CONNECTIONTYPE kerneldensity crashes mapserv/gdal on Windows (memcpy)

[jmckenna]

• initially reported through the mailing list http://lists.osgeo.org/pipermail/mapserver-users/2014-September/076985.html

• I have built MapServer (master) and GDAL (trunk and 1.11.1) in debug mode

• small test case including mapfile (using the Natural Earth populated places shapefile): http://www.gatewaygeomatics.com/dl/ticket-kerneldensity.zip

• command to cause crash:

  mapserv -nh "QUERY_STRING=MAP=kerneldensity.map&MODE=map&LAYERS=all"
  

• error/crash details displayed:

    Problem signature:
      Problem Event Name:   APPCRASH
      Application Name: mapserv.exe
      Application Version:  0.0.0.0
      Application Timestamp:    544536b7
      Fault Module Name:    MSVCR90.dll
      Fault Module Version: 9.0.30729.6161
      Fault Module Timestamp:   4dace5b9
      Exception Code:   c0000005
      Exception Offset: 0003ae7a
      OS Version:   6.0.6002.2.2.0.768.2
      Locale ID:    1033
      Additional Information 1: 1e2c
      Additional Information 2: ac6d5ba36818e8000ec133b4ed12b99d
      Additional Information 3: 9afd
      Additional Information 4: b4e1bd2cfeabb701f3d0e0c7b04f79c2

• opening in Visual Studio 2008 debugger, this message appears:

  message: Unhandled exception at 0x71fbae7a (msvcr90.dll) in mapserv.exe: 
   0xC0000005: Access violation reading location 0x00000031.
  

• the debugger stops at:

  memcpy.asm

  line 188 (with arrow):

    Dword_align:
        test    edi,11b         ;U - destination dword aligned?
        jnz     short CopyLeadUp ;V - if we are not dword aligned already, align
  
        shr     ecx,2           ;U - shift down to dword count
        and     edx,11b         ;V - trailing byte count
  
        cmp     ecx,8           ;U - test if small enough for unwind copy
        jb      short CopyUnwindUp ;V - if so, then jump
  
      --->      rep     movsd           ;N - move all of our dwords
  
        jmp     dword ptr TrailUpVec[edx*4] ;N - process trailing bytes 
  

• which is called by rasterio I believe, at:
  rasterio.cpp (line 1249)

     memcpy(pDstData, pSrcData, nWordCount * nSrcDataTypeSize);
  

• the call stack at that point is:

