"bpart: Start tracking backedges for bindings" introduced UB into our CI

[vtjnash]

As mentioned in the comment during PR review, this PR is causing CI crashes due to the introduction of UB / memory corruption here: #57213 (review)

Internal error: during type inference of
2025-02-17 18:10:36 EST	var"#create_tasks##3"()
2025-02-17 18:10:36 EST	Encountered unexpected error in runtime:
2025-02-17 18:10:36 EST	UndefRefError()
2025-02-17 18:10:36 EST	getindex at ./essentials.jl:918 [inlined]
2025-02-17 18:10:36 EST	maybe_add_binding_backedge! at ./invalidation.jl:173
2025-02-17 18:10:36 EST	store_backedges at ./../usr/share/julia/Compiler/src/typeinfer.jl:561
2025-02-17 18:10:36 EST	codeinst_as_edge at ./../usr/share/julia/Compiler/src/typeinfer.jl:839
2025-02-17 18:10:36 EST	const_prop_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:1370
2025-02-17 18:10:36 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:911
2025-02-17 18:10:36 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:881 [inlined]
2025-02-17 18:10:36 EST	handle1 at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:178
2025-02-17 18:10:36 EST	infercalls at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:252
2025-02-17 18:10:36 EST	abstract_call_gf_by_type at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:345
2025-02-17 18:10:36 EST	abstract_call_known at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2769
2025-02-17 18:10:36 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2876
2025-02-17 18:10:36 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2869 [inlined]
2025-02-17 18:10:36 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3029
2025-02-17 18:10:36 EST	abstract_eval_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3047 [inlined]
2025-02-17 18:10:36 EST	abstract_eval_statement_expr at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3354
2025-02-17 18:10:36 EST	typeinf_local at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4106
2025-02-17 18:10:36 EST	jfptr_typeinf_local_126997 at /cache/build/tester-amdci5-9/julialang/julia-master/julia-7c89aba267/lib/julia/sys.so (unknown line)
2025-02-17 18:10:36 EST	_jl_invoke at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3456 [inlined]
2025-02-17 18:10:36 EST	ijl_apply_generic at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3675
2025-02-17 18:10:36 EST	typeinf at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4298
2025-02-17 18:10:36 EST	const_prop_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:1361
2025-02-17 18:10:36 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:911
2025-02-17 18:10:36 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:881 [inlined]
2025-02-17 18:10:36 EST	handle1 at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:178
2025-02-17 18:10:36 EST	infercalls at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:252
2025-02-17 18:10:36 EST	abstract_call_gf_by_type at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:345
2025-02-17 18:10:36 EST	abstract_call_known at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2769
2025-02-17 18:10:36 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2876
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2869 [inlined]
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3029
2025-02-17 18:10:37 EST	abstract_eval_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3047 [inlined]
2025-02-17 18:10:37 EST	abstract_eval_statement_expr at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3354
2025-02-17 18:10:37 EST	typeinf_local at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4106
2025-02-17 18:10:37 EST	jfptr_typeinf_local_126997 at /cache/build/tester-amdci5-9/julialang/julia-master/julia-7c89aba267/lib/julia/sys.so (unknown line)
2025-02-17 18:10:37 EST	_jl_invoke at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3456 [inlined]
2025-02-17 18:10:37 EST	ijl_apply_generic at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3675
2025-02-17 18:10:37 EST	typeinf at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4298
2025-02-17 18:10:37 EST	const_prop_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:1361
2025-02-17 18:10:37 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:911
2025-02-17 18:10:37 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:881 [inlined]
