Question

I have a C++ application (for OS X) that calls lua as a scripting language.
I’m running a large number of these applications (100s) and they can run
for a very long time (days or weeks).

Sometimes one crashes. And when it crashes it leaves me a lovely core file.

I can open this core file in gdb and find where the application crashes.
I can walk the call stack and find an instance of a lua_State variable.
My problem is that I’d like to see what the lua call stack looks like at
this time…

Keep in mind that since this is a core I don’t have access to calling C functions, which rules out several of the usual ways of debugging lua scripts.

Id like to avoid adding manual traces through debug hooks as I’m worried about the additional performance penalties, and added complexity.

How can I traverse the lua internal structures to get at call stack information?

Answer 1

I’ve created a GDB script to do the stuff in the web page linked to by macs. Its not beautiful, and should probably be properly wrapped into a function etc, but here it is for the curious.

NOTE: It seems that the web page is wrong about the filename for lua functions. In the case where the string comes from luaL_dofile() the filename starts with a @ symbol. If they’re called from lua_dostring(). In that case the $filename variable is set to the whole of the string passed to lua_dostring() – and the user is probably only interested in one or two lines of context from that file. I wasn’t sure how to fix that up.

set $p = L->base_ci
while ($p <= L->ci )
  if ( $p->func->value.gc->cl.c.isC == 1 )
    printf "0x%x   C FUNCTION", $p
    output $p->func->value.gc->cl.c.f
    printf "\n"
  else
    if ($p->func.tt==6)
      set $proto = $p->func->value.gc->cl.l.p
      set $filename = (char*)(&($proto->source->tsv) + 1)
      set $lineno = $proto->lineinfo[ $p->savedpc - $proto->code -1 ]
      printf "0x%x LUA FUNCTION : %d %s\n", $p, $lineno, $filename
    else
      printf "0x%x LUA BASE\n", $p
    end
  end
  set $p = $p+1
end

This outputs something like:

0x1002b0 LUA BASE
0x1002c8 LUA FUNCTION : 4 @a.lua
0x1002e0 LUA FUNCTION : 3 @b.lua
0x100310   C FUNCTION(lua_CFunction) 0x1fda <crash_function(lua_State*)>

When I debug the crash from this code:

// This is a file designed to crash horribly when run.
// It should generate a core, and it should crash inside some lua functions

#include "lua.h"
#include "lualib.h"
#include "lauxlib.h"

#include <iostream>
#include <signal.h>

int crash_function(lua_State * L)
{
  raise( SIGABRT ); //This should dump core!
  return 0;
}



int main()
{
  lua_State * L = luaL_newstate();
  lua_pushcfunction(L, crash_function);
  lua_setfield(L, LUA_GLOBALSINDEX, "C");

  luaopen_base(L);
  if( 1 == luaL_dofile(L, "a.lua" ))
  {
    std::cout<<"ERROR: "<<lua_tostring(L,-1)<<std::endl;
    return 1;
  }
  if( 1 == luaL_dofile(L, "b.lua" ))
  {
    std::cout<<"ERROR: "<<lua_tostring(L,-1)<<std::endl;
    return 1;
  }

  lua_getfield(L, LUA_GLOBALSINDEX, "A");
  lua_pcall(L, 0, 0, NULL);
}

With a.lua

-- a.lua
-- just calls B, which calls C which should crash
function A()
  B()
end

and b.lua

-- b.lua
function B()
  C()
end