Segfault on Ubuntu 12.10 Quantal

Bug #1056684 reported by Anton Gladky
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Yade
Fix Released
High
Unassigned

Bug Description

Yade is unusable on Ubuntu 12.10
Crashes all the time.

yade --test

...
...
Bodies: erased bodies are None in python ... ok
testErasedAndNewlyCreatedSphere (yade.TestBodies)
Bodies: The bug is described in LP:1001194. If the new body was created after deletion of previous, it has no bounding box ... ok
testErasedIterate (yade.TestBodies)
Bodies: Iterator silently skips erased ones ... SIGSEGV/SIGABRT handler called; gdb batch file is `/tmp/yade-dYcDeB/tmp-0'
GNU gdb (GDB) 7.5-ubuntu
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
[New LWP 13815]
[New LWP 13814]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

0x00007fcbaa8b4b5d in waitpid () from /lib/x86_64-linux-gnu/libc.so.6
No symbol "info" in current context.

Thread 3 (Thread 0x7fcb88bd5700 (LWP 13814)):
#0 0x00007fcbaa8e2703 in select () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fcb897a7e4c in ?? () from /usr/lib/libtcl8.5.so.0
#2 0x00007fcbab4d5e9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#3 0x00007fcbaa8e939d in clone () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x0000000000000000 in ?? ()

