bug#25387: guile-2.2 multi-thread segfault in SCM_VALIDATE_WEAK_TABLE

[Linas Vepstas]

Following program crashes immediately (fraction of a second)
in guile-2.2, current git version (as of 29 Dec 2016
a0656ad4cf976b3845e9b9663a90b46b4cf9fc5a )

It runs fine in guile-2.0. Its doing something slightly squonky:
referencing the variable 'cnt' in a thread.  Note definition of
use before definition of variable

Its deterministic - always crashes in the same place.

(define junk 0)
(define halt #f)

(define (wtf-thr)
   (define start (- (current-time) 0.1))

   ; Create thread that does junk and exits.  Yes, the increment
   ; of `junk` is not protected, and its racey, but so what.
   (define (mkthr v) (call-with-new-thread (lambda ()
      (if (eq? 0 (modulo cnt 30)) (gc))   ;;;; <<<<  crashes here!!!
(set! junk (+ junk 1)))))

   ; thread arguments
   (define thrarg (make-list 10 0))

   (define cnt 0)
   (define (mke)
      ; Create a limited number of threads
      (define thr-list (map mkthr thrarg))
      ; (display (length (all-threads)))
      (map join-thread thr-list)

      ; Some handy debug printing.
      (set! cnt (+ cnt 1))
      (if (eq? 0 (modulo cnt 500))
         (begin
            (display "rate=")
            (display (/ cnt (- (current-time) start))) (newline)
(display "cnt=") (display cnt) (newline)
(display (gc-stats)) (newline) (newline)
         )))

   ; tail recursive infinite loop.
   (define (aloop) (mke) (if (not halt) (aloop)))

   ; while forever.
   (aloop)
)

; Run elsewhere, so that we have a shell prompt
; (not required for the bug)
(call-with-new-thread wtf-thr)

; halt if desired.
; (set! halt #t)


Thread 621 "guile" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffedbe1700 (LWP 10504)]
0x00007ffff7b78af1 in scm_c_weak_table_ref (table=0x0,
    raw_hash=2738445758486295669, pred=0x7ffff7b77bb0 <assq_predicate>,
    closure=0x5555558fff00, dflt=0x904) at ../../libguile/weak-table.c:862
warning: Source file is more recent than executable.
862  SCM_VALIDATE_WEAK_TABLE (1, table);
(gdb) bt
#0  0x00007ffff7b78af1 in scm_c_weak_table_ref (table=0x0,
    raw_hash=2738445758486295669, pred=0x7ffff7b77bb0 <assq_predicate>,
    closure=0x5555558fff00, dflt=0x904) at ../../libguile/weak-table.c:862
#1  0x00007ffff7b02fa4 in fluid_ref (dynamic_state=0x555555f8ce60,
    fluid=0x5555558fff00) at ../../libguile/fluids.c:287
#2  0x00007ffff7b0325f in scm_fluid_ref (fluid=0x5555558fff00)
    at ../../libguile/fluids.c:308
#3  0x00007ffff7b34424 in scm_i_default_port_conversion_strategy ()
    at ../../libguile/ports.c:1015
#4  0x00007ffff7b5e4df in scm_i_default_string_failed_conversion_handler ()
    at ../../libguile/strings.c:1619
#5  scm_from_locale_stringn (
    str=0x7ffff7b88d50 "Wrong type argument in position ~A: ~S",
    address@hidden) at ../../libguile/strings.c:1626
#6  0x00007ffff7b5e51c in scm_from_locale_string (str=<optimized out>)
    at ../../libguile/strings.c:1613
#7  0x00007ffff7af76c6 in scm_error (key=0x5555558fa960,
    address@hidden <s_scm_set_current_dynamic_state>
"set-current-dynamic-state", message=<optimized out>,
args=0x555555c6ce30,
    address@hidden) at ../../libguile/error.c:59
#8  0x00007ffff7af7968 in scm_wrong_type_arg (
    address@hidden <s_scm_set_current_dynamic_state>
"set-current-dynamic-state", address@hidden,
address@hidden)
---Type <return> to continue, or q <return> to quit---
    at ../../libguile/error.c:251
#9  0x00007ffff7b03096 in scm_set_current_dynamic_state (
    address@hidden) at ../../libguile/fluids.c:496
#10 0x00007ffff7b6351a in guilify_self_2 (
    address@hidden)
    at ../../libguile/threads.c:466
#11 0x00007ffff7b63e0c in scm_i_init_thread_for_guile (base=0x7fffedbe0ec0,
    dynamic_state=0x555555c6c3b0) at ../../libguile/threads.c:595
#12 0x00007ffff7b63e59 in with_guile (address@hidden,
    address@hidden) at ../../libguile/threads.c:638
#13 0x00007ffff6c71812 in GC_call_with_stack_base (
    address@hidden <with_guile>, address@hidden)
    at misc.c:1925
#14 0x00007ffff7b635cc in scm_i_with_guile (dynamic_state=<optimized out>,
    data=0x555555c6c410, func=0x7ffff7b635e0 <really_launch>)
    at ../../libguile/threads.c:688
#15 launch_thread (d=0x555555c6c410) at ../../libguile/threads.c:750
#16 0x00007ffff735f464 in start_thread (arg=0x7fffedbe1700)
    at pthread_create.c:333
#17 0x00007ffff70a29df in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:105