ASAN complains

gistfile1.txt

ok 6 - Code in thread ran
=================================================================
==22506== ERROR: AddressSanitizer: heap-use-after-free on address 0x99605a94 at pc 0xb55b7f84 bp 0xb1877828 sp 0xb187781c
READ of size 4 at 0x99605a94 thread T1
ok 7 - Thread was finished
    #0 0xb55b7f83 in bind_pos /home/dogbert/repos/rakudo/nqp/MoarVM/src/6model/reprs/VMArray.c:387
    #1 0xb559fbd0 in MVM_repr_bind_pos_o /home/dogbert/repos/rakudo/nqp/MoarVM/src/6model/reprconv.c:232
    #2 0xb574c12d in MVM_spesh_stats_cleanup /home/dogbert/repos/rakudo/nqp/MoarVM/src/spesh/stats.c:645
    #3 0xb5743d0d in worker /home/dogbert/repos/rakudo/nqp/MoarVM/src/spesh/worker.c:13
    #4 0xb55cf068 in invoke_handler /home/dogbert/repos/rakudo/nqp/MoarVM/src/6model/reprs/MVMCFunction.c:9
    #5 0xb54d0a7a in thread_initial_invoke /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:59
    #6 0xb53ff0cb in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:93
    #7 0xb54d0d6d in start_thread /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:85
    #8 0xb61b69c6 (/usr/lib/i386-linux-gnu/libasan.so.0+0x1a9c6)
    #9 0xb61a62ac (/usr/lib/i386-linux-gnu/libasan.so.0+0xa2ac)
    #10 0xb5078f71 in start_thread (/lib/i386-linux-gnu/libpthread.so.0+0x6f71)
    #11 0xb517c3ed (/lib/i386-linux-gnu/libc.so.6+0xee3ed)
0x99605a94 is located 20 bytes inside of 488-byte region [0x99605a80,0x99605c68)
freed by thread T0 here:
    #0 0xb61b2774 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16774)
    #1 0xb54952f3 in MVM_free /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/alloc.h:40
    #2 0xb5495fae in MVM_tc_destroy /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threadcontext.c:113
    #3 0xb552805c in finish_gc /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/orchestrate.c:210
    #4 0xb5528c96 in run_gc /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/orchestrate.c:373
    #5 0xb5529907 in MVM_gc_enter_from_allocator /home/dogbert/repos/rakudo/nqp/MoarVM/src/gc/orchestrate.c:486
    #6 0xb54d1808 in try_join /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:188
    #7 0xb54d1946 in MVM_thread_join /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:194
    #8 0xb545bef0 in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:3740
    #9 0xb57ecd4d in MVM_vm_run_file /home/dogbert/repos/rakudo/nqp/MoarVM/src/moar.c:401
    #10 0x80494f8 in main /home/dogbert/repos/rakudo/nqp/MoarVM/src/main.c:256
    #11 0xb50a7af2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
previously allocated by thread T0 here:
    #0 0xb61b2905 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16905)
    #1 0xb54952ad in MVM_calloc /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/alloc.h:11
    #2 0xb5495321 in MVM_tc_create /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threadcontext.c:8
    #3 0xb54d072d in MVM_thread_new /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/threads.c:29
    #4 0xb545bd49 in MVM_interp_run /home/dogbert/repos/rakudo/nqp/MoarVM/src/core/interp.c:3735
    #5 0xb57ecd4d in MVM_vm_run_file /home/dogbert/repos/rakudo/nqp/MoarVM/src/moar.c:401
    #6 0x80494f8 in main /home/dogbert/repos/rakudo/nqp/MoarVM/src/main.c:256
    #7 0xb50a7af2 (/lib/i386-linux-gnu/libc.so.6+0x19af2)
Thread T1 created by T0 here:
    #0 0xb61a61d0 (/usr/lib/i386-linux-gnu/libasan.so.0+0xa1d0)
    #1 0xb580b980 in uv_thread_create /home/dogbert/repos/rakudo/nqp/MoarVM/3rdparty/libuv/src/unix/thread.c:198
SUMMARY: AddressSanitizer: heap-use-after-free /home/dogbert/repos/rakudo/nqp/MoarVM/src/6model/reprs/VMArray.c:387 bind_pos
Shadow bytes around the buggy address:
  0x332c0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x332c0b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x332c0b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x332c0b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
  0x332c0b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x332c0b50: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x332c0b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x332c0b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x332c0b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x332c0b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x332c0ba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==22506== ABORTING