bugGNU Octave - Bugs: bug #53604, ASAN new-delete-type-mismatch...

 
 

bug #53604: ASAN new-delete-type-mismatch error after "close all"

Submitted by:  Pantxo Diribarne <pantxo>
Submitted on:  Tue 10 Apr 2018 01:30:37 PM UTC  
 
Category:  Plotting with OpenGL Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Regression
Status:  Invalid Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  4.3.90 Operating System:  GNU/Linux

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Fri 13 Apr 2018 03:46:55 PM UTC, comment #10: 

I think we can close this bug as an upstream issue with Qt that has since been fixed.

The long list of leaks is exactly what ASAN produces.  Almost all of them are tagged as "Indirect leaks" which means they may not be true leaks, and digging through each one to determine that would take eons.  The ones to really watch are the direct leaks, for which we have about 56B.

I'm intrigued about the possible heap-buffer-overflow.  Can you open a new bug report about that?  I suspect it is a bug in the driver nouveau_dri, but there is the possibility that somehow the offset that Octave is supplying is something crazy.

We could put an assert statement in the code temporarily to make sure that offset is in some reasonable range ([-5, +5]).

Rik <rik5>
Project Administrator
Fri 13 Apr 2018 05:54:40 AM UTC, comment #9: 

But there are other things that Address Sanitizer complains about.  Below is something OpenGL-related.  I notice that this is using nouveau_dri.so, and I've been having random errors building documentation figures on these KDE systems.  A dozen figures will build, then one fail...start again...a dozen will pass, then another fail...keep repeating and eventually all the documentation figures build successfully.  I suppose that the non-open Nvidia driver isn't being installed.  On Mint/Cinnamon I know my Nvidia driver is being used and there are no documentation issues.  I do see libasan.so at the start of the list.

octave:1> demo image
image example 1:
clf;
colormap (jet (21));
img = 1 ./ hilb (11);
x = y = -5:5;
subplot (2,2,1);
  h = image (x, y, img);
  ylabel ("limits = [-5.5, 5.5]");
  title ("image (x, y, img)");
subplot (2,2,2);
  h = image (-x, y, img);
  title ("image (-x, y, img)");
subplot (2,2,3);
  h = image (x, -y, img);
  title ("image (x, -y, img)");
  ylabel ("limits = [-5.5, 5.5]");
subplot (2,2,4);
  h = image (-x, -y, img);
  title ("image (-x, -y, img)");

octave:2> =================================================================
==3309==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000d406a8 at pc 0x7f656654a733 bp 0x7fff060b1cc0 sp 0x7fff060b1468
READ of size 200 at 0x611000d406a8 thread T0
    #0 0x7f656654a732  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732)
    #1 0x7f65226a8dbc  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5bddbc)
    #2 0x7f65226a9cfb  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5becfb)
    #3 0x7f65226a9e76  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5bee76)
    #4 0x7f65226b49fd  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5c99fd)
    #5 0x7f652234782e  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x25c82e)
    #6 0x7f652230c9d5  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x2219d5)
    #7 0x7f65222f0ddb  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x205ddb)
    #8 0x7f65223097a2  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x21e7a2)
    #9 0x7f65221b9234  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0xce234)
    #10 0x7f6564747feb in octave::opengl_renderer::set_polygon_offset(bool, float) ../octave/libinterp/corefcn/gl-render.cc:3932
    #11 0x7f656474fde8 in octave::opengl_renderer::draw_axes_planes(axes::properties const&) ../octave/libinterp/corefcn/gl-render.cc:1194
    #12 0x7f6564791374 in octave::opengl_renderer::draw_axes(axes::properties const&) ../octave/libinterp/corefcn/gl-render.cc:2125
    #13 0x7f656474afdd in octave::opengl_renderer::draw(graphics_object const&, bool) ../octave/libinterp/corefcn/gl-render.cc:647
    #14 0x7f65660c3a15 in octave::opengl_renderer::draw(Matrix const&, bool) ../octave/libinterp/corefcn/gl-render.h:60
    #15 0x7f656475e6bc in octave::opengl_renderer::draw_figure(figure::properties const&) ../octave/libinterp/corefcn/gl-render.cc:712
    #16 0x7f656474afdd in octave::opengl_renderer::draw(graphics_object const&, bool) ../octave/libinterp/corefcn/gl-render.cc:647
    #17 0x7f656601904a in QtHandles::GLCanvas::draw(octave_handle const&) ../octave/libgui/graphics/GLCanvas.cc:72
    #18 0x7f6565fcbdfb in QtHandles::Canvas::canvasPaintEvent() ../octave/libgui/graphics/Canvas.cc:304
    #19 0x7f655d53686c  (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1b386c)
    #20 0x7f655d516047 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x193047)
    #21 0x7f655d4d782b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15482b)
    #22 0x7f655d4df0f3 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15c0f3)
    #23 0x7f655c7595c7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28a5c7)
    #24 0x7f655d50f189 in QWidgetPrivate::sendPaintEvent(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x18c189)
    #25 0x7f655d4e6703  (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x163703)
    #26 0x7f655d4e7094  (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x164094)
    #27 0x7f655d4fe66e in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x17b66e)
    #28 0x7f655d5161b7 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1931b7)
    #29 0x7f655d629b6a in QMainWindow::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2a6b6a)
    #30 0x7f6565f63124 in QtHandles::FigureWindowBase::event(QEvent*) ../octave/libgui/graphics/FigureWindow.h:33
    #31 0x7f655d4d782b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15482b)
    #32 0x7f655d4df0f3 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15c0f3)
    #33 0x7f655c7595c7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28a5c7)
    #34 0x7f655c75bd3c in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28cd3c)
    #35 0x7f655c7b2eb2  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e3eb2)
    #36 0x7f65541b2286 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c286)
    #37 0x7f65541b24bf  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c4bf)
    #38 0x7f65541b254b in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c54b)
    #39 0x7f655c7b24de in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e34de)
    #40 0x7f655c757619 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x288619)
    #41 0x7f655c760663 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x291663)
    #42 0x7f6565dab253 in octave::gui_application::execute() ../octave/libgui/src/octave-gui.cc:202
    #43 0x562a27d7afa9 in main ../octave/src/main-gui.cc:104
    #44 0x7f655ee21b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #45 0x562a27d7b849 in _start (/home/sebald/octave/octave-53604/build1/src/.libs/octave-gui+0x2849)

