bugGNU Octave - Bugs: bug #48519, Segfault with Qt plotting when...

 
 

bug #48519: Segfault with Qt plotting when running demos

Submitter:  Andreas Weber <andy1978>
Submitted:  Fri 15 Jul 2016 08:38:57 AM UTC
   
 
Category:  Plotting with OpenGL Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Fixed Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * dev Operating System:  * GNU/Linux
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 11 Jan 2019 11:27:48 PM UTC, comment #47: 

No complaints so far, I'm closing this report as fixed and crossing it out at https://wiki.octave.org/Bug_Fix_List_-_5.0_Release.

Rik <rik5>
Group administrator
Mon 07 Jan 2019 10:26:19 AM UTC, comment #46: 

Can someone take a look at bug #54187 for which I posted a patch? This is also a case of C++ callbacks causing a crash.

Pantxo Diribarne <pantxo>
Group Member
Sun 06 Jan 2019 10:52:07 PM UTC, comment #45: 

I have

  • compiled the latest stable Octave (hg-id bf835b1d04b1), including Pantox's patch and Markus's patch (both directly from the repo). Without any debug symbols this time.
  • I have run 'compare_plot_demos ("toolkits", "qt")' as before, with massivly clicking into the figure windows and moving them around with the mouse.
  • Doing this twice, I could never provoke any crash of Octave any more (before I could).


So this look much better! Thanks for those two patches.

Can anyone else (who observed those crashes before) confirm that this issue is now fully FIXED?

Hartmut <hardy>
Sun 06 Jan 2019 08:12:50 PM UTC, comment #44: 
Pantxo Diribarne <pantxo>
Group Member
Sun 06 Jan 2019 03:53:50 PM UTC, comment #43: 

Both bug #55400 and "demo lighting 5" now pass for me as well.

Rik <rik5>
Group administrator
Sun 06 Jan 2019 02:07:45 PM UTC, comment #42: 

Thanks again for testing.
I pushed the change to stable here:
http://hg.savannah.gnu.org/hgweb/octave/rev/dd40f9650821

I don't know whether this was the sole issue this report is about. So I'm leaving the status as is.

Markus Mützel <mmuetzel>
Group administrator
Sun 06 Jan 2019 01:57:04 PM UTC, comment #41: 

Yes, this patch (applied after bug 5540 patch) solved
"demo lighting 5" crash for me.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sun 06 Jan 2019 12:22:18 PM UTC, comment #40: 

I think I found the issue. The last line of the grid must use the same face normals like the second last line.

Could you please try whether you still see the error after applying the attached diff?

There is also an issue with how face normals are calculated if xdata or ydata are vectors. I hope I can push a patch for this shortly.

(file #45883)

Markus Mützel <mmuetzel>
Group administrator
Sun 06 Jan 2019 01:18:30 AM UTC, comment #39: 

If I compile w/o qt, I do not get this crash.

I do have a similar crash running
contour3(peaks(19))
See bug 55400 -- it might be completely different issue.

Dmitri.
--




Dmitri A. Sergatskov <dasergatskov>
Sat 05 Jan 2019 10:39:31 PM UTC, comment #38: 

Confirmed.  I can also reproduce with "demo lighting 5" on an unpatched Octave.  Simplest example now that segfaults is


clf;
mesh (sombrero ());
light ();


Order of execution is important.  This does not segfault.


clf;
light ();
mesh (sombrero ());



Rik <rik5>
Group administrator
Sat 05 Jan 2019 05:57:39 PM UTC, comment #37: 

FWIW i can reproduce Hartmut's results with


octave:1> demo lighting 5
lighting example 5:
 clf;
 colormap ("default");
 mesh (sombrero ());
 shading flat
 lighting flat
 light ();
 title ("shading flat - lighting flat");

=================================================================
==6512==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d00b661a00 at pc 0x7ff611edcdb8 bp 0x7ffc07e8b080 sp 0x7ffc07e8b070
READ of size 8 at 0x62d00b661a00 thread T0
    #0 0x7ff611edcdb7 in Array<double>::xelem(long) const ../liboctave/array/Array.h:459
    #1 0x7ff61271006d in Array<double>::xelem(long, long) const ../liboctave/array/Array.h:464
    #2 0x7ff612f9a555 in Array<double>::xelem(long, long, long) const ../liboctave/array/Array.h:469
    #3 0x7ff612f97ebd in Array<double>::elem(long, long, long) const ../liboctave/array/Array.h:524
    #4 0x7ff612f94d53 in Array<double>::operator()(long, long, long) const ../liboctave/array/Array.h:534
    #5 0x7ff612f7b786 in octave::opengl_renderer::set_normal(int, NDArray const&, int, int) ../libinterp/corefcn/gl-render.cc:4524
    #6 0x7ff612f60c21 in octave::opengl_renderer::draw_surface(surface::properties const&) ../libinterp/corefcn/gl-render.cc:2792
    #7 0x7ff612f3b679 in octave::opengl_renderer::draw(graphics_object const&, bool) ../libinterp/corefcn/gl-render.cc:667
    #8 0x7ff612f53ee3 in octave::opengl_renderer::draw_axes_children(axes::properties const&) ../libinterp/corefcn/gl-render.cc:2127
    #9 0x7ff612f55149 in octave::opengl_renderer::draw_axes(axes::properties const&) ../libinterp/corefcn/gl-render.cc:2215
    #10 0x7ff612f3b3ab in octave::opengl_renderer::draw(graphics_object const&, bool) ../libinterp/corefcn/gl-render.cc:663
    #11 0x7ff612f8f380 in octave::opengl_renderer::draw(Matrix const&, bool) ../libinterp/corefcn/gl-render.h:64
    #12 0x7ff612f3db7c in octave::opengl_renderer::draw_figure(figure::properties const&) ../libinterp/corefcn/gl-render.cc:727
    #13 0x7ff612f3b244 in octave::opengl_renderer::draw(graphics_object const&, bool) ../libinterp/corefcn/gl-render.cc:661
    #14 0x7ff5ee3668b9 in QtHandles::GLCanvas::draw(octave_handle const&) ../libgui/graphics/GLCanvas.cc:79
    #15 0x7ff5ee3343df in QtHandles::Canvas::canvasPaintEvent() ../libgui/graphics/Canvas.cc:304
<etc...>


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sat 05 Jan 2019 05:27:23 PM UTC, comment #36: 

Address sanitizer finds neumerous problem with octave (especially with qt and java enabled). So you should either disable docs (which invoces octave) or suppress this particular diagnostics with


ASAN_OPTIONS=stack-use-after-scope=0 make -j3


See e.g.:
https://github.com/google/sanitizers/wiki/AddressSanitizerFlags

for details.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sat 05 Jan 2019 05:12:08 PM UTC, comment #35: 

I don't see immediately why it fails in these lines.

I tried to replicate (with Pantxo's second patch on top of af7faef288ad). But compiling after:

make maintainer-clean
cd .build
../configure CPPFLAGS=-I/usr/include/hdf5/serial LDFLAGS="-L/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH)/hdf5/serial" FFLAGS=-g CFLAGS=-g CXXFLAGS=-g --enable-address-sanitizer-flags --disable-java
make -j3


Fails with:

  GEN      doc/interpreter/voronoi.txt
  GEN      doc/interpreter/triplot.txt
  GEN      doc/interpreter/griddata.txt
=================================================================
=================================================================
==99945==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fde1714e3d0 at pc 0x7fde3616a99e bp 0x7fde1714e0c0 sp 0x7fde1714e0b0
==99948==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fd68aa523d0 at pc 0x7fd6a9a6e99e bp 0x7fd68aa520c0 sp 0x7fd68aa520b0
WRITE of size 8 at 0x7fd68aa523d0 thread T7 (QThread)
WRITE of size 8 at 0x7fde1714e3d0 thread T7 (QThread)
=================================================================
==99946==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f4b5febf3d0 at pc 0x7f4b7eedb99e bp 0x7f4b5febf0c0 sp 0x7f4b5febf0b0
WRITE of size 8 at 0x7f4b5febf3d0 thread T7 (QThread)
    #0 0x7fde3616a99d in Array<octave_value>::Array(Array<octave_value> const&, dim_vector const&) ../liboctave/array/Array.cc:52
    #1 0x7fde3616f4b2 in Array<octave_value>::index(idx_vector const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x11374b2)
    #2 0x7fde36173041 in Array<octave_value>::index(idx_vector const&, bool, octave_value const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x113b041)
    #0 0x7fd6a9a6e99d in Array<octave_value>::Array(Array<octave_value> const&, dim_vector const&) ../liboctave/array/Array.cc:52
    #1 0x7fd6a9a734b2 in Array<octave_value>::index(idx_vector const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x11374b2)
    #2 0x7fd6a9a77041 in Array<octave_value>::index(idx_vector const&, bool, octave_value const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x113b041)
    #3 0x7fde36813f1c in Cell::index(octave_value_list const&, bool) const ../libinterp/corefcn/Cell.cc:176
    #3 0x7fd6aa117f1c in Cell::index(octave_value_list const&, bool) const ../libinterp/corefcn/Cell.cc:176
    #4 0x7fd6a9c22146 in octave_base_matrix<Cell>::do_index_op(octave_value_list const&, bool) ../libinterp/octave-value/ov-cell.cc:70
    #5 0x7fd6a9c23c5c in octave_cell::subsref(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, int) ../libinterp/octave-value/ov-cell.cc:160
    #4 0x7fde3631e146 in octave_base_matrix<Cell>::do_index_op(octave_value_list const&, bool) ../libinterp/octave-value/ov-cell.cc:70
    #5 0x7fde3631fc5c in octave_cell::subsref(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, int) ../libinterp/octave-value/ov-cell.cc:160
    #0 0x7f4b7eedb99d in Array<octave_value>::Array(Array<octave_value> const&, dim_vector const&) ../liboctave/array/Array.cc:52
    #1 0x7f4b7eee04b2 in Array<octave_value>::index(idx_vector const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x11374b2)
    #2 0x7f4b7eee4041 in Array<octave_value>::index(idx_vector const&, bool, octave_value const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x113b041)
    #3 0x7f4b7f584f1c in Cell::index(octave_value_list const&, bool) const ../libinterp/corefcn/Cell.cc:176
    #4 0x7f4b7f08f146 in octave_base_matrix<Cell>::do_index_op(octave_value_list const&, bool) ../libinterp/octave-value/ov-cell.cc:70
    #5 0x7f4b7f090c5c in octave_cell::subsref(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, int) ../libinterp/octave-value/ov-cell.cc:160
    #6 0x7fd6a9e8ba1f in octave_value::subsref(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, int) ../libinterp/octave-value/ov.cc:1424
    #6 0x7fde36587a1f in octave_value::subsref(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, int) ../libinterp/octave-value/ov.cc:1424
    #6 0x7f4b7f2f8a1f in octave_value::subsref(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, int) ../libinterp/octave-value/ov.cc:1424
    #7 0x7fd6aa09a40c in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2158
    #7 0x7fde3679640c in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2158
    #8 0x7fd6aa0d56c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #8 0x7fde367d16c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #7 0x7f4b7f50740c in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2158
    #9 0x7fd6a9cf009a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #10 0x7fd6aa0f00f4 in octave::tm_row_const::init(octave::tree_argument_list const&, octave::tree_evaluator&) ../libinterp/parse-tree/pt-tm-const.cc:168
    #11 0x7fd6aa0f7bd1 in octave::tm_row_const::tm_row_const(octave::tree_argument_list const&, octave::tree_evaluator&) ../libinterp/parse-tree/pt-tm-const.h:154
    #12 0x7fd6aa0f2c44 in octave::tm_const::init(octave::tree_matrix const&) ../libinterp/parse-tree/pt-tm-const.cc:308
    #13 0x7fd6aa0b40e8 in octave::tm_const::tm_const(octave::tree_matrix const&, octave::tree_evaluator&) (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x17780e8)
    #14 0x7fd6aa09b2d5 in octave::tree_evaluator::visit_matrix(octave::tree_matrix&) ../libinterp/parse-tree/pt-eval.cc:2226
    #15 0x7fd6aa0ddf54 in octave::tree_matrix::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-mat.h:70
    #16 0x7fd6a9cf009a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #17 0x7fd6aa0a06b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #9 0x7fde363ec09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #10 0x7fde367ec0f4 in octave::tm_row_const::init(octave::tree_argument_list const&, octave::tree_evaluator&) ../libinterp/parse-tree/pt-tm-const.cc:168
    #11 0x7fde367f3bd1 in octave::tm_row_const::tm_row_const(octave::tree_argument_list const&, octave::tree_evaluator&) ../libinterp/parse-tree/pt-tm-const.h:154
    #12 0x7fde367eec44 in octave::tm_const::init(octave::tree_matrix const&) ../libinterp/parse-tree/pt-tm-const.cc:308
    #13 0x7fde367b00e8 in octave::tm_const::tm_const(octave::tree_matrix const&, octave::tree_evaluator&) (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x17780e8)
    #14 0x7fde367972d5 in octave::tree_evaluator::visit_matrix(octave::tree_matrix&) ../libinterp/parse-tree/pt-eval.cc:2226
    #18 0x7fd6aa076c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #19 0x7fd6a9cf009a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #20 0x7fd6aa0a199f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #8 0x7f4b7f5426c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #15 0x7fde367d9f54 in octave::tree_matrix::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-mat.h:70
    #16 0x7fde363ec09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #17 0x7fde3679c6b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #21 0x7fd6aa0ed3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #22 0x7fd6aa0a207b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #18 0x7fde36772c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #19 0x7fde363ec09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #20 0x7fde3679d99f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #23 0x7fd6a9cf0cce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #24 0x7fd6aa098689 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #25 0x7fd6aa07ad80 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #26 0x7fd6aa09828f in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #9 0x7f4b7f15d09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #10 0x7f4b7f55d0f4 in octave::tm_row_const::init(octave::tree_argument_list const&, octave::tree_evaluator&) ../libinterp/parse-tree/pt-tm-const.cc:168
    #11 0x7f4b7f564bd1 in octave::tm_row_const::tm_row_const(octave::tree_argument_list const&, octave::tree_evaluator&) ../libinterp/parse-tree/pt-tm-const.h:154
    #12 0x7f4b7f55fc44 in octave::tm_const::init(octave::tree_matrix const&) ../libinterp/parse-tree/pt-tm-const.cc:308
    #21 0x7fde367e93c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #13 0x7f4b7f5210e8 in octave::tm_const::tm_const(octave::tree_matrix const&, octave::tree_evaluator&) (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x17780e8)
    #22 0x7fde3679e07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #14 0x7f4b7f5082d5 in octave::tree_evaluator::visit_matrix(octave::tree_matrix&) ../libinterp/parse-tree/pt-eval.cc:2226
    #27 0x7fd6aa0ea096 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #28 0x7fd6aa0a17ca in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #29 0x7fd6aa0ed3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #30 0x7fd6aa0a207b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #31 0x7fd6a9cf0cce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #32 0x7fd6aa096537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #15 0x7f4b7f54af54 in octave::tree_matrix::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-mat.h:70
    #16 0x7f4b7f15d09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #17 0x7f4b7f50d6b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #18 0x7f4b7f4e3c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #19 0x7f4b7f15d09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #20 0x7f4b7f50e99f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #23 0x7fde363eccce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #24 0x7fde36794689 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #25 0x7fde36776d80 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #26 0x7fde3679428f in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #33 0x7fd6a9e76857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #34 0x7fd6aa0994ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #35 0x7fd6aa0d56c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #36 0x7fd6a9cf009a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #37 0x7fd6aa0a06b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #38 0x7fd6aa076c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #39 0x7fd6a9cf009a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #40 0x7fd6aa0a199f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #41 0x7fd6aa0ed3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #42 0x7fd6aa0a207b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #43 0x7fd6a9cf0cce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #44 0x7fd6aa098689 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #45 0x7fd6aa07ad80 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #46 0x7fd6aa09828f in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #47 0x7fd6aa0ea096 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #48 0x7fd6aa0a17ca in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #49 0x7fd6aa0ed3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #50 0x7fd6aa0a207b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #51 0x7fd6a9cf0cce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #52 0x7fd6aa096537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #53 0x7fd6a9e76857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #54 0x7fd6aa0994ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #55 0x7fd6aa0d56c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #56 0x7fd6a9cf009a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #57 0x7fd6aa0a06b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #58 0x7fd6aa076c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #59 0x7fd6a9cf009a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #60 0x7fd6aa0a199f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #61 0x7fd6aa0ed3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #62 0x7fd6aa0a207b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #63 0x7fd6a9cf0cce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #64 0x7fd6aa096537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #65 0x7fd6a9e76857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #66 0x7fd6aa0994ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #67 0x7fd6aa0d56c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #68 0x7fd6aa0b2042 in octave::tree_evaluator::evaluate_n(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:343
    #69 0x7fd6aa088147 in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:242
    #27 0x7fde367e6096 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #28 0x7fde3679d7ca in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #29 0x7fde367e93c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #30 0x7fde3679e07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #31 0x7fde363eccce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #32 0x7fde36792537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #70 0x7fd6aa89b410 in octave::interpreter::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/corefcn/interpreter.cc:1137
    #71 0x7fd6aa896f37 in octave::interpreter::execute_eval_option_code() ../libinterp/corefcn/interpreter.cc:857
    #72 0x7fd6aa894ea5 in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:662
    #21 0x7f4b7f55a3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #22 0x7f4b7f50f07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #33 0x7fde36572857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #34 0x7fde367954ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #35 0x7fde367d16c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #36 0x7fde363ec09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #37 0x7fde3679c6b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #38 0x7fde36772c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #39 0x7fde363ec09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #40 0x7fde3679d99f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #41 0x7fde367e93c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #42 0x7fde3679e07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #43 0x7fde363eccce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #44 0x7fde36794689 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #45 0x7fde36776d80 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #46 0x7fde3679428f in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #47 0x7fde367e6096 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #48 0x7fde3679d7ca in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #49 0x7fde367e93c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #50 0x7fde3679e07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #51 0x7fde363eccce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #52 0x7fde36792537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #53 0x7fde36572857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #54 0x7fde367954ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #55 0x7fde367d16c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #56 0x7fde363ec09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #57 0x7fde3679c6b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #58 0x7fde36772c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #59 0x7fde363ec09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #60 0x7fde3679d99f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #61 0x7fde367e93c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #62 0x7fde3679e07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #63 0x7fde363eccce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #64 0x7fde36792537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #65 0x7fde36572857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #66 0x7fde367954ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #67 0x7fde367d16c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #68 0x7fde367ae042 in octave::tree_evaluator::evaluate_n(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:343
    #69 0x7fde36784147 in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:242
    #23 0x7f4b7f15dcce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #24 0x7f4b7f505689 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #25 0x7f4b7f4e7d80 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #26 0x7f4b7f50528f in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #27 0x7f4b7f557096 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #28 0x7f4b7f50e7ca in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #29 0x7f4b7f55a3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #30 0x7f4b7f50f07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #31 0x7f4b7f15dcce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #32 0x7f4b7f503537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #70 0x7fde36f97410 in octave::interpreter::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/corefcn/interpreter.cc:1137
    #71 0x7fde36f92f37 in octave::interpreter::execute_eval_option_code() ../libinterp/corefcn/interpreter.cc:857
    #72 0x7fde36f90ea5 in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:662
    #73 0x7fd6ab65f243 in octave::octave_interpreter::execute() ../libgui/src/main-window.cc:146
    #74 0x7fd6ab8366b3 in octave::octave_interpreter::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-main-window.cc:89
    #75 0x7fd6a58acf91 in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x294f91)
    #76 0x7fd6a62424a0 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15f4a0)
    #77 0x7fd6a6249adf in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x166adf)
    #78 0x7fd6ab68b2c3 in octave::octave_qapplication::notify(QObject*, QEvent*) ../libgui/src/main-window.cc:2783
    #79 0x7fd6a5883498 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26b498)
    #80 0x7fd6a588648a in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26e48a)
    #81 0x7fd6a58d5b22  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bdb22)
    #82 0x7fd6a02fac3d in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4dc3d)
    #83 0x7fd6a02faed7  (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4ded7)
    #84 0x7fd6a02faf6b in g_main_context_iteration (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4df6b)
    #85 0x7fd6a58d5142 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bd142)
    #86 0x7fd6a588216a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26a16a)
    #87 0x7fd6a56d10b5 in QThread::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xb90b5)
    #88 0x7fd6a56dac86  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xc2c86)
    #89 0x7fd6a6b6d163 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8163)
    #90 0x7fd6a6cb0dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11adee)