Thread 2 (Thread 0x7fcb868c8700 (LWP 13815)):
#0 0x00007fcba7456fb6 in ?? () from /usr/lib/x86_64-linux-gnu/libgomp.so.1
#1 0x00007fcba745582e in ?? () from /usr/lib/x86_64-linux-gnu/libgomp.so.1
#2 0x00007fcbab4d5e9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#3 0x00007fcbaa8e939d in clone () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7fcbab8fa700 (LWP 13813)):
#0 0x00007fcbaa8b4b5d in waitpid () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fcbaa83af1e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007fcbaa83b330 in system () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007fcbab7aab33 in crashHandler (sig=11) at /home/dem/trunk/core/main/pyboot.cpp:21
#4 <signal handler called>
#5 0x000000000048a5a8 in ?? ()
#6 0x00007fcba8eda5c9 in boost::python::converter::shared_ptr_deleter::operator()(void const*) () from /usr/lib/libboost_python-py27.so.1.49.0
#7 0x00007fcba9b69781 in boost::detail::sp_counted_impl_pd<void*, boost::python::converter::shared_ptr_deleter>::dispose (this=0x2dedd60) at /usr/include/boost/smart_ptr/detail/sp_counted_impl.hpp:148
#8 0x00007fcbab7ab8b2 in boost::detail::sp_counted_base::release (this=0x2dedd60) at /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:145
#9 0x00007fcbab7ab941 in boost::detail::shared_count::~shared_count (this=0x31a6bb8, __in_chrg=<optimized out>) at /usr/include/boost/smart_ptr/detail/shared_count.hpp:305
#10 0x00007fcba9b2911c in boost::shared_ptr<Body>::~shared_ptr (this=0x31a6bb0, __in_chrg=<optimized out>) at /usr/include/boost/smart_ptr/shared_ptr.hpp:164
#11 0x00007fcba9c21103 in std::_Destroy<boost::shared_ptr<Body> > (__pointer=0x31a6bb0) at /usr/include/c++/4.7/bits/stl_construct.h:95
#12 0x00007fcba9c1e435 in std::_Destroy_aux<false>::__destroy<boost::shared_ptr<Body>*> (__first=0x31a6bb0, __last=0x31a6be0) at /usr/include/c++/4.7/bits/stl_construct.h:105
#13 0x00007fcba9c19c54 in std::_Destroy<boost::shared_ptr<Body>*> (__first=0x31a6bb0, __last=0x31a6be0) at /usr/include/c++/4.7/bits/stl_construct.h:128
#14 0x00007fcba9c13f71 in std::_Destroy<boost::shared_ptr<Body>*, boost::shared_ptr<Body> > (__first=0x31a6bb0, __last=0x31a6be0) at /usr/include/c++/4.7/bits/stl_construct.h:155
#15 0x00007fcba9c18a6a in std::vector<boost::shared_ptr<Body>, std::allocator<boost::shared_ptr<Body> > >::~vector (this=0x29b8098, __in_chrg=<optimized out>) at /usr/include/c++/4.7/bits/stl_vector.h:403
#16 0x00007fcba9d6bfb9 in BodyContainer::~BodyContainer (this=0x29b8090, __in_chrg=<optimized out>) at /home/dem/trunk/core/BodyContainer.cpp:18
#17 0x00007fcba9d6c018 in BodyContainer::~BodyContainer (this=0x29b8090, __in_chrg=<optimized out>) at /home/dem/trunk/core/BodyContainer.cpp:18
#18 0x00007fcba9bbae56 in boost::checked_delete<BodyContainer> (x=0x29b8090) at /usr/include/boost/checked_delete.hpp:34
#19 0x00007fcba9bec248 in boost::detail::sp_counted_impl_p<BodyContainer>::dispose (this=0x31e3cd0) at /usr/include/boost/smart_ptr/detail/sp_counted_impl.hpp:78
#20 0x00007fcbab7ab8b2 in boost::detail::sp_counted_base::release (this=0x31e3cd0) at /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:145
#21 0x00007fcbab7ab941 in boost::detail::shared_count::~shared_count (this=0x31e3c30, __in_chrg=<optimized out>) at /usr/include/boost/smart_ptr/detail/shared_count.hpp:305
#22 0x00007fcba9b94d84 in boost::shared_ptr<BodyContainer>::~shared_ptr (this=0x31e3c28, __in_chrg=<optimized out>) at /usr/include/boost/smart_ptr/shared_ptr.hpp:164
#23 0x00007fcba9bc0ad3 in Scene::~Scene (this=0x31e39f0, __in_chrg=<optimized out>) at /home/dem/build/yade/core/Scene.hpp:33
#24 0x00007fcba9bc0ca4 in Scene::~Scene (this=0x31e39f0, __in_chrg=<optimized out>) at /home/dem/build/yade/core/Scene.hpp:33
#25 0x00007fcba9bc0cdc in boost::checked_delete<Scene> (x=0x31e39f0) at /usr/include/boost/checked_delete.hpp:34
#26 0x00007fcba9beb9de in boost::detail::sp_counted_impl_p<Scene>::dispose (this=0x31a2e70) at /usr/include/boost/smart_ptr/detail/sp_counted_impl.hpp:78
#27 0x00007fcbab7ab8b2 in boost::detail::sp_counted_base::release (this=0x31a2e70) at /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:145
#28 0x00007fcbab7ab941 in boost::detail::shared_count::~shared_count (this=0x7fff89b17328, __in_chrg=<optimized out>) at /usr/include/boost/smart_ptr/detail/shared_count.hpp:305
#29 0x00007fcbab7ac3a4 in boost::shared_ptr<Scene>::~shared_ptr (this=0x7fff89b17320, __in_chrg=<optimized out>) at /usr/include/boost/smart_ptr/shared_ptr.hpp:164
#30 0x00007fcba9bb5d19 in boost::shared_ptr<Scene>::operator= (this=0x14d6e40, r=...) at /usr/include/boost/smart_ptr/shared_ptr.hpp:311
#31 0x00007fcba9c00652 in Omega::resetAllScenes (this=0x1494ae0) at /home/dem/trunk/core/Omega.cpp:57
#32 0x00007fcba9c00c3e in Omega::init (this=0x1494ae0) at /home/dem/trunk/core/Omega.cpp:103
#33 0x00007fcba9c00c08 in Omega::reset (this=0x1494ae0) at /home/dem/trunk/core/Omega.cpp:97
#34 0x00007fcb90ee90c0 in pyOmega::reset (this=0x7fcbab765f70) at /home/dem/trunk/py/wrapper/yadeWrapper.cpp:403
#35 0x00007fcb91003c02 in boost::python::detail::invoke<int, void (pyOmega::*)(), boost::python::arg_from_python<pyOmega&> > (f=@0x1559318: (void (pyOmega::*)(pyOmega * const)) 0x7fcb90ee909c <pyOmega::reset()>, tc=...) at /usr/include/boost/python/detail/invoke.hpp:94
#36 0x00007fcb90fe0755 in boost::python::detail::caller_arity<1u>::impl<void (pyOmega::*)(), boost::python::default_call_policies, boost::mpl::vector2<void, pyOmega&> >::operator() (this=0x1559318, args_=0x2fa6790) at /usr/include/boost/python/detail/caller.hpp:223
#37 0x00007fcb90fc2deb in boost::python::objects::caller_py_function_impl<boost::python::detail::caller<void (pyOmega::*)(), boost::python::default_call_policies, boost::mpl::vector2<void, pyOmega&> > >::operator() (this=0x1559310, args=0x2fa6790, kw=0x0) at /usr/include/boost/python/object/py_function.hpp:38
#38 0x00007fcba8ecfd3b in boost::python::objects::function::call(_object*, _object*) const () from /usr/lib/libboost_python-py27.so.1.49.0
#39 0x00007fcba8ecff58 in ?? () from /usr/lib/libboost_python-py27.so.1.49.0
#40 0x00007fcba8ed8f8b in boost::python::handle_exception_impl(boost::function0<void>) () from /usr/lib/libboost_python-py27.so.1.49.0
#41 0x00007fcba8ece205 in ?? () from /usr/lib/libboost_python-py27.so.1.49.0
#42 0x00000000004600ae in PyEval_EvalFrameEx ()
#43 0x00000000004602a7 in PyEval_EvalFrameEx ()
#44 0x00000000004671d9 in PyEval_EvalCodeEx ()
#45 0x00000000004aa068 in ?? ()
#46 0x000000000046187e in PyEval_EvalFrameEx ()
#47 0x00000000004671d9 in PyEval_EvalCodeEx ()
#48 0x00000000004a9f3a in ?? ()
#49 0x000000000048227d in ?? ()
#50 0x00000000004a08d6 in PyObject_Call ()
#51 0x00000000004f0e94 in ?? ()
#52 0x00000000004600ae in PyEval_EvalFrameEx ()
#53 0x00000000004671d9 in PyEval_EvalCodeEx ()
#54 0x00000000004aa068 in ?? ()
#55 0x000000000046187e in PyEval_EvalFrameEx ()
#56 0x00000000004671d9 in PyEval_EvalCodeEx ()
#57 0x00000000004a9f3a in ?? ()
#58 0x000000000048227d in ?? ()
#59 0x00000000004a08d6 in PyObject_Call ()
#60 0x00000000004f0e94 in ?? ()
#61 0x00000000004600ae in PyEval_EvalFrameEx ()
#62 0x00000000004671d9 in PyEval_EvalCodeEx ()
#63 0x00000000004aa068 in ?? ()
#64 0x000000000046187e in PyEval_EvalFrameEx ()
#65 0x00000000004671d9 in PyEval_EvalCodeEx ()
#66 0x00000000004a9f3a in ?? ()
#67 0x000000000048227d in ?? ()
#68 0x00000000004a08d6 in PyObject_Call ()
#69 0x00000000004f0e94 in ?? ()
#70 0x00000000004600ae in PyEval_EvalFrameEx ()
#71 0x00000000004671d9 in PyEval_EvalCodeEx ()
#72 0x00000000004aa068 in ?? ()
#73 0x000000000046187e in PyEval_EvalFrameEx ()
#74 0x00000000004671d9 in PyEval_EvalCodeEx ()
#75 0x00000000004a9f3a in ?? ()
#76 0x000000000048227d in ?? ()
#77 0x00000000004a08d6 in PyObject_Call ()
#78 0x00000000004f0e94 in ?? ()
#79 0x00000000004600ae in PyEval_EvalFrameEx ()
#80 0x00000000004602a7 in PyEval_EvalFrameEx ()
#81 0x00000000004602a7 in PyEval_EvalFrameEx ()
#82 0x00000000004671d9 in PyEval_EvalCodeEx ()
#83 0x00000000004d0162 in PyEval_EvalCode ()
#84 0x00000000005103bb in ?? ()
#85 0x000000000044a456 in PyRun_FileExFlags ()
#86 0x000000000044a96a in PyRun_SimpleFileExFlags ()
#87 0x000000000044b6ac in Py_Main ()
#88 0x00007fcbaa81876d in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
#89 0x00000000004cdfcd in _start ()
Segmentation fault (core dumped)