0x611000d406a8 is located 0 bytes to the right of 232-byte region [0x611000d405c0,0x611000d406a8)
allocated by thread T0 here:
    #0 0x7f65665afd38 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded38)
    #1 0x7f65226a6032  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5bb032)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732)
Shadow bytes around the buggy address:
  0x0c22801a0080: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c22801a00a0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c22801a00b0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c22801a00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c22801a00d0: 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa
  0x0c22801a00e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a00f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3309==ABORTING

Dan Sebald <sebald>
Fri 13 Apr 2018 05:45:11 AM UTC, comment #8: 

OK, I'm compiling, configured with the option mentioned...

I noticed the following strange warning message during compilation:

  CXX      libgui/graphics/libgui_graphics_libgui_graphics_la-Container.lo
  CXX      libgui/graphics/libgui_graphics_libgui_graphics_la-ContextMenu.lo
In file included from ../octave/libgui/src/settings-dialog.cc:36:0:
libgui/src/ui-settings-dialog.h: In member function ‘void Ui_settings_dialog::setupUi(QDialog*)’:
libgui/src/ui-settings-dialog.h:351:10: note: variable tracking size limit exceeded with -fvar-tracking-assignments, retrying without
     void setupUi(QDialog *settings_dialog)
          ^~~~~~~
  CXX      libgui/graphics/libgui_graphics_libgui_graphics_la-EditControl.lo

Probably off topic, but I've had problems with settings, I think (just a guess).  Sometimes when working on the GUI and doing a build, the first launch after the build seems to take about 100% longer (which still isn't too long) and will crash once in a while.  I launch Octave again, and it's fine.

Wup...here's another one:

  CXX      libgui/src/libgui_src_libgui_src_la-documentation.lo
  CXX      libgui/src/libgui_src_libgui_src_la-external-editor-interface.lo
src/mkoctfile.cc: In function ‘int main(int, char**)’:
src/mkoctfile.cc:455:1: note: variable tracking size limit exceeded with -fvar-tracking-assignments, retrying without
main (int argc, char **argv)
^~~~
  CXX      libgui/src/libgui_src_libgui_src_la-files-dock-widget.lo
  CXX      libgui/src/libgui_src_libgui_src_la-history-dock-widget.lo

Here's one last one:

  CXXLD    libgui/src/libgui-src.la
  CXXLD    libgui/graphics/libgui-graphics.la
libinterp/build-env-features.cc: In function ‘octave_scalar_map octave::build_env::features()’:
libinterp/build-env-features.cc:15:5: note: variable tracking size limit exceeded with -fvar-tracking-assignments, retrying without
     features (void)
     ^~~~~~~~
  DVIPS    doc/liboctave/liboctave.ps
  CXXLD    libinterp/corefcn/libcorefcn.la

Wow, and then there is a big long screen full of entries like the following:

Indirect leak of 1 byte(s) in 1 object(s) allocated from:
    #0 0x7f2fd3960618 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe0618)
    #1 0x7f2fd11b12a4 in Array<double>::ArrayRep::ArrayRep(long) ../octave/liboctave/array/Array.h:158
    #2 0x7f2fd11b12a4 in Array<double>::Array(dim_vector const&) ../octave/liboctave/array/Array.h:264
    #3 0x7f2fd11b12a4 in MArray<double>::MArray(dim_vector const&) ../octave/liboctave/array/MArray.h:73
    #4 0x7f2fd11b12a4 in NDArray::NDArray(dim_vector const&) ../octave/liboctave/array/dNDArray.h:43
    #5 0x7f2fd11b12a4 in Matrix::Matrix(long, long) ../octave/liboctave/array/dMatrix.h:62
    #6 0x7f2fd11b12a4 in Range::Range() ../octave/liboctave/array/Range.h:40
    #7 0x7f2fd11b12a4 in octave_range::register_type(octave::type_info&) ../octave/libinterp/octave-value/ov-range.h:56
    #8 0x7f2fd128de60 in install_types(octave::type_info&) ../octave/libinterp/octave-value/ov.cc:2904
    #9 0x7f2fd123e7bd in octave::type_info::type_info(int) ../octave/libinterp/octave-value/ov-typeinfo.cc:80
    #10 0x7f2fd203f4cc in octave::interpreter::interpreter(octave::application*) ../octave/libinterp/corefcn/interpreter.cc:369
    #11 0x7f2fcff8a10f in octave::application::create_interpreter() ../octave/libinterp/octave.cc:314
    #12 0x7f2fd3125c03 in octave::octave_interpreter::execute() ../octave/libgui/src/main-window.cc:100
    #13 0x7f2fc9b37d11 in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b9d11)
    #14 0x7f2fca88682b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15482b)

And a summary:

SUMMARY: AddressSanitizer: 212272 byte(s) leaked in 3488 allocation(s).

OK, so running from the GUI things are fine:

>> plot (1:10)
>> close all
>>

Ah, well there is this super long delay at exit and then address sanitizer gives a long list similar to what I noted previously, then summarizes:

SUMMARY: AddressSanitizer: 4771115 byte(s) leaked in 64673 allocation(s).

So that list at build was probably from attempting to build the documentation figures via Octave.  (Which crashed on the first figure...which I assume is related to some of this.)

And running from CLI things look fine as well:

octave:1> plot (1:10)
octave:2> close all
octave:3>
octave:3> exit
[big delay]
[big data dump]
SUMMARY: AddressSanitizer: 212272 byte(s) leaked in 3488 allocation(s).

In summary, no crash for the example with Qt 5.9.x.

Dan Sebald <sebald>
Fri 13 Apr 2018 02:06:25 AM UTC, comment #7: 

Adding Dan to the CC list for this bug.  He recently installed a new version of KDE with Qt libraries that I think are at the 5.9 level.  He might be able to build with  --enable-address-sanitizer-flags and try your simple test code.

Rik <rik5>
Project Administrator
Wed 11 Apr 2018 05:01:20 PM UTC, comment #6: 

I'm running Qt5.6.1.  It is possible (likely?) that the bug was introduced in 5.7 and then fixed by the time 5.9 was released.

It does sound like this is an upstream bug, and I would be fine with closing it.

Rik <rik5>
Project Administrator
Wed 11 Apr 2018 10:55:52 AM UTC, comment #5: 

Maybe related to this upstream Qt bug:

https://groups.google.com/forum/#!topic/linux.debian.bugs.dist/fVAuz_I7kKg

@Rik: I am using exactly the same distribution as the user. Do you by any chance use Qt 5.9 in which the above bug is supposed to have been fixed?

Pantxo Diribarne <pantxo>
Project Member
Tue 10 Apr 2018 09:00:00 PM UTC, comment #4: 

>> Adding bug #53513 as a dependency since I'm pretty sure they are related.


That is also what I thought but I could check that reverting cset b6aea95a7bf9 does not fix bug #53513. Unfortunately I don't have debug symbols enabled and no time right now provide a backtrace.

Pantxo Diribarne <pantxo>
Project Member
Tue 10 Apr 2018 04:18:39 PM UTC, comment #3: 

I'm not getting the delete-type-mismatch error after compiling with --enable-address-sanitizer-flags.  But, I suspect this is very dependent on race conditions between the GUI thread and the Octave thread.

Rik <rik5>
Project Administrator
Tue 10 Apr 2018 04:15:21 PM UTC, comment #2: 

Adding bug #53513 as a dependency since I'm pretty sure they are related.

Rik <rik5>
Project Administrator
Tue 10 Apr 2018 03:56:25 PM UTC, comment #1: 

This is probably related to the reason that I needed to add a delay after delete() for the uicontextmenu BIST tests in order for them to pass.

I think the delete operation for graphic objects needs to be reviewed completely.

Rik <rik5>
Project Administrator
Tue 10 Apr 2018 01:30:37 PM UTC, original submission:  

The following makes Octave crash for me with the address sanitizer enabled:

plot (1:10)
close all
## crash
## SUMMARY: AddressSanitizer: new-delete-type-mismatch (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc37f0) in operator delete(void*, unsigned long)

Works OK with FLTK.

Pantxo Diribarne <pantxo>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Digest:
   bug dependencies.

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by sebald (Posted a comment)
  • -email is unavailable- added by rik5
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by pantxo (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-04-13 rik5 StatusNone => Invalid
        Open/ClosedOpen => Closed
    2018-04-13 rik5 Carbon-Copy- => Added sebald
    2018-04-10 rik5 Dependencies- => Depends on bugs #53513

    Back to the top


    Powered by Savane 3.5