    msvcr90.dll!memcpy(unsigned char * dst=0x05be0068, unsigned char * src=0x00000031, unsigned long count=400)  Line 188   Asm
    gdal200.dll!GDALCopyWords(void * pSrcData=0x00000031, GDALDataType eSrcType=GDT_Byte, int nSrcPixelStride=1, void * pDstData=0x05be0068, GDALDataType eDstType=GDT_Byte, int nDstPixelStride=1, int nWordCount=400)  Line 1249 + 0x15 bytes C++
    gdal200.dll!MEMRasterBand::IRasterIO(GDALRWFlag eRWFlag=GF_Read, int nXOff=0, int nYOff=0, int nXSize=400, int nYSize=300, void * pData=0x05be0068, int nBufXSize=400, int nBufYSize=300, GDALDataType eBufType=GDT_Byte, int nPixelSpaceBuf=1, int nLineSpaceBuf=400)  Line 222    C++
    gdal200.dll!GDALRasterBand::RasterIO(GDALRWFlag eRWFlag=GF_Read, int nXOff=0, int nYOff=0, int nXSize=400, int nYSize=300, void * pData=0x05be0068, int nBufXSize=400, int nBufYSize=300, GDALDataType eBufType=GDT_Byte, int nPixelSpace=1, int nLineSpace=400)  Line 261  C++
    gdal200.dll!MEMDataset::IRasterIO(GDALRWFlag eRWFlag=GF_Read, int nXOff=0, int nYOff=0, int nXSize=400, int nYSize=300, void * pData=0x05be0068, int nBufXSize=400, int nBufYSize=300, GDALDataType eBufType=GDT_Byte, int nBandCount=1, int * panBandMap=0x00d9e5b8, int nPixelSpaceBuf=1, int nLineSpaceBuf=400, int nBandSpaceBuf=0)  Line 339 + 0x34 bytes  C++
    gdal200.dll!GDALDataset::RasterIO(GDALRWFlag eRWFlag=GF_Read, int nXOff=0, int nYOff=0, int nXSize=400, int nYSize=300, void * pData=0x05be0068, int nBufXSize=400, int nBufYSize=300, GDALDataType eBufType=GDT_Byte, int nBandCount=1, int * panBandMap=0x00d9e5b8, int nPixelSpace=1, int nLineSpace=400, int nBandSpace=0)  Line 1774 + 0x45 bytes  C++
    gdal200.dll!GDALDatasetRasterIO(void * hDS=0x0461c998, GDALRWFlag eRWFlag=GF_Read, int nXOff=0, int nYOff=0, int nXSize=400, int nYSize=300, void * pData=0x05be0068, int nBufXSize=400, int nBufYSize=300, GDALDataType eBufType=GDT_Byte, int nBandCount=1, int * panBandMap=0x00d9e5b8, int nPixelSpace=0, int nLineSpace=0, int nBandSpace=0)  Line 1813    C++
    mapserver.dll!LoadGDALImages(void * hDS=0x0461c998, int * band_numbers=0x00d9e5b8, int band_count=1, layerObj * layer=0x04907ea0, int src_xoff=0, int src_yoff=0, int src_xsize=400, int src_ysize=300, unsigned char * pabyWholeBuffer=0x05be0068, int dst_xsize=400, int dst_ysize=300, int * pbHaveRGBNoData=0x00d9e594, int * pnNoData1=0x00d9e588, int * pnNoData2=0x00d9e57c, int * pnNoData3=0x00d9e570)  Line 1146 + 0x37 bytes C
    mapserver.dll!msDrawRasterLayerGDAL(mapObj * map=0x04900918, layerObj * layer=0x04907ea0, imageObj * image=0x04935250, rasterBufferObj * rb=0x0372dcd0, void * hDSVoid=0x0461c998)  Line 649 + 0x6b bytes   C
    mapserver.dll!msDrawRasterLayerLow(mapObj * map=0x04900918, layerObj * layer=0x04907ea0, imageObj * image=0x04935250, rasterBufferObj * rb=0x0372dcd0)  Line 780 + 0x1c bytes   C
    mapserver.dll!msDrawRasterLayerPlugin(mapObj * map=0x04900918, layerObj * layer=0x04907ea0, imageObj * image=0x04935250)  Line 1390 + 0x15 bytes    C
    mapserver.dll!msDrawRasterLayer(mapObj * map=0x04900918, layerObj * layer=0x04907ea0, imageObj * image=0x04935250)  Line 1430 + 0x11 bytes  C
    mapserver.dll!msDrawLayer(mapObj * map=0x04900918, layerObj * layer=0x04907ea0, imageObj * image=0x04935250)  Line 744 + 0x11 bytes C
    mapserver.dll!msDrawMap(mapObj * map=0x04900918, int querymap=0)  Line 351 + 0x11 bytes C
    mapserver.dll!msCGIDispatchImageRequest(mapservObj * mapserv=0x048ff2c0)  Line 1506 + 0xe bytes C
    mapserver.dll!msCGIDispatchRequest(mapservObj * mapserv=0x048ff2c0)  Line 1793 + 0x9 bytes  C
    mapserv.exe!main(int argc=3, char * * argv=0x03721348)  Line 275 + 0x9 bytes    C
    mapserv.exe!__tmainCRTStartup()  Line 586 + 0x19 bytes  C
    mapserv.exe!mainCRTStartup()  Line 403  C
    kernel32.dll!76c0d3c9()     
    [Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]  
    ntdll.dll!77a91603()    
    ntdll.dll!77a915d6()    
    gdal200.dll!swq_expr_node::Check(swq_field_list * poFieldList=0x0008000b, int bAllowFieldsInSecondaryTables=66048)  Line 237 + 0x7 bytes    C++

[jmckenna]

• additional comment: I don't believe any Windows build/user can make kerneldensity work without a crash. So any kerneldensity test case will cause a crash on Windows.

[jmckenna]

Thanks @rouault ! This fixes the issue in my test case. Closing ticket but more testing is needed on Windows for this new feature.