What are Zombies and what causes them? Are there Zombie processes and Zombie objects?

Question

I can find questions about zombies but none that directly addresses what they are and why and how they occur. There are a couple that address what zombie processes are in the context of answering a specific question but don't address the cause.

There are also questions regarding zombie processes and questions about Objective-C/Cocoa-related zombie objects. What are the differences or how are these related? Is an "EXEC_BAD_ACCESS" on Mac/iPhone (or similar error on other platforms) synonymous with a zombie?

How can one prevent zombies and are there any best practices that will help avoid them?

It would be helpful to have this information in one place. This question is intended to be platform/language agnostic, if possible.

Amplexicaul

Answer 1

Zombie processes and zombie objects are totally unrelated. Zombie processes are when a parent starts a child process and the child process ends, but the parent doesn't pick up the child's exit code. The process object has to stay around until this happens - it consumes no resources and is dead, but it still exists - hence, 'zombie'.

Zombie objects are a debugging feature of Cocoa / CoreFoundation to help you catch memory errors - normally when an object's refcount drops to zero it's freed immediately, but that makes debugging difficult. Instead, if zombie objects are enabled, the object's memory isn't instantly freed, it's just marked as a zombie, and any further attempts to use it will be logged and you can track down where in the code the object was used past its lifetime.

EXEC_BAD_ACCESS is your run-of-the-mill "You used a bad pointer" exception, like if I did:

(*(0x42)) = 5;

Malignity

OK, I get what the zombie process is but why does this happen? Is this a programming error in the parent process, system glitch, supernatural force? So, the so-called zombie object is used to catch dangling pointers, i.e., pointers that reference an object whose memory has been freed? – Amplexicaul

Yeah, it's the parent doing something wrong. You've got it wrt the Zombie Objects – Malignity

Conceptually, I'd argue, they are related: both have been "killed" but are somehow still "alive" in a sense. – Amplexicaul

As for the "EXEC_BAD_ACCESS" type of error, it seems that it doesn't necessarily have to be a zombie. If you did some horrible pointer arithmetic you could presumably get that type of error but you'd still have a valid object somewhere (you'd just have to get your pointer referencing it correctly). Also, I get the point of your example but theoretically it could work if the stars were aligned correctly (not likely but just sayin'), right? – Amplexicaul

Answer 2

When a process ends, much of its state still exists in the kernel, because its parent may still want to look at a few things, like its return value, which needs to be stored someplace. When a parent calls wait() or waitpid(), it tells the kernel to throw it all away because it's done with it. Until it does so, the child retains a pid and uses up resources. Those un-reaped child processes are called zombies. Even killing a zombie won't remove it, it must be reaped (wait-ed-upon) by its parent. If the parent dies, they are passed to "init" on unix systems, whose sole job is to wait for things to clean them up.

I've never heard of "zombie objects", but I assume that it refers to things that have either not been cleaned up by the garbage collector, or that have circular references or some such thing, such that they are not going to be cleaned up by the garbage collector. The metaphor is pretty similar: fork()==malloc(), wait()==free() at a certain level. (Not a perfect metaphor, of course.)

Unfriendly

The only resource consumed by a zombie process is its entry in the kernel's process table. Everything else has been reclaimed at that point because It's Dead, Jim. (And init has other responsibilities too, but you usually only see those when it goes wrong.) – Remindful

@donal: i thought that the signal code was also in there. and can it still be writing core during/after its wait-ed-upon? also, by "using up resources", i was mostly referring to the pid itself, since you can run out of those, especially on a per-user basis. :-) – Unfriendly

Hmm, I had also thought that a "zombie object" was the result of cyclic references preventing a garbage collector from collecting certain objects. Would you say that this thread has responded to this in the negative? – Anora