2025-02-17 18:10:37 EST	handle1 at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:178
2025-02-17 18:10:37 EST	infercalls at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:252
2025-02-17 18:10:37 EST	abstract_call_gf_by_type at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:345
2025-02-17 18:10:37 EST	abstract_call_known at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2769
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2876
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2869 [inlined]
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3029
2025-02-17 18:10:37 EST	abstract_eval_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3047 [inlined]
2025-02-17 18:10:37 EST	abstract_eval_statement_expr at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3354
2025-02-17 18:10:37 EST	typeinf_local at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4106
2025-02-17 18:10:37 EST	jfptr_typeinf_local_126997 at /cache/build/tester-amdci5-9/julialang/julia-master/julia-7c89aba267/lib/julia/sys.so (unknown line)
2025-02-17 18:10:37 EST	_jl_invoke at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3456 [inlined]
2025-02-17 18:10:37 EST	ijl_apply_generic at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3675
2025-02-17 18:10:37 EST	typeinf at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4298
2025-02-17 18:10:37 EST	const_prop_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:1361
2025-02-17 18:10:37 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:911
2025-02-17 18:10:37 EST	abstract_call_method_with_const_args at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:881 [inlined]
2025-02-17 18:10:37 EST	handle1 at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:178
2025-02-17 18:10:37 EST	infercalls at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:252
2025-02-17 18:10:37 EST	abstract_call_gf_by_type at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:345
2025-02-17 18:10:37 EST	abstract_call_known at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2769
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2876
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:2869 [inlined]
2025-02-17 18:10:37 EST	abstract_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3029
2025-02-17 18:10:37 EST	abstract_eval_call at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3047 [inlined]
2025-02-17 18:10:37 EST	abstract_eval_statement_expr at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:3354
2025-02-17 18:10:37 EST	typeinf_local at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4106
2025-02-17 18:10:37 EST	jfptr_typeinf_local_126997 at /cache/build/tester-amdci5-9/julialang/julia-master/julia-7c89aba267/lib/julia/sys.so (unknown line)
2025-02-17 18:10:37 EST	_jl_invoke at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3456 [inlined]
2025-02-17 18:10:37 EST	ijl_apply_generic at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3675
2025-02-17 18:10:37 EST	typeinf at ./../usr/share/julia/Compiler/src/abstractinterpretation.jl:4298
2025-02-17 18:10:37 EST	typeinf_ext at ./../usr/share/julia/Compiler/src/typeinfer.jl:1166
2025-02-17 18:10:37 EST	typeinf_ext_toplevel at ./../usr/share/julia/Compiler/src/typeinfer.jl:1240
2025-02-17 18:10:37 EST	jfptr_typeinf_ext_toplevel_126802 at /cache/build/tester-amdci5-9/julialang/julia-master/julia-7c89aba267/lib/julia/sys.so (unknown line)
2025-02-17 18:10:37 EST	_jl_invoke at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3456 [inlined]
2025-02-17 18:10:37 EST	ijl_apply_generic at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3675
2025-02-17 18:10:37 EST	jl_apply at /cache/build/tester-amdci4-10/julialang/julia-master/src/julia.h:2303 [inlined]
2025-02-17 18:10:37 EST	jl_type_infer at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:453
2025-02-17 18:10:37 EST	jl_compile_method_internal at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:2972
2025-02-17 18:10:37 EST	_jl_invoke at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3467 [inlined]
2025-02-17 18:10:37 EST	ijl_apply_generic at /cache/build/tester-amdci4-10/julialang/julia-master/src/gf.c:3675
2025-02-17 18:10:37 EST	jl_apply at /cache/build/tester-amdci4-10/julialang/julia-master/src/julia.h:2303 [inlined]
2025-02-17 18:10:37 EST	start_task at /cache/build/tester-amdci4-10/julialang/julia-master/src/task.c:1249