Address 0x7fd68aa523d0 is located in stack of thread T7 (QThread) at offset 432 in frame
    #0 0x7fd6a9a732e1 in Array<octave_value>::index(idx_vector const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x11372e1)

  This frame has 9 object(s):
    [32, 40) '<unknown>'
    [96, 104) 'result_dims'
    [160, 168) 'dv'
    [224, 232) '<unknown>'
    [288, 296) 'l'
    [352, 360) 'u'
    [416, 456) '<unknown>' <== Memory access at offset 432 is inside this variable
    [512, 552) '<unknown>'
    [608, 648) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
Thread T7 (QThread) created by T0 here:
    #0 0x7fd6abad7e5f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x4ae5f)
    #1 0x7fd6a56da609 in QThread::start(QThread::Priority) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xc2609)

SUMMARY: AddressSanitizer: stack-use-after-scope ../liboctave/array/Array.cc:52 in Array<octave_value>::Array(Array<octave_value> const&, dim_vector const&)
Shadow bytes around the buggy address:
  0x0ffb51542420: f1 f1 00 00 00 00 f2 f2 f2 f2 00 00 00 00 f3 f3
  0x0ffb51542430: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffb51542440: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2
  0x0ffb51542450: 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2
  0x0ffb51542460: 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2
=>0x0ffb51542470: 00 f2 f2 f2 f2 f2 f2 f2 00 00[f8]f8 00 f2 f2 f2
  0x0ffb51542480: f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2
  0x0ffb51542490: 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 00
  0x0ffb515424a0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x0ffb515424b0: 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2
  0x0ffb515424c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==99948==ABORTING
    #73 0x7fde37d5b243 in octave::octave_interpreter::execute() ../libgui/src/main-window.cc:146
    #33 0x7f4b7f2e3857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #34 0x7f4b7f5064ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #35 0x7f4b7f5426c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #36 0x7f4b7f15d09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #37 0x7f4b7f50d6b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #38 0x7f4b7f4e3c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #39 0x7f4b7f15d09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #40 0x7f4b7f50e99f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #41 0x7f4b7f55a3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #42 0x7f4b7f50f07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #43 0x7f4b7f15dcce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #44 0x7f4b7f505689 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #45 0x7f4b7f4e7d80 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #46 0x7f4b7f50528f in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #47 0x7f4b7f557096 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #48 0x7f4b7f50e7ca in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #49 0x7f4b7f55a3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #50 0x7f4b7f50f07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #51 0x7f4b7f15dcce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #52 0x7f4b7f503537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #53 0x7f4b7f2e3857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #54 0x7f4b7f5064ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #55 0x7f4b7f5426c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #56 0x7f4b7f15d09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #57 0x7f4b7f50d6b6 in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) ../libinterp/parse-tree/pt-eval.cc:2680
    #58 0x7f4b7f4e3c3a in octave::tree_simple_assignment::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-assign.h:84
    #59 0x7f4b7f15d09a in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #60 0x7f4b7f50e99f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #61 0x7f4b7f55a3c4 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #62 0x7f4b7f50f07b in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #63 0x7f4b7f15dcce in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #64 0x7f4b7f503537 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #65 0x7f4b7f2e3857 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #66 0x7f4b7f5064ab in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #67 0x7f4b7f5426c4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #68 0x7f4b7f51f042 in octave::tree_evaluator::evaluate_n(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:343
    #69 0x7f4b7f4f5147 in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:242
    #74 0x7fde37f326b3 in octave::octave_interpreter::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-main-window.cc:89
    #75 0x7fde31fa8f91 in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x294f91)
    #76 0x7fde3293e4a0 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15f4a0)
    #77 0x7fde32945adf in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x166adf)
    #78 0x7fde37d872c3 in octave::octave_qapplication::notify(QObject*, QEvent*) ../libgui/src/main-window.cc:2783
    #79 0x7fde31f7f498 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26b498)
    #80 0x7fde31f8248a in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26e48a)
    #81 0x7fde31fd1b22  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bdb22)
    #82 0x7fde2c9f6c3d in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4dc3d)
    #83 0x7fde2c9f6ed7  (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4ded7)
    #84 0x7fde2c9f6f6b in g_main_context_iteration (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4df6b)
    #85 0x7fde31fd1142 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bd142)
    #86 0x7fde31f7e16a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26a16a)
    #87 0x7fde31dcd0b5 in QThread::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xb90b5)
    #88 0x7fde31dd6c86  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xc2c86)
    #89 0x7fde33269163 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8163)
    #90 0x7fde333acdee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11adee)

Address 0x7fde1714e3d0 is located in stack of thread T7 (QThread) at offset 432 in frame
    #0 0x7fde3616f2e1 in Array<octave_value>::index(idx_vector const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x11372e1)

  This frame has 9 object(s):
    [32, 40) '<unknown>'
    [96, 104) 'result_dims'
    [160, 168) 'dv'
    [224, 232) '<unknown>'
    [288, 296) 'l'
    [352, 360) 'u'
    [416, 456) '<unknown>' <== Memory access at offset 432 is inside this variable
    [512, 552) '<unknown>'
    [608, 648) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
Thread T7 (QThread) created by T0 here:
    #0 0x7fde381d3e5f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x4ae5f)
    #1 0x7fde31dd6609 in QThread::start(QThread::Priority) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xc2609)

SUMMARY: AddressSanitizer: stack-use-after-scope ../liboctave/array/Array.cc:52 in Array<octave_value>::Array(Array<octave_value> const&, dim_vector const&)
Shadow bytes around the buggy address:
  0x0ffc42e21c20: f1 f1 00 00 00 00 f2 f2 f2 f2 00 00 00 00 f3 f3
  0x0ffc42e21c30: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ffc42e21c40: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2
  0x0ffc42e21c50: 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2
  0x0ffc42e21c60: 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2
=>0x0ffc42e21c70: 00 f2 f2 f2 f2 f2 f2 f2 00 00[f8]f8 00 f2 f2 f2
  0x0ffc42e21c80: f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2
  0x0ffc42e21c90: 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 00
  0x0ffc42e21ca0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x0ffc42e21cb0: 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2
  0x0ffc42e21cc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==99945==ABORTING
    #70 0x7f4b7fd08410 in octave::interpreter::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/corefcn/interpreter.cc:1137
    #71 0x7f4b7fd03f37 in octave::interpreter::execute_eval_option_code() ../libinterp/corefcn/interpreter.cc:857
    #72 0x7f4b7fd01ea5 in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:662
make[2]: *** [Makefile:30808: doc/interpreter/griddata.txt] Error 1
make[2]: *** Waiting for unfinished jobs....
    #73 0x7f4b80acc243 in octave::octave_interpreter::execute() ../libgui/src/main-window.cc:146
    #74 0x7f4b80ca36b3 in octave::octave_interpreter::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-main-window.cc:89
    #75 0x7f4b7ad19f91 in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x294f91)
    #76 0x7f4b7b6af4a0 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15f4a0)
    #77 0x7f4b7b6b6adf in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x166adf)
    #78 0x7f4b80af82c3 in octave::octave_qapplication::notify(QObject*, QEvent*) ../libgui/src/main-window.cc:2783
    #79 0x7f4b7acf0498 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26b498)
    #80 0x7f4b7acf348a in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26e48a)
    #81 0x7f4b7ad42b22  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bdb22)
    #82 0x7f4b75767c3d in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4dc3d)
make[2]: *** [Makefile:30804: doc/interpreter/voronoi.txt] Error 1
    #83 0x7f4b75767ed7  (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4ded7)
    #84 0x7f4b75767f6b in g_main_context_iteration (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4df6b)
    #85 0x7f4b7ad42142 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bd142)
    #86 0x7f4b7acef16a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x26a16a)
    #87 0x7f4b7ab3e0b5 in QThread::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xb90b5)
    #88 0x7f4b7ab47c86  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xc2c86)
    #89 0x7f4b7bfda163 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8163)
    #90 0x7f4b7c11ddee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11adee)

Address 0x7f4b5febf3d0 is located in stack of thread T7 (QThread) at offset 432 in frame
    #0 0x7f4b7eee02e1 in Array<octave_value>::index(idx_vector const&) const (/home/osboxes/Documents/Repositories/Octave/octave-stable/.build/libinterp/.libs/liboctinterp.so.6+0x11372e1)

  This frame has 9 object(s):
    [32, 40) '<unknown>'
    [96, 104) 'result_dims'
    [160, 168) 'dv'
    [224, 232) '<unknown>'
    [288, 296) 'l'
    [352, 360) 'u'
    [416, 456) '<unknown>' <== Memory access at offset 432 is inside this variable
    [512, 552) '<unknown>'
    [608, 648) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
Thread T7 (QThread) created by T0 here:
    #0 0x7f4b80f44e5f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x4ae5f)
    #1 0x7f4b7ab47609 in QThread::start(QThread::Priority) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xc2609)

SUMMARY: AddressSanitizer: stack-use-after-scope ../liboctave/array/Array.cc:52 in Array<octave_value>::Array(Array<octave_value> const&, dim_vector const&)
Shadow bytes around the buggy address:
  0x0fe9ebfcfe20: f1 f1 00 00 00 00 f2 f2 f2 f2 00 00 00 00 f3 f3
  0x0fe9ebfcfe30: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe9ebfcfe40: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2
  0x0fe9ebfcfe50: 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2
  0x0fe9ebfcfe60: 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2
=>0x0fe9ebfcfe70: 00 f2 f2 f2 f2 f2 f2 f2 00 00[f8]f8 00 f2 f2 f2
  0x0fe9ebfcfe80: f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2
  0x0fe9ebfcfe90: 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 00
  0x0fe9ebfcfea0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x0fe9ebfcfeb0: 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2
  0x0fe9ebfcfec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==99946==ABORTING
make[2]: *** [Makefile:30806: doc/interpreter/triplot.txt] Error 1
make[2]: Leaving directory '/home/osboxes/Documents/Repositories/Octave/octave-stable/.build'
make[1]: *** [Makefile:27048: all-recursive] Error 1
make[1]: Leaving directory '/home/osboxes/Documents/Repositories/Octave/octave-stable/.build'
make: *** [Makefile:10868: all] Error 2


Am I doing something wrong?
Is it necessary to compile with address-sanitizer-flags to reproduce?

@Hartmut: Does it always fail for you in octave::opengl_renderer::set_normal with the same (or a similar) backtrace like in your comment #33?
(For a backtrace just type "bt" at the gdb prompt.)

Markus Mützel <mmuetzel>
Group administrator
Sat 05 Jan 2019 02:45:46 PM UTC, comment #34: 

This is starting to look promising.  I added Markus to the CC list for the bug since he wrote the lighting and update_normals code.  It may be unrelated, but I would at least start there.

Rik <rik5>
Group administrator
Sat 05 Jan 2019 01:27:04 PM UTC, comment #33: 

I have (using gdb for the first time):

  • used Pantxo's second patch (from comment #32)
  • recompiled my Octave version (still hg id 31b0761cd641) with debug symbols (configure FFLAGS=-g CFLAGS=-g CXXFLAGS=-g --enable-address-sanitizer-flags) as explained in the wiki
  • run Octave without GUI (I couldn't interact with the Octave GUI after starting gdb any more): ./run-octave -g
  • gdb> run
  • octave> compare_plot_demos ("toolkits", "qt")
  • moved most of the figure windows around


This resultet in the following "last words" (which might not be a stack trace at all):

