use after free causes sporadic assertion fail
Claude Heiland-Allen <[email protected]>
| Newsgroups | gmane.comp.lib.cairo |
|---|---|
| Message-ID | <[email protected]> |
Hi all, The attached log from valgrind shows a use after free, which results in an assertion failure. Inspecting with gdb seems to show a font is removed from a cache, which requires looking up its key in a hash table, which aborts when the key isn't found - this can happen when the key contains garbage as the memory was already freed. I tried using ltrace to see the sequence of events leading to the crash, but unfortunately ltrace itself crashed earlier. I'm using Debian Stable (Wheezy) with libcairo2 1.12.14-4 from Testing (Jessie). My program is written in Haskell using the diagrams [1] library with its cairo backend [2]. My program is multithreaded but this should be safe as cairo is threadsafe [3], and each of my threads should be independent regarding any calls to cairo. I'm using Haskell's forkOS [4] to ensure that each Haskell thread makes all its 'safe' foreign calls to cairo from the same OS thread. The lower level Haskell cairo bindings [5] seem to use 'safe' foreign calls throughout [6]. I haven't been able to reproduce this crash in a single-threaded version of my program. Any suggestions for further debugging steps I might take to help fix this bug are welcome. Claude [1] http://projects.haskell.org/diagrams/ [2] http://hackage.haskell.org/package/diagrams-cairo [3] http://lists.cairographics.org/archives/cairo/2009-February/016648.html [4] http://hackage.haskell.org/packages/archive/base/latest/doc/html/Control-Concurrent.html#v:forkOS [5] http://hackage.haskell.org/package/cairo [6] http://hackage.haskell.org/packages/archive/cairo/0.12.4/doc/html/src/Graphics-Rendering-Cairo-Internal-Drawing-Cairo.html#line-385 -- http://mathr.co.uk -- cairo mailing list [email protected] http://lists.cairographics.org/mailman/listinfo/cairo
valgrind.log
(text/x-log, 6.2 KB)
$ valgrind postcards-wedged ==20173== Memcheck, a memory error detector ==20173== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al. ==20173== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info ==20173== Command: postcards-wedged ==20173== ==20173== Conditional jump or move depends on uninitialised value(s) ==20173== at 0x4017766: index (strchr.S:55) ==20173== by 0x4007902: expand_dynamic_string_token (dl-load.c:431) ==20173== by 0x40081F4: _dl_map_object (dl-load.c:2543) ==20173== by 0x400170D: map_doit (rtld.c:632) ==20173== by 0x400E845: _dl_catch_error (dl-error.c:177) ==20173== by 0x4000FDD: do_preload (rtld.c:821) ==20173== by 0x4004711: dl_main (rtld.c:1635) ==20173== by 0x40151AD: _dl_sysdep_start (dl-sysdep.c:241) ==20173== by 0x4004D85: _dl_start (rtld.c:337) ==20173== by 0x4001527: ??? (in /lib/x86_64-linux-gnu/ld-2.17.so) ==20173== ==20173== Conditional jump or move depends on uninitialised value(s) ==20173== at 0x401776B: index (strchr.S:58) ==20173== by 0x4007902: expand_dynamic_string_token (dl-load.c:431) ==20173== by 0x40081F4: _dl_map_object (dl-load.c:2543) ==20173== by 0x400170D: map_doit (rtld.c:632) ==20173== by 0x400E845: _dl_catch_error (dl-error.c:177) ==20173== by 0x4000FDD: do_preload (rtld.c:821) ==20173== by 0x4004711: dl_main (rtld.c:1635) ==20173== by 0x40151AD: _dl_sysdep_start (dl-sysdep.c:241) ==20173== by 0x4004D85: _dl_start (rtld.c:337) ==20173== by 0x4001527: ??? (in /lib/x86_64-linux-gnu/ld-2.17.so) ==20173== ==20173== Thread 8: ==20173== Invalid read of size 4 ==20173== at 0x56CD16E: _cairo_toy_font_face_destroy (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x567EC46: cairo_font_face_destroy (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x56815A5: _cairo_gstate_fini (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x568198A: _cairo_gstate_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x5675A24: cairo_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x480A29: ??? (in /home/claude/.cabal/bin/postcards-wedged) ==20173== by 0x3FE7F284E49FE51E: ??? ==20173== Address 0x19563d5c is 12 bytes inside a block of size 80 free'd ==20173== at 0x4C29D4E: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==20173== by 0x56815A5: _cairo_gstate_fini (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x568198A: _cairo_gstate_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x5675A24: cairo_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x480A29: ??? (in /home/claude/.cabal/bin/postcards-wedged) ==20173== by 0xE1B6D97: ??? ==20173== ==20173== Invalid read of size 4 ==20173== at 0x56CD175: _cairo_toy_font_face_destroy (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x567EC46: cairo_font_face_destroy (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x56815A5: _cairo_gstate_fini (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x568198A: _cairo_gstate_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x5675A24: cairo_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x480A29: ??? (in /home/claude/.cabal/bin/postcards-wedged) ==20173== by 0x3FE7F284E49FE51E: ??? ==20173== Address 0x19563d58 is 8 bytes inside a block of size 80 free'd ==20173== at 0x4C29D4E: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==20173== by 0x56815A5: _cairo_gstate_fini (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x568198A: _cairo_gstate_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x5675A24: cairo_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x480A29: ??? (in /home/claude/.cabal/bin/postcards-wedged) ==20173== by 0xE1B6D97: ??? ==20173== ==20173== Invalid read of size 8 ==20173== at 0x5684EF7: _cairo_hash_table_remove (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x56CD186: _cairo_toy_font_face_destroy (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x567EC46: cairo_font_face_destroy (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x56815A5: _cairo_gstate_fini (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x568198A: _cairo_gstate_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x5675A24: cairo_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x480A29: ??? (in /home/claude/.cabal/bin/postcards-wedged) ==20173== by 0x3FE7F284E49FE51E: ??? ==20173== Address 0x19563d50 is 0 bytes inside a block of size 80 free'd ==20173== at 0x4C29D4E: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==20173== by 0x56815A5: _cairo_gstate_fini (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x568198A: _cairo_gstate_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x5675A24: cairo_restore (in /usr/lib/x86_64-linux-gnu/libcairo.so.2.11200.14) ==20173== by 0x480A29: ??? (in /home/claude/.cabal/bin/postcards-wedged) ==20173== by 0xE1B6D97: ??? ==20173== postcards-wedged: /build/buildd-cairo_1.12.14-4-amd64-KKcr2E/cairo-1.12.14/src/cairo-hash.c:506: _cairo_hash_table_lookup_exact_key: Assertion `!"reached"' failed. ==20173== ==20173== HEAP SUMMARY: ==20173== in use at exit: 18,852,636 bytes in 198 blocks ==20173== total heap usage: 3,188 allocs, 2,990 frees, 25,656,340 bytes allocated ==20173== ==20173== LEAK SUMMARY: ==20173== definitely lost: 256 bytes in 1 blocks ==20173== indirectly lost: 96 bytes in 3 blocks ==20173== possibly lost: 3,040 bytes in 10 blocks ==20173== still reachable: 18,849,244 bytes in 184 blocks ==20173== suppressed: 0 bytes in 0 blocks ==20173== Rerun with --leak-check=full to see details of leaked memory ==20173== ==20173== For counts of detected and suppressed errors, rerun with: -v ==20173== Use --track-origins=yes to see where uninitialised values come from ==20173== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 0 from 0) Killed