https://buildkite.com/julialang/julia-master/builds/44900#019515d0-adde-4706-837c-2590e6b36c8b

[nsajko]

More examples:

• https://buildkite.com/julialang/julia-master/builds/45511#0195679a-de1e-4565-9590-8f8e8a331c15/893-1405
• https://buildkite.com/julialang/julia-master/builds/45540#01956c65-6f53-438d-85ad-8c566885681e/890-1409

[xal-0]

I've got ThreadSanitizer working again in order to investigate this issue (PR
incoming, after I can disentangle it from all the related work). Just for an
update, here are a few of the identified issues.

Data race on jl_binding_t.backedges

We need to take a lock in both jl_add_binding_backedge and in
Base.invalidate_code_for_globalref!, but doing so from Julia code is a little
tricky.

module M
    const x = 0 
end
t = Threads.@spawn for i=1:100
    @eval M const x = $i
end
for i=1:100
    s = Symbol("f$i")
    @eval ($s() = M.x; $s())
end
wait(t)

$ ./usr/bin/julia -t4,0 --gcthreads=1 test.jl
==================
WARNING: ThreadSanitizer: data race (pid=3644)
  Write of size 8 at 0xffff9e714960 by main thread:
    #0 ijl_array_grow_end /home/user/c/julia/src/array.c (libjulia-internal.so.1.13+0x9f5f4)
    #1 ijl_array_ptr_1d_push /home/user/c/julia/src/array.c:260:5 (libjulia-internal.so.1.13+0x9f8b0)
    #2 jl_add_binding_backedge /home/user/c/julia/src/module.c:1634:5 (libjulia-internal.so.1.13+0x8e2e4)
    #3 jl_maybe_add_binding_backedge /home/user/c/julia/src/module.c:1654:5 (libjulia-internal.so.1.13+0x90cf0)
    #4 maybe_add_binding_backedge! invalidation.jl:175 (sys.so+0x74ce8c)
    #5 julia_store_backedges_11269 ../usr/share/julia/Compiler/src/typeinfer.jl:768 (sys.so+0x74ce8c)
    #6 julia_codeinst_as_edge_11265 ../usr/share/julia/Compiler/src/typeinfer.jl:1029 (sys.so+0x10ee660)
    #7 julia_const_prop_call_80069 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:1359 (sys.so+0xe2bb5c)
    #8 julia_abstract_call_method_with_const_args_80196 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:898 (sys.so+0x4b5160)
    #9 julia_abstract_call_method_with_const_args_80193 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:868 (sys.so+0x4b07f4)
    #10 julia_handle1_80177 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:178 (sys.so+0x4bbbe0)
    #11 julia_infercalls_80302 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:252 (sys.so+0x3f999c)
    #12 julia_abstract_call_gf_by_type_80290 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:338 (sys.so+0xdb83c0)
    #13 julia_abstract_call_known_80243 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:2796 (sys.so+0xfbfc58)
    #14 julia_abstract_call_80236 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:2903 (sys.so+0xd1f2c8)
    #15 julia_abstract_call_82082 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:2896 (sys.so+0x122a7a8)
    #16 julia_abstract_call_82074 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:3056 (sys.so+0x472bac)
    #17 julia_abstract_eval_call_86189 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:3074 (sys.so+0x5601ac)
    #18 julia_abstract_eval_statement_expr_86143 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:3430 (sys.so+0xf2cbe0)
    #19 abstract_eval_basic_statement ../usr/share/julia/Compiler/src/abstractinterpretation.jl:3819 (sys.so+0x169c4c)
    #20 abstract_eval_basic_statement ../usr/share/julia/Compiler/src/abstractinterpretation.jl:3776 (sys.so+0x169c4c)
    #21 julia_typeinf_local_86082 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:4325 (sys.so+0x169c4c)
    #22 jfptr_typeinf_local_86083 <null> (sys.so+0xb43040)
    #23 _jl_invoke /home/user/c/julia/src/gf.c (libjulia-internal.so.1.13+0x5e9a4)
    #24 ijl_apply_generic /home/user/c/julia/src/gf.c:3892:12 (libjulia-internal.so.1.13+0x5e9a4)
    #25 julia_typeinf_78891 ../usr/share/julia/Compiler/src/abstractinterpretation.jl:4483 (sys.so+0x10aa25c)
[snip]

  Previous read of size 8 at 0xffff9e714960 by thread T9:
    #0 length essentials.jl:11 (sys.so+0x8a9188)
    #1 checkbounds essentials.jl:383 (sys.so+0x8a9188)
    #2 _iterate_array genericmemory.jl:230 (sys.so+0x8a9188)
    #3 iterate array.jl:907 (sys.so+0x8a9188)
    #4 julia_invalidate_code_for_globalrefNOT._86900 invalidation.jl:139 (sys.so+0x8a9188)
    #5 julia_invalidate_code_for_globalrefNOT._86907 invalidation.jl:170 (sys.so+0x213564)
    #6 jfptr_invalidate_code_for_globalrefNOT._86908 <null> (sys.so+0x2135fc)
    #7 _jl_invoke /home/user/c/julia/src/gf.c (libjulia-internal.so.1.13+0x5e9a4)
    #8 ijl_apply_generic /home/user/c/julia/src/gf.c:3892:12 (libjulia-internal.so.1.13+0x5e9a4)
    #9 jl_apply /home/user/c/julia/src/julia.h:2345:12 (libjulia-internal.so.1.13+0x90c40)
    #10 jl_invalidate_binding_refs /home/user/c/julia/src/module.c:1617:5 (libjulia-internal.so.1.13+0x90c40)
    #11 jl_replace_binding_locked2 /home/user/c/julia/src/module.c:1715:9 (libjulia-internal.so.1.13+0x8f504)
    #12 jl_replace_binding_locked /home/user/c/julia/src/module.c:1662:12 (libjulia-internal.so.1.13+0x89e5c)
    #13 jl_declare_constant_val3 /home/user/c/julia/src/module.c:574:25 (libjulia-internal.so.1.13+0x89e5c)
    #14 jl_declare_constant_val2 /home/user/c/julia/src/toplevel.c:571:37 (libjulia-internal.so.1.13+0xbd128)
    #15 jl_declare_constant_val /home/user/c/julia/src/toplevel.c:580:12 (libjulia-internal.so.1.13+0xbd128)
    #16 jl_eval_const_decl /home/user/c/julia/src/toplevel.c:597:5 (libjulia-internal.so.1.13+0xbd128)
[snip]

