datatype(dt)); in jl_new_bits_internal in datatype.c
• the dt arg should be Void, but is a corrupted value
• The type should be getting "selected" correctly from jl_get_nth_field from this line uint8_t sel = ((uint8_t*)v)[offs + jl_field_size(st, i) - 1];
  • the offs and fieldsize look like they're coming back correctly, but the actual byte stored looks corrupted
• I tried to start debugging where that byte gets set, which I think should be jl_set_nth_field, and we should hit jl_find_union_component, but my debugger never breakpoints on that function, so that seems like a problem. Is there another way the Pair could be getting constructed that wouldn't go through jl_set_nth_field?

[quinnj]

Update:

• Only affects immutables/struct, which would explain why I couldn't breakpoint anything in jl_set_nth_field