Printing "lighting_03.png" ... [0.920596 2.110584] done
Printing "lighting_04.png" ... [0.945274 2.411876] done
Printing "lighting_05.png" ... =================================================================
==7195==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d00053ba00 at pc 0x7ffff436d548 bp 0x7fffffff6500 sp 0x7fffffff64f0
READ of size 8 at 0x62d00053ba00 thread T0
    #0 0x7ffff436d547 in Array<double>::xelem(long) const liboctave/array/Array.h:459
    #1 0x7ffff4baac1d in Array<double>::xelem(long, long) const liboctave/array/Array.h:464
    #2 0x7ffff5438747 in Array<double>::xelem(long, long, long) const liboctave/array/Array.h:469
    #3 0x7ffff5436371 in Array<double>::elem(long, long, long) const liboctave/array/Array.h:524
    #4 0x7ffff54333c3 in Array<double>::operator()(long, long, long) const liboctave/array/Array.h:534
    #5 0x7ffff5418bf4 in octave::opengl_renderer::set_normal(int, NDArray const&, int, int) libinterp/corefcn/gl-render.cc:4514
    #6 0x7ffff53fe04d in octave::opengl_renderer::draw_surface(surface::properties const&) libinterp/corefcn/gl-render.cc:2792
    #7 0x7ffff53d82c4 in octave::opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:667
    #8 0x7ffff53f10c0 in octave::opengl_renderer::draw_axes_children(axes::properties const&) libinterp/corefcn/gl-render.cc:2127
    #9 0x7ffff53f2346 in octave::opengl_renderer::draw_axes(axes::properties const&) libinterp/corefcn/gl-render.cc:2215
    #10 0x7ffff53d7ff6 in octave::opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:663
    #11 0x7ffff542dab4 in octave::opengl_renderer::draw(Matrix const&, bool) libinterp/corefcn/gl-render.h:63
    #12 0x7ffff53da7f1 in octave::opengl_renderer::draw_figure(figure::properties const&) libinterp/corefcn/gl-render.cc:727
    #13 0x7ffff53d7e8f in octave::opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:661
    #14 0x7fffbfa0017d in QtHandles::GLCanvas::draw(octave_handle const&) libgui/graphics/GLCanvas.cc:79
    #15 0x7fffbf9cd93e in QtHandles::Canvas::canvasPaintEvent() libgui/graphics/Canvas.cc:304
    #16 0x7fffbfa02503 in QtHandles::GLCanvas::paintGL() libgui/graphics/GLCanvas.cc:218
    #17 0x7fffefb0a85c  (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1b385c)
    #18 0x7fffefaea037 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x193037)
    #19 0x7fffefaab82b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15482b)
    #20 0x7fffefab30f3 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15c0f3)
    #21 0x7ffff68255f9 in octave::octave_qapplication::notify(QObject*, QEvent*) libgui/src/main-window.cc:2783
    #22 0x7fffeed2d9a7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28a9a7)
    #23 0x7fffefae3189 in QWidgetPrivate::sendPaintEvent(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x18c189)
    #24 0x7fffefaba703  (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x163703)
    #25 0x7fffefabb094  (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x164094)
    #26 0x7fffefad266e in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x17b66e)
    #27 0x7fffefaea1a7 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1931a7)
    #28 0x7fffefbfdc4a in QMainWindow::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2a6c4a)
    #29 0x7fffbf9ff5d2 in QtHandles::FigureWindowBase::event(QEvent*) libgui/graphics/FigureWindow.h:33
    #30 0x7fffefaab82b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15482b)
    #31 0x7fffefab30f3 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15c0f3)
    #32 0x7ffff68255f9 in octave::octave_qapplication::notify(QObject*, QEvent*) libgui/src/main-window.cc:2783
    #33 0x7fffeed2d9a7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28a9a7)
    #34 0x7fffeed3011c in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28d11c)
    #35 0x7fffeed872c2  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e42c2)
    #36 0x7fffe7ae7386 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c386)
    #37 0x7fffe7ae75bf  (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c5bf)
    #38 0x7fffe7ae764b in g_main_context_iteration (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c64b)
    #39 0x7fffeed868ee in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e38ee)
    #40 0x7fffeed2b9e9 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2889e9)
    #41 0x7fffeed34a83 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x291a83)
    #42 0x7ffff6826f1a in octave::octave_qt_app::exec() libgui/src/main-window.cc:2921
    #43 0x7ffff6853647 in octave::gui_application::execute() libgui/src/octave-gui.cc:64
    #44 0x555555556670 in main src/main-gui.cc:103
    #45 0x7ffff13f5b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #46 0x555555555e29 in _start (/home/hartmut-nobackup/octave-repo/src/.libs/octave-gui+0x1e29)

0x62d00053ba00 is located 0 bytes to the right of 38400-byte region [0x62d000532400,0x62d00053ba00)
allocated by thread T8 (QThread) here:
    #0 0x7ffff6efa618 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe0618)
    #1 0x7ffff436b55a in Array<double>::ArrayRep::ArrayRep(long) liboctave/array/Array.h:158
    #2 0x7ffff46a8ce7 in Array<double>::Array(dim_vector const&, double const&) liboctave/array/Array.h:273
    #3 0x7ffff46a8c28 in MArray<double>::MArray(dim_vector const&, double const&) liboctave/array/MArray.h:76
    #4 0x7ffff46a8a0b in NDArray::NDArray(dim_vector const&, double) liboctave/array/dNDArray.h:46
    #5 0x7ffff5702a6f in surface::properties::update_face_normals(bool, bool) libinterp/corefcn/graphics.cc:9871
    #6 0x7ffff5798243 in surface::properties::update_normals(bool, bool) libinterp/corefcn/graphics.h:10259
    #7 0x7ffff56ef774 in axes::properties::trigger_normals_calc() libinterp/corefcn/graphics.cc:9026
    #8 0x7ffff56f792e in light::initialize(graphics_object const&) libinterp/corefcn/graphics.cc:9297
    #9 0x7ffff575a333 in graphics_object::initialize() libinterp/corefcn/graphics.h:3093
    #10 0x7ffff547be5c in xinitialize libinterp/corefcn/graphics.cc:3057
    #11 0x7ffff5731426 in make_graphics_object libinterp/corefcn/graphics.cc:12545
    #12 0x7ffff57350be in F__go_light__(octave_value_list const&, int) libinterp/corefcn/graphics.cc:12760
    #13 0x7ffff4bb466f in octave_builtin::call(octave::tree_evaluator&, int, octave_value_list const&) libinterp/octave-value/ov-builtin.cc:65
    #14 0x7ffff50508df in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) libinterp/parse-tree/pt-eval.cc:2007
    #15 0x7ffff508b60e in octave::tree_index_expression::accept(octave::tree_walker&) libinterp/parse-tree/pt-idx.h:102
    #16 0x7ffff4c8861d in octave::tree_evaluator::evaluate(octave::tree_expression*, int) libinterp/parse-tree/pt-eval.h:312
    #17 0x7ffff505795e in octave::tree_evaluator::visit_simple_assignment(octave::tree_simple_assignment&) libinterp/parse-tree/pt-eval.cc:2680
    #18 0x7ffff502ee7e in octave::tree_simple_assignment::accept(octave::tree_walker&) libinterp/parse-tree/pt-assign.h:84
    #19 0x7ffff4c8861d in octave::tree_evaluator::evaluate(octave::tree_expression*, int) libinterp/parse-tree/pt-eval.h:312
    #20 0x7ffff5058c47 in octave::tree_evaluator::visit_statement(octave::tree_statement&) libinterp/parse-tree/pt-eval.cc:2775
    #21 0x7ffff50a1d56 in octave::tree_statement::accept(octave::tree_walker&) libinterp/parse-tree/pt-stmt.h:119
    #22 0x7ffff505931f in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) libinterp/parse-tree/pt-eval.cc:2844
    #23 0x7ffff4c891fc in octave::tree_statement_list::accept(octave::tree_walker&) libinterp/parse-tree/pt-stmt.h:194
    #24 0x7ffff504da49 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) libinterp/parse-tree/pt-eval.cc:1694
    #25 0x7ffff4e34a41 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) libinterp/octave-value/ov-usr-fcn.cc:455
    #26 0x7ffff50508df in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) libinterp/parse-tree/pt-eval.cc:2007
    #27 0x7ffff508b60e in octave::tree_index_expression::accept(octave::tree_walker&) libinterp/parse-tree/pt-idx.h:102
    #28 0x7ffff4c8861d in octave::tree_evaluator::evaluate(octave::tree_expression*, int) libinterp/parse-tree/pt-eval.h:312
    #29 0x7ffff5058c47 in octave::tree_evaluator::visit_statement(octave::tree_statement&) libinterp/parse-tree/pt-eval.cc:2775

Thread T8 (QThread) created by T0 here:
    #0 0x7ffff6e51d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
    #1 0x7fffeeb4e665 in QThread::start(QThread::Priority) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xab665)

SUMMARY: AddressSanitizer: heap-buffer-overflow liboctave/array/Array.h:459 in Array<double>::xelem(long) const
Shadow bytes around the buggy address:
  0x0c5a8009f6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a8009f700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a8009f710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a8009f720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a8009f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c5a8009f740:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a8009f750: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a8009f760: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a8009f770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a8009f780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a8009f790: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==7195==ABORTING
[Thread 0x7fffafa0a700 (LWP 7303) exited]
[Thread 0x7fffaf1f3700 (LWP 7304) exited]
[Thread 0x7fffb0219700 (LWP 7302) exited]
[Thread 0x7fffc241c700 (LWP 7223) exited]
[Thread 0x7fffc2fb1700 (LWP 7220) exited]
[Thread 0x7fffc382b700 (LWP 7218) exited]
[Thread 0x7fffc52c2700 (LWP 7217) exited]
[Thread 0x7fffc5ac3700 (LWP 7216) exited]
[Thread 0x7fffd4bfd700 (LWP 7214) exited]
[Thread 0x7fffd73fe700 (LWP 7213) exited]
[Thread 0x7fffd7bff700 (LWP 7212) exited]
[Thread 0x7ffff7f68940 (LWP 7195) exited]
[Inferior 1 (process 7195) exited with code 01]
(gdb) where
No stack.
(gdb)


Sorry if this is not too helpful. But this is probably as far as I can get with gdb. Currently I don't have the time to dig further into this topic (i.e. using gdb to produce stack traces), and I couldn't find a simple (and working) description how to do this.

Hartmut <hardy>
Fri 04 Jan 2019 07:40:48 AM UTC, comment #32: 

I attached an updated version of the patch (that simply removes unused functions).

(file #45862)

Pantxo Diribarne <pantxo>
Group Member
Fri 04 Jan 2019 07:38:42 AM UTC, comment #31: 

@Harmut: Thanks for testing. I can't reproduce the second crash and without debug info then it is hard to guess its origin. Do you have debug symbols enabled? If so, can you attach a backtrace?
As for bug #55028, yes it should fix it since the offending callback (Figure::updateBoundingBoxHelper) is not used anymore.

Pantxo Diribarne <pantxo>
Group Member
Thu 03 Jan 2019 10:51:05 PM UTC, comment #30: 

I have compiled a current dev version of Octave (hg id 31b0761cd641) with Pantxo's "no callback" patch from comment #29. When I then massivly move the figure windows around during the running of the compare_plot_demos.m script, then I canNOT produce any crash during this plotting, any more. So this patch definitly improves something.

I have tried this twice, and both times Octave still crashed:

  • After my first try, Octave crashed with "signal 11" immediatelly AFTER the script was finished (it only shortly displayed the Octave prompt in the Octave GUI).
  • During my second try, I could make a screenshot of the last "words" on the Octave console, they were:


Printing "ocean_01.png" ... [0.332105 0.278287] done
corrupted double-linked list
fatal: caught signal |

(the last message was really truncated on my screen, when Octave became unresponsive, an empty figure windows was still open)

Those might be a different "kinds" of crashes, but they are still a crash :(

Does this patch improve bug #55028 (mentioned in comment #27) by the way?

Hartmut <hardy>
Wed 02 Jan 2019 04:46:39 PM UTC, comment #29: 

With those additional information, I can reproduce the crash. The issue is that we are passing Figure objects member functions as callbacks to be executed in the interpreter event queue. At the time the callback is executed, the Figure object may not exist anymore, hence the crash. Note that this is in fact the same origin as bug #54187.

I attached a preliminary cset (complicated I admit) that avoids passing such dangerous callback, and fixes the issue for me. It does not fix bug #54187.

(file #45844)

Pantxo Diribarne <pantxo>
Group Member
Tue 01 Jan 2019 04:04:19 PM UTC, comment #28: 

(as a reply to comment #22 and comment #23:)
I have tried some more times to reproduce this crahs of Octave. Here are my observations:

  • When I don't touch my PC during the running compare_plot_demos.m script, then I do NOT get any crash. (This fits to the observation of Pantxo in comment #22.)
  • When I move the popping up figure windows around with my mouse once in a while (because I try to read some news page in my browser meanwhile), then I still DO get this crash. (This fits to the observations of Andreas in comment #25.)
  • When I set LIBGL_ALWAYS_SOFTWARE (as suggested by Dmitri in comment #23), and move some figure windows around, then I still DO get those crashes. So this LIBGL_ALWAYS_SOFTWARE does NOT change the behavior for me.


Note: I am using Qt version 5.9.5 for this (in Octave 5.0.xxx). So my Qt version is new enough and it should not still have the Qt bug mentioned in comment #26. (The Qt webpage claims to have fixed this in 5.9.4)

Hartmut <hardy>
Sun 30 Dec 2018 08:44:50 PM UTC, comment #27: 

See also bug #55028 where Michael Godfrey reports the same segfault.

Andreas Weber <andy1978>
Group Member
Sun 30 Dec 2018 05:12:04 PM UTC, comment #26: 
Andreas Weber <andy1978>
Group Member
Sun 30 Dec 2018 04:36:20 PM UTC, comment #25: 

Meanwhile I'm able to trigger this within seconds moving the window by hand or per xdotool.

file doit.m

more off
for k=1:10
  plot (1:10);
  print ('-dpng', 'out.png');
  system ('xdotool search "Figure 1" windowmove 50 150');
  close ('all');
endfor


And I call it with

gdb --args octave -f doit.m


Andreas Weber <andy1978>
Group Member
Sun 30 Dec 2018 03:29:25 PM UTC, comment #24: 

I'm able to reproduce this with a current build of stable with a stripped dump_plot_demos.m (see attachments)

It can take up to 30mins until I see the segfault:

Printing "waterfall_01.png" ...
Thread 16 "QThread" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffb6560700 (LWP 18240)]
0x00007ffff32800f3 in QMetaObject::activate(QObject*, int, int, void**) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
(gdb) bt
#0  0x00007ffff32800f3 in QMetaObject::activate(QObject*, int, int, void**) ()
   from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#1  0x00007fffb47925d2 in QtHandles::Figure::updateBoundingBoxHelper (data=0x55555659af30)
    at ../octave-src/libgui/graphics/Figure.cc:634


see backtrace.log for full backtrace but without debugging symbols. I'll du a debug build next

(file #45790, file #45791)

Andreas Weber <andy1978>
Group Member
Wed 26 Dec 2018 07:03:00 PM UTC, comment #23: 

Also a usual suggestion to set software renderer

LIBGL_ALWAYS_SOFTWARE=1 octave

etc...

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Wed 26 Dec 2018 11:25:18 AM UTC, comment #22: 

@hardy: I can't reproduce, all files are properly created. To be honest my desktop environment becomes unusable during the process (figure widgets keep popping up and taking the focus over any other window in my OS). Can you add some more comments on the crash you are seeing: is there a specific demo on which the crash happens or does it crash randomly? Can you paste here typical error messages (the "malloc" one for example)? Can you try to run the attached modified script (images are then printed using a single invisible figure)?



(file #45741)

Pantxo Diribarne <pantxo>
Group Member
Sun 23 Dec 2018 07:28:08 PM UTC, comment #21: 

I STILL see this crash with Octave 5.0.1 (hg-id 9644c0b7efd8), self compiled on Ubuntu 18.04, when running 'compare_plot_demos ("toolkits", "qt")' from the scripts/testfun/private dir".

I've seen different ways of crashing:

  • Some lines of error messages, including "malloc" on the Octave console, freezing Octave. And "octave exited with signal 9" on the linux console.
  • A full crash of Octave, the GUI dissappearing. And "octave exited with signal 11" on the linux console.


Conclusion: This bug is still alive :(

Hartmut <hardy>
Sun 23 Dec 2018 04:15:21 PM UTC, comment #20: 

@Hartmut: See comment #0, "compare_plot_demos ("toolkits", "qt")' from the scripts/testfun/private dir".

Try this


testdir = fileparts (which ("rundemos.m"))
addpath (fullfile (testdir, "private"))
compare_plot_demos ("qt")


To run it


rm *.png
./run-octave -f dump_plot_demos.m



Rik <rik5>
Group administrator
Sat 22 Dec 2018 10:03:02 PM UTC, comment #19: 

Where can I find the "run_plot_demo" scripts today, in order to try reproducing this behavior?

Hartmut <hardy>
Thu 19 Jan 2017 05:37:31 AM UTC, comment #18: 

change report status to "In Progress", according to comment #17

Avinoam Kalma <avinoam>
Group Member
Wed 21 Sep 2016 12:44:33 AM UTC, comment #17: 

I am still getting crashes on machines with with NVidia and AMD cards (as of 4.2.0-rc2). Crashes are intermittent but it looks like the situation gets worse if I LD_PRELOAD multithreaded openblas library. At least once instead of crash octave hanged on
ghostscript making zoom1.png (I killed it after ~20 minutes).

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 22 Aug 2016 09:46:44 PM UTC, comment #16: 

So I changed dump_plot_demos_2.m so it save hold_06.eps instead of png. No crash but file is corrupted (attached).

Dmitri.
--


(file #38322)

Dmitri A. Sergatskov <dasergatskov>
Mon 22 Aug 2016 09:39:22 PM UTC, comment #15: 

With changeset:   22361:a12f11e20c75
I have crashes on computers with AMD and NVIDIA cards
(no crash on i7 with intel graphics).
After applying lachlan's patch still crash on nvidia (I have not tried others):


....
--nostringval--
Dictionary stack:
   --dict:1194/1684(ro)(G)--   --dict:0/20(G)--   --dict:83/200(L)--   --dict:39/64(L)--
Current allocation mode is local
Last OS error: Not a directory
GPL Ghostscript 9.16: Unrecoverable error, exit code 1
warning: broken pipe
terminate called after throwing an instance of 'octave::execution_exception'
panic: Aborted -- stopping myself...
Aborted (core dumped)

The crash is due to ghostscript. It looks like it gets a corrupted input file from gl2ps.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 22 Aug 2016 05:15:19 PM UTC, comment #14: 

@Dmitri: Does the crash go away if you apply Lachlan's original fix in file 37907?

Rik <rik5>
Group administrator
Mon 22 Aug 2016 05:04:38 PM UTC, comment #13: 

The crash has gone away for me after Andy pushed the second fix mentioned in comment #11.  But, there is clearly still an instability that depend on exact hardware and software versions.

Rik <rik5>
Group administrator
Sun 21 Aug 2016 05:09:30 AM UTC, comment #12: 

I still get crash running dump_plot_demos_2:


Printing "hold_05.png" ... [0.112316 0.513765] done
Printing "hold_06.png" ... Error: /undefined in -nan
Operand stack:
   --nostringval--   74.8709   119.654   0.164833   0.46813   0.558143   86.2677   401.882   0   0   -5.33243e-35   83.9993   401.882
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1967   1   3   %oparray_pop   1966   1   3   %oparray_pop   --nostringval--   1950   1   3   %oparray_pop   1836   1   3   %oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--
Dictionary stack:
   --dict:1194/1684(ro)(G)--   --dict:0/20(G)--   --dict:83/200(L)--   --dict:39/64(L)--
Current allocation mode is local
Last OS error: Not a directory
GPL Ghostscript 9.16: Unrecoverable error, exit code 1
warning: broken pipe
terminate called after throwing an instance of 'octave::execution_exception'
panic: Aborted -- stopping myself...
Aborted (core dumped)


At least once it froze at the same hold_06 demo instead of a crash. It is not 100% reproducible: if I restart after the crash it tends to go through and finish the script, but if I delete all hold_*.png files and restart it crashes at hold_06
with fairly high reproducibility.

changeset:   22348:9deb86bb5632

Dmitri.

Dmitri A. Sergatskov <dasergatskov>
Sat 20 Aug 2016 07:06:21 AM UTC, comment #11: 

I've pushed http://hg.savannah.gnu.org/hgweb/octave/rev/2e49ab3d6b48 which should prevent the segfault (but of course doesn't solve the timing problems in the first place)

Andreas Weber <andy1978>
Group Member
Wed 17 Aug 2016 10:39:53 PM UTC, comment #10: 

What if you change in ObjectProxy.cc

void
ObjectProxy::update (int pId)
{
  if (m_object)
    {
      if (octave_thread::is_octave_thread ())
        emit sendUpdate (pId);
      else
        m_object->slotUpdate (pId);
    }
}


but I think this is also only a workaround. ObjectProxy::update shouldn't be called before a valid object is set, right?

Andreas Weber <andy1978>
Group Member
Wed 17 Aug 2016 04:44:15 PM UTC, comment #9: 

Unfortunately, this still crashes for me as well.


parent: 22330:53e246fd8124 tip
 doc: Spellcheck documentation ahead of 4.2 release.
branch: default


It is fairly repeatable in stopping at axis demo #3.  This is a demo that contains 9 subplots so there is going to be a lot of work by the graphics system as it initially places the 9 subplots and then adjusts the positioning slightly as titles are added.

Steps to reproduce


rm *.png
./run-octave -f dump_plot_demos.m


I experimented with adding back in the small delay in graphics.cc that allows for the print routine to grab the mutex on the graphics object.  The value that was there before was .05 (50 milliseconds).  That definitely helped, but it is not a cure.  I experimented with delays up to 1 second, but I still occasionally get segfaults.

Rik <rik5>
Group administrator
Wed 17 Aug 2016 08:17:08 AM UTC, comment #8: 

It still crashes for me as of

changeset:   22326:71dd9d5a5ecd
bookmark:    @
tag:         tip
user:        John W. Eaton <jwe@octave.org>
date:        Wed Aug 17 02:57:50 2016 -0400
summary:     move more new classes inside octave namespace

Dmitri.

Dmitri A. Sergatskov <dasergatskov>
Wed 17 Aug 2016 06:04:48 AM UTC, comment #7: 

Pantxo's fix from #44463
http://hg.savannah.gnu.org/hgweb/octave/rev/fc127f0e1ccd

Fixes the segfault for me.

@Dmitri: can you confirm it's fixed on fc127f0e1ccd?

Andreas Weber <andy1978>
Group Member
Wed 17 Aug 2016 12:06:12 AM UTC, comment #6: 

I used Andreas Weber

http://josoansi.de/dump_plot_demos_1.m
http://josoansi.de/dump_plot_demos_2.m

and they both coredump of two computers I tried.
Then I modify the scripts by adding 1 sec delay
in front of every tic ();
After that I was able to finish both scripts on
both computers w/o obvious problems.

Looks like some race condition on GL buffer?

Dmitri.

Dmitri A. Sergatskov <dasergatskov>
Tue 16 Aug 2016 08:55:57 PM UTC, comment #5: 

Marking as confirmed.  I used 'dump_demos' to create 'dump_plot_demos.m'.  I then ran


./run-octave -f dump_plot_demos.m


The dump_plot_demos script really stresses the graphics system and quickly led to segfaults.  It could be software versions.  I'm using Qt5.4.  I'll try the ObjectProxy fix from Lachlan later.

Rik <rik5>
Group administrator
Fri 29 Jul 2016 01:07:43 PM UTC, comment #4: 

Still present with 8971508e21c8
(I was hoping that e68128601f5e solved this)
@Pantxo: Sorry: forgot to test your patch, I'll do it soon

Andreas Weber <andy1978>
Group Member
Sun 17 Jul 2016 04:35:17 PM UTC, comment #3: 

I can't reproduce the bug either but it may have to do with bug #44463, for which the current workaround may not always work. You may want to try the last patch I attached there, I think it is more robust than the current workaround.

Pantxo Diribarne <pantxo>
Group Member
Sun 17 Jul 2016 12:09:50 PM UTC, comment #2: 

Hi Lachlan. Your patch clearly avoids the segfault but it looks to me like a workaround for a deeper problem.

The problem is triggered if the previous parameters are restored after "print". I've added some debug output to stdout


diff -r 3f8ed6d7cb1c libgui/graphics/ObjectProxy.cc
--- a/libgui/graphics/ObjectProxy.cc    Sat Jul 16 17:49:30 2016 +0200
+++ b/libgui/graphics/ObjectProxy.cc    Sun Jul 17 14:06:02 2016 +0200
@@ -43,6 +43,7 @@
 void
 ObjectProxy::init (Object* obj)
 {
+  std::cout << "ObjectProxy::init obj=" << obj << " m_object=" << m_object << std::endl;
   if (obj != m_object)
     {
       if (m_object)
@@ -83,6 +84,8 @@
 void
 ObjectProxy::update (int pId)
 {
+  std::cout << "ObjectProxy::update pId=" << pId << " m_object=" << m_object << std::endl;
+
   if (octave_thread::is_octave_thread ())
     emit sendUpdate (pId);
   else


which gives before the segfault:


ObjectProxy::init obj=0 m_object=0
ObjectProxy::update pId=2053 m_object=0
ObjectProxy::update pId=2055 m_object=0
ObjectProxy::update pId=2056 m_object=0
ObjectProxy::update pId=2005 m_object=0
ObjectProxy::init obj=0x25a3c60 m_object=0
ObjectProxy::update pId=2046 m_object=0x25a3c60
ObjectProxy::update pId=2047 m_object=0x25a3c60
ObjectProxy::update pId=2048 m_object=0x25a3c60
ObjectProxy::update pId=2049 m_object=0x25a3c60
Printing "axis_08.png" ... ObjectProxy::update pId=2030 m_object=0x25a3c60
ObjectProxy::update pId=2030 m_object=0x25a3c60
[0.295166 0.556593] done
ObjectProxy::update pId=0 m_object=0x25a3c60
ObjectProxy::init obj=0 m_object=0x25a3c60
ObjectProxy::init obj=0 m_object=0
ObjectProxy::update pId=2053 m_object=0
ObjectProxy::update pId=2055 m_object=0
ObjectProxy::update pId=2056 m_object=0
ObjectProxy::update pId=2046 m_object=0


I'm doubt it's in intended that ObjectProxy::init ist called with both obj=0 and m_object=0. This whole QtHandles backend is a unfathomable beast for me...

Andreas Weber <andy1978>
Group Member
Sat 16 Jul 2016 03:19:36 AM UTC, comment #1: 

I've tried to reproduce this, and don't seem to be able to.

Thanks for providing a stack trace.  That really helps.  You can see that slotUpdate is being called on a NULL object.  That means the bug must be in QtHandles::ObjectProxy::update or earlier.  It seems that ObjectProxy::init is not being called to set  m_object.