Revision history for this message
Anton Gladky (gladky-anton) wrote :

It seems, it happens during removing of the old "smart" scene-pointer [1].
Crashes somewhere in libthreads.

The problem occurs only on Ubuntu Quantal.
Still not sure why... On other systems the bug does not appear.
Suggestions are welcome.

Thanks.

Anton

[1] https://github.com/yade/trunk/blob/master/core/Omega.cpp#L57

Revision history for this message
Bruno Chareyre (bruno-chareyre) wrote :

Maybe similar to this?
http://code.google.com/p/libtorrent/issues/detail?id=369

In the backtrace, it looks like a problem in boost::python::shared_ptr_deleter. In the libtorrent bug, it is due to a race condition.
Maybe additional locks would solve the problem?
Does it crash without openMP?

Revision history for this message
Anton Gladky (gladky-anton) wrote :

It crashes independently from openMP. There is actually a lock
(RenderMutexLock lock;). Perhaps it does not work effectively.

I saw the libtorrent patch. They just removed the crashing part of the code.
We can not do that.

Anton

Revision history for this message
Bruno Chareyre (bruno-chareyre) wrote :

The lock only prevent the Qt display of scene.
If for some reason python is accessing scene during the delete, then it can crashes, there is no lock to prevent that.
Sorry, I can't help much more, I don't even have any 12.10 around to test.

Revision history for this message
Anton Gladky (gladky-anton) wrote : Re: [Bug 1056684] Re: Segfault on Ubuntu 12.10 Quantal

I was trying to block it using boost:mutex but with
no success. I have no idea how to fix that.

Yade is completely unusable on that distribution...

Anton

Revision history for this message
Bruno Chareyre (bruno-chareyre) wrote :

Does it crash also in an ordinary script Anton?
Looking again at the trace, it seems it crashes while trying to delete bodies.

Revision history for this message
Anton Gladky (gladky-anton) wrote :

I think so. At least it crashes on both --test and --check verifications.
It seems, the problem happens, when the scene resets.

Anton

2012/10/15 Chareyre <email address hidden>:
> Does it crash also in an ordinary script Anton?
> Looking again at the trace, it seems it crashes while trying to delete bodies.

Revision history for this message
Anton Gladky (gladky-anton) wrote :

The fix is committed:

https://github.com/yade/trunk/commit/4c2a90cc20af4e589645b725a4d85602ebc8a4d2
https://github.com/yade/trunk/commit/b146e47bf1fce67c0cb0afa745d7be0b130c9979

So, we will be able to build packages for newer Ubuntu versions now (12.10 and 13.04).

Cheers,

Anton

Changed in yade:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.