bugGNU Octave - Bugs: bug #50189, Segfault when drawing sphere as...

 
 

bug #50189: Segfault when drawing sphere as first plot

Submitter:  Pantxo Diribarne <pantxo>
Submitted:  Mon 30 Jan 2017 09:47:56 PM UTC
   
 
Category:  Plotting with OpenGL Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Regression
Status:  Fixed Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * dev Operating System:  * Any
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 02 Feb 2017 09:37:23 PM UTC, comment #28: 

I stepped through print.m and the line that makes the axes appear is


  set (opts.figure, "position", fpos);


fpos is


    fpos = get (opts.figure, "position");
    ...
    fpos(3:4) = opts.canvas_size;


If the new position is different from the original, the plot updates and the axes appear.  Setting other properties doesn't seem to change anything, though I haven't tried them all.  Maybe it is just a missed drawnow and the other properties aren't affecting the "modified" status of the figure object?  I haven't checked.

John W. Eaton <jwe>
Group administrator
Thu 02 Feb 2017 03:30:29 PM UTC, comment #27: 

Bug #50209 is the one about allchild and the list of axes children.

John W. Eaton <jwe>
Group administrator
Thu 02 Feb 2017 03:24:40 PM UTC, comment #26: 

Thanks for pushing the patch.

I'm closing this report and opening a new one about the allchild compatibility.

The print trick works for me.  I tried


./run-octave --persist --no-gui --eval "newplot; newplot; drawnow;"


until it failed with a blank figure window.  A "print foo.png" command made the axes appear.  So I guess this is some other kind of race condition involving rendering and drawnow?  But although printing the figure worked to fix the display, I couldn't seem to get that to happen with something that should force a redraw like


set (gca, 'xlim', [-5, 5]);


So maybe it is more complicated that just missing a drawnow request.

John W. Eaton <jwe>
Group administrator
Thu 02 Feb 2017 12:10:57 PM UTC, comment #25: 

I pushed the patch after running succesfully dump_plot_demos:

http://hg.savannah.gnu.org/hgweb/octave/rev/2165993aed7d

May I close the report or do you want to discuss the blank window issue here?

Pantxo Diribarne <pantxo>
Group Member
Thu 02 Feb 2017 11:43:06 AM UTC, comment #24: 

For what its worth, the results from the tests from comment #15 and comment #16 in Matlab R2016a:

>> labels = {'xlabel', 'ylabel', 'zlabel', 'title'};
hlabels = cell2mat (get (gca, labels));
Error using cell2mat (line 52)
CELL2MAT does not support cell arrays containing cell arrays or objects.


Fails because graphics handles are objects now.
Slightly modified keeping the spirit of the test:

>> close all
>> labels = {'xlabel', 'ylabel', 'zlabel', 'title'};
>> hlabels = get (gca, labels);
>> hparents = get ([hlabels{:}], 'parent');
>> all ([hparents{:}] == gca)

ans =

     1

>> allchild (gca)

ans =

  0x0 empty GraphicsPlaceholder array.


Markus Mützel <mmuetzel>
Group administrator
Thu 02 Feb 2017 08:22:51 AM UTC, comment #23: 

Speaking of blank plot:
on my i7 computer the very first plot is almost always
comes a black windows. "drawnow" does not do anything.
But, if i do say
"print junk.png" it would get redrawn and come back
normal (and works fine in the octave session).


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Thu 02 Feb 2017 08:09:04 AM UTC, comment #22: 

There may be other places where data should be protected, but I think the blank window is another story.

My guess is that it is something like bug #44472: at some point the concurrency (imposed by mutex) between the GUI and the interpreter makes the GUI thread miss a drawnow_requested.

Pantxo Diribarne <pantxo>
Group Member
Wed 01 Feb 2017 10:20:15 PM UTC, comment #21: 

What other objects does the Qt rendering code access directly from Octave?  I guess that's the place to start looking for things that might also need to be locked?

John W. Eaton <jwe>
Group administrator
Wed 01 Feb 2017 10:19:26 PM UTC, comment #20: 

I tried running the following shell command after applying your change:


while true; do ./run-octave --no-gui --eval "newplot; newplot; drawnow; pause (1);"; done


It never seems to segfault, but it does occasionally fail to display the axes in the plot window.  Maybe there is some other place where we need a lock?

In any case, please push your change as it does seem to be a significant improvement.

Thanks.

John W. Eaton <jwe>
Group administrator
Wed 01 Feb 2017 09:45:30 PM UTC, comment #19: 

Sorry I just saw the "nemplot; newplot" part of the discussion. In this case "reset" is actually called (for the second newplot), and the patch in comment #18 also prevents the crash for this test case.

Pantxo Diribarne <pantxo>
Group Member
Wed 01 Feb 2017 09:24:24 PM UTC, comment #18: 

Is "reset" ever called when running "sphere (64)"? That is not what I would expect.

I think it is directly operations on txt_renderer objects that should be mutex protected. If I do that in graphics.cc, see attached, I am then unable to trigger the crash.




(file #39645)

Pantxo Diribarne <pantxo>
Group Member
Wed 01 Feb 2017 09:14:49 PM UTC, comment #17: 

Also, with that patch, I haven't yet been able to trigger a segfault.  But it does sometimes fail to render the plot properly.  Instead, I get a blank figure window.

I'd guess there are some other places where we need to use a lock.

John W. Eaton <jwe>
Group administrator
Wed 01 Feb 2017 09:05:46 PM UTC, comment #16: 

Try this also:


allchild (gca)


Does that return a list of 4 handles in Matlab?

Yeah, I think it's a race condition.  The attached change helps, but I can still trigger the problem:



(file #39644)

John W. Eaton <jwe>
Group administrator
Wed 01 Feb 2017 08:52:25 PM UTC, comment #15: 

@John: I am pretty sure labels have been hidden children of axes objects at least up to ML2015b, just like in Octave. Could someone test the following in Matlab?


%% Are labels children of the axes object
labels = {'xlabel', 'ylabel', 'zlabel', 'title'};
hlabels = cell2mat (get (gca, labels));
all (cell2mat (get (hlabels, 'parent')) == gca)


@Rik: when running "sphere (64)" from scratch, "do_reset" is false and the axes object, which was just created, is untouched prior to plotting.

I think that the change in newplot only reveals a (up to now) potential race condition.
AFAICS, there are text_renderer objects instantiated as part of axes and text objects (handled in the interpreter thread) and opengl_renderer objects (GUI thread when using Qt). I also see there is a ft_manager: do those objects share any sensible objects like FT_Face (see [1])?

[1] https://www.freetype.org/freetype2/docs/reference/ft2-base_interface.html#FT_Face

Pantxo Diribarne <pantxo>
Group Member
Wed 01 Feb 2017 08:31:25 PM UTC, comment #14: 

And now I have a crash (actually plot hangs)...
At first glance -- nothing has changed.

Dmitri.

Dmitri A. Sergatskov <dasergatskov>
Wed 01 Feb 2017 08:28:44 PM UTC, comment #13: 

With a patch i have not gotten crash (yet), but got:

<...deleted...>
warning: text_renderer: skipping missing glyph for character '2e'
warning: called from