SUMMARY: ThreadSanitizer: data race /home/user/c/julia/src/array.c in ijl_array_grow_end
=================

Data race on jl_module_t.usings_backedges

The same goes for jl_module_t.usings_backedges.

Threads.@spawn for i=1:10000
    @eval Core const foo = $i
end
Threads.@threads for i=1:10000
    Module()
end

==================
WARNING: ThreadSanitizer: data race (pid=9714)
  Write of size 8 at 0xffff7db5b3b0 by thread T11:
    #0 ijl_array_grow_end /home/user/c/julia/src/gc-wb-stock.h (libjulia-internal.so.1.13+0x9f834)
    #1 ijl_array_ptr_1d_push /home/user/c/julia/src/array.c:260:5 (libjulia-internal.so.1.13+0x9f99c)
    #2 jl_add_usings_backedge /home/user/c/julia/src/module.c:1323:5 (libjulia-internal.so.1.13+0x8e73c)
    #3 jl_module_initial_using /home/user/c/julia/src/module.c:1337:5 (libjulia-internal.so.1.13+0x89a34)
    #4 jl_add_default_names /home/user/c/julia/src/module.c:517:13 (libjulia-internal.so.1.13+0x89a34)
    #5 jl_new_module_ /home/user/c/julia/src/module.c:530:5 (libjulia-internal.so.1.13+0x89a34)
    #6 jl_f_new_module /home/user/c/julia/src/module.c:650:22 (libjulia-internal.so.1.13+0x8a9b4)
[snip]

  Previous read of size 8 at 0xffff7db5b3b0 by thread T9:
    #0 getindex essentials.jl:967 (sys.so+0x40a1e4)
    #1 _iterate_array genericmemory.jl:230 (sys.so+0x40a1e4)
    #2 iterate array.jl:907 (sys.so+0x40a1e4)
    #3 iterate array.jl:907 (sys.so+0x40a1e4)
    #4 julia_invalidate_code_for_globalrefNOT._86900 invalidation.jl:148 (sys.so+0x40a1e4)
    #5 julia_invalidate_code_for_globalrefNOT._86907 invalidation.jl:170 (sys.so+0x10da33c)
    #6 jfptr_invalidate_code_for_globalrefNOT._86908 <null> (sys.so+0x10da3d4)
    #7 _jl_invoke /home/user/c/julia/src/gf.c (libjulia-internal.so.1.13+0x5ea04)
    #8 ijl_apply_generic /home/user/c/julia/src/gf.c:3892:12 (libjulia-internal.so.1.13+0x5ea04)
    #9 jl_apply /home/user/c/julia/src/julia.h:2362:12 (libjulia-internal.so.1.13+0x90d2c)
    #10 jl_invalidate_binding_refs /home/user/c/julia/src/module.c:1627:5 (libjulia-internal.so.1.13+0x90d2c)
    #11 jl_replace_binding_locked2 /home/user/c/julia/src/module.c:1725:9 (libjulia-internal.so.1.13+0x8f5f0)
    #12 jl_replace_binding_locked /home/user/c/julia/src/module.c:1672:12 (libjulia-internal.so.1.13+0x89ea0)
    #13 jl_declare_constant_val3 /home/user/c/julia/src/module.c:575:25 (libjulia-internal.so.1.13+0x89ea0)
    #14 jl_declare_constant_val2 /home/user/c/julia/src/toplevel.c:571:37 (libjulia-internal.so.1.13+0xbd214)
    #15 jl_declare_constant_val /home/user/c/julia/src/toplevel.c:580:12 (libjulia-internal.so.1.13+0xbd214)
    #16 jl_eval_const_decl /home/user/c/julia/src/toplevel.c:597:5 (libjulia-internal.so.1.13+0xbd214)
[snip]