Crash in cc_memalloc_deallocate

[VolkerEnderlein]

Original report by Johannes Obermayr (Bitbucket: jobermayr, GitHub: jobermayr).

Attachments: Coin.log

---

Used revision: 10d8002

Cannot access/execute: allocator->num_allocated_units--;

$ gdb FreeCAD --batch -ex "run" -ex "bt full"
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffd2ffa700 (LWP 15961)]

Thread 1 "FreeCAD" received signal SIGSEGV, Segmentation fault.
cc_memalloc_deallocate (allocator=0x7838342f65730000, ptr=ptr@entry=0x8be7c0) at memalloc.cpp:215
215 memalloc.cpp: Datei oder Verzeichnis nicht gefunden.
#0 cc_memalloc_deallocate (allocator=0x7838342f65730000, ptr=ptr@entry=0x8be7c0) at memalloc.cpp:215
newfree = 0x8be7c0
#1 0x00007ffff41d0e46 in SbHash<char const*, short>::SbHashEntry::operator delete (ptr=0x8be7c0) at ../../src/misc/SbHash.h:144
entry = 0x8be7c0
#2 SbHash<char const*, short>::resize (newsize=, this=0x8d0ff0) at ../../src/misc/SbHash.h:444
preventry = 0x8be7c0
entry = 0x8c0950
oldsize =
oldbuckets = 0xd0a6d0
i =
#3 SbHash<char const*, short>::put (obj=, key=, this=0x8d0ff0) at ../../src/misc/SbHash.h:473
key =
obj =
this = 0x8d0ff0
entry =
#4 SoType::createType (parent=..., name=..., method=method@entry=0x7ffff40e8780 SoGLCacheContextElement::createInstance(), data=data@entry=0) at SoType.cpp:305
discard =
newType = {index = 192, static typedatalist = 0xd328c0}
typeData =
#5 0x00007ffff40e882b in SoGLCacheContextElement::initClass () at SoGLCacheContextElement.cpp:168
PRETTY_FUNCTION = "static void SoGLCacheContextElement::initClass()"
#6 0x00007ffff40c627f in SoElement::initElements () at SoElement.cpp:459
No locals.
#7 0x00007ffff40c639f in SoElement::initClass () at SoElement.cpp:516
PRETTY_FUNCTION = "static void SoElement::initClass()"
#8 0x00007ffff41b81d4 in SoDB::init () at SoDB.cpp:313
PRETTY_FUNCTION = "static void SoDB::init()"
env =
#9 0x00007ffff73afd3e in Gui::Application::runApplication () at /usr/src/debug/freecad/src/Gui/Application.cpp:1662

[VolkerEnderlein]

Original comment by Johannes Obermayr (Bitbucket: jobermayr, GitHub: jobermayr).

---

Some more debug information from resize(unsigned int newsize):

elements: 193, threshold: 192

oldsize: 257, newsize: 521

processing oldbucket[0]

Available Entries:

Processing Entries:

processing oldbucket[1]

Available Entries:

obj string: SoGLViewingMatrixElement, key value 173

obj string: SoDecimationTypeElement, key value 127

obj string: MFVec3i32, key value 97

Processing Entries:

obj string: SoGLViewingMatrixElement, key value: 173

-> crash in cc_memalloc_deallocate

If I change function: void operator delete(void * ptr)

- SbHashEntry * entry = static_cast<SbHashEntry *>( ptr);
+ SbHashEntry * entry = (SbHashEntry *)ptr;

the first entry succeed, the second (obj string: SoDecimationTypeElement, key value 127) crashes.

[VolkerEnderlein]

Original comment by Roy Walmsley (Bitbucket: walroy, GitHub: walroy).

---

Hi Johannes,

Can you give us a more general description of what you are doing, please? For example, operating system, build tools, Coin version usage, etc.. This should help us to help you.

Thanks,

Roy

[VolkerEnderlein]

Original comment by Johannes Obermayr (Bitbucket: jobermayr, GitHub: jobermayr).

---

OS:

openSUSE Tumbleweed (Linux, x86_64)

Full build log (with initialing buildhost):

https://pmbs.links2linux.de/build/Extra/openSUSE_Tumbleweed/x86_64/Coin/_log

Coin version:

https://bitbucket.org/Coin3D/coin/commits/10d8002

Coin included/loaded:

https://github.com/FreeCAD/FreeCAD/blob/master/src/Gui/Application.cpp#L1662

[VolkerEnderlein]

Original comment by Johannes Obermayr (Bitbucket: jobermayr, GitHub: jobermayr).

---

gcc produces wrong code.

$ sed -i -e "s:gcc:clang:g" -e "s:g++:clang++:g" configure
$ make -j2

produces right code.

[VolkerEnderlein]

Original comment by Roy Walmsley (Bitbucket: walroy, GitHub: walroy).

---

Hi Johannes,

Glad to see you are making some progress. Do you know if the code in any particular file needs correction?

Roy

[VolkerEnderlein]

Original comment by MJDSys (Bitbucket: MJDSys, GitHub: MJDSys).

---

Fedora devs have figured out the issue, see their bug report here: https://bugzilla.redhat.com/show_bug.cgi?id=1323159 , and patch here: http://pkgs.fedoraproject.org/cgit/rpms/Coin3.git/commit/?id=ca89ec7227943bdec800ee51b920f578fab87b05 . It appears using placement new to initialize the memhandler member is undefined behaviour, and gcc is now aggressively optimizing out that store, which causes this problem (see gcc's documentation here https://gcc.gnu.org/gcc-6/porting_to.html regarding -flifetime-dse). Would a pull request with fedora's patch be accepted? That seems to be the simplest way forward.

[VolkerEnderlein]

Original comment by Volker Enderlein (Bitbucket: VolkerEnderlein, GitHub: VolkerEnderlein).

---

I just prepared pull request #258 for that issue.

[VolkerEnderlein]

Original comment by Bastiaan Veelo (Bitbucket: veelo, GitHub: veelo).

---

Thanks! I just merged it.

[VolkerEnderlein]

Original comment by Bastiaan Veelo (Bitbucket: veelo, GitHub: veelo).

---

Thank you to all contributors.