Can you see if the attached changeset makes a difference?


There are several Qt bugs that are system dependent. One thing you could do to debug it is to look for the other problems with Qt and see if your system reproduces any of them.

(My guess is that this is different, because those crashes were often in the OpenGL drivers and this in in Octave code, but it is something to try.)

(file #37907)

Lachlan Andrew <lachlan>
Fri 15 Jul 2016 08:38:57 AM UTC, original submission:  

hg id c8abb2ba4017

This bug is not deterministic and happened with "demo axis", "demo pbaspect" and "demo light"(see below). Perhaps it's some race condition which happens if you make a lot plots in a sequence. In my case I've used 'compare_plot_demos ("toolkits", "qt")' from the scripts/testfun/private dir which basically makes "demo xyz, print demo xyz2, print..."


start octave, getpid, attach gdb

[New Thread 0x7f333c43f700 (LWP 17310)]

Program received signal SIGSEGV, Segmentation fault.
0x00007f336548e2e8 in octave_handle::ok (this=0x10)
    at ../octave-src/libinterp/corefcn/oct-handle.h:109
109          bool ok (void) const { return ! octave::math::isnan (val); }
(gdb) bt
#0  0x00007f336548e2e8 in octave_handle::ok (this=0x10)
    at ../octave-src/libinterp/corefcn/oct-handle.h:109
#1  0x00007f336548f1dc in gh_manager::do_get_object (this=0x172d5b0, h=...)
    at libinterp/corefcn/graphics.h:14014
#2  0x00007f336548efbb in gh_manager::get_object (h=...) at libinterp/corefcn/graphics.h:13776
#3  0x00007f33654c06dd in QtHandles::Object::object (this=0x0)
    at ../octave-src/libgui/graphics/Object.cc:82
#4  0x00007f33654c0768 in QtHandles::Object::slotUpdate (this=0x0, pId=2046)
    at ../octave-src/libgui/graphics/Object.cc:100
#5  0x00007f33654c1f88 in QtHandles::ObjectProxy::update (this=0x7f3341cea950, pId=2046)
    at ../octave-src/libgui/graphics/ObjectProxy.cc:89
#6  0x00007f336549b0e5 in QtHandles::Backend::update (this=0x7f33406b65c0, go=..., pId=2046)
    at ../octave-src/libgui/graphics/Backend.cc:148
#7  0x00007f3364b16f6f in graphics_toolkit::update (this=0x7ffc9045e7d0, go=..., id=2046)
    at libinterp/corefcn/graphics.h:2216
#8  0x00007f3364b19806 in base_graphics_object::update (this=0x7f334255c5a0, go=..., id=2046)
    at libinterp/corefcn/graphics.h:3118
#9  0x00007f3364b1a205 in graphics_object::update (this=0x7ffc9045e840, id=2046)
    at libinterp/corefcn/graphics.h:3362
#10 0x00007f33649ec66c in base_property::set (this=0x7f334255e9e8, v=..., do_run=true,
    do_notify_toolkit=true) at ../octave-src/libinterp/corefcn/graphics.cc:1147
#11 0x00007f33649d8871 in figure::properties::set___gl_extensions__ (this=0x7f334255c5b0, val=...)
    at libinterp/corefcn/graphics.h:4581
#12 0x00007f33649c25a9 in opengl_renderer::draw_figure (this=0x7ffc9045eb40, props=...)
    at ../octave-src/libinterp/corefcn/gl-render.cc:691
#13 0x00007f33649c15d9 in opengl_renderer::draw (this=0x7ffc9045eb40, go=..., toplevel=true)
    at ../octave-src/libinterp/corefcn/gl-render.cc:628
#14 0x00007f33654b8912 in QtHandles::GLCanvas::draw (this=0x1a085f0, gh=...)
    at ../octave-src/libgui/graphics/GLCanvas.cc:63
#15 0x00007f33654a68c1 in QtHandles::Canvas::canvasPaintEvent (this=0x1a08618)
---Type <return> to continue, or q <return> to quit---
    at ../octave-src/libgui/graphics/Canvas.cc:319
#16 0x00007f33654b8cce in QtHandles::GLCanvas::paintGL (this=0x1a085f0)
    at ../octave-src/libgui/graphics/GLCanvas.cc:144
#17 0x00007f336151dba5 in QGLWidget::glDraw() () from /usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4
#18 0x00007f336151d68d in QGLWidget::paintEvent(QPaintEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4
#19 0x00007f3360a1b748 in QWidget::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#20 0x00007f3361527511 in QGLWidget::event(QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4
#21 0x00007f33609c848c in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#22 0x00007f33609cefa8 in QApplication::notify(QObject*, QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#23 0x00007f336049871d in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#24 0x00007f3360a15e1d in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#25 0x00007f3360be58fd in QWidgetPrivate::repaint_sys(QRegion const&) ()
   from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#26 0x00007f3360a0a4f7 in QWidgetPrivate::syncBackingStore() ()
   from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#27 0x00007f3360a1b818 in QWidget::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#28 0x00007f3361527511 in QGLWidget::event(QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4
#29 0x00007f33609c848c in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#30 0x00007f33609cefa8 in QApplication::notify(QObject*, QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#31 0x00007f336049871d in QCoreApplication::notifyInternal(QObject*, QEvent*) ()
   from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
---Type <return> to continue, or q <return> to quit---
#32 0x00007f336049bfc1 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) ()
   from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#33 0x00007f33604c7bd3 in ?? () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#34 0x00007f335946ec5d in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#35 0x00007f335946ef48 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#36 0x00007f335946effc in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#37 0x00007f33604c7d1d in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
    () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#38 0x00007f3360a6cf96 in ?? () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#39 0x00007f3360497271 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#40 0x00007f33604975d5 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#41 0x00007f336049d059 in QCoreApplication::exec() () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#42 0x00007f336542b66b in octave::gui_application::execute (this=0x7ffc9045fdb0)
    at ../octave-src/libgui/src/octave-gui.cc:224
#43 0x00000000004016b5 in main (argc=3, argv=0x7ffc9045ffa8) at ../octave-src/src/main-gui.cc:104
(gdb) print val
Cannot access memory at address 0x10


Is there anything I can do to help debug this?

Andreas Weber <andy1978>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #45883:  bug48519_heap-buffer-overflow.diff added by mmuetzel (2KiB - application/octet-stream)
file #45862:  no_callback2.patch added by pantxo (10KiB - text/x-patch)
file #45844:  no_callback.patch added by pantxo (8KiB - text/x-patch)
file #45790:  backtrace.log added by andy1978 (7KiB - text/x-log)
file #45791:  dump_plot_demos.m added by andy1978 (982B - text/x-objcsrc)
file #45741:  dump_plot_demos.m added by pantxo (358KiB - text/x-objcsrc)
file #38322:  hold_06.eps added by dasergatskov (168KiB - application/postscript)

 

Depends on the following items: None found

Digest:
   bug dependencies.

 

Carbon-Copy List
  • -email is unavailable- added by mmuetzel (Posted a comment)
  • -email is unavailable- added by rik5
  • -email is unavailable- added by hardy (Posted a comment)
  • -email is unavailable- added by avinoam (Posted a comment)
  • -email is unavailable- added by dasergatskov (Posted a comment)
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by pantxo (Posted a comment)
  • -email is unavailable- added by lachlan (Updated the item)
  • -email is unavailable- added by andy1978 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 16 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-01-11 rik5 StatusPatch Submitted Fixed
        Open/ClosedOpen Closed
    2019-01-06 mmuetzel Attached File- Added bug48519_heap-buffer-overflow.diff, #45883
    2019-01-05 rik5 Carbon-Copy- Added mmuetzel
    2019-01-04 pantxo Attached File- Added no_callback2.patch, #45862
    2019-01-02 cdf Dependencies- bugs #55268 is dependent
    2019-01-02 pantxo Attached File- Added no_callback.patch, #45844
        StatusIn Progress Patch Submitted
    2018-12-30 andy1978 Attached File- Added backtrace.log, #45790
        Attached File- Added dump_plot_demos.m, #45791
    2018-12-26 pantxo Attached File- Added dump_plot_demos.m, #45741
    2017-01-19 avinoam StatusReady For Test In Progress
    2016-08-22 dasergatskov Attached File- Added hold_06.eps, #38322
    2016-08-17 andy1978 StatusConfirmed Ready For Test
    2016-08-16 rik5 StatusNone Confirmed
    2016-07-16 lachlan Attached File- Added bug_48519_qt_invalid_proxy.cset, #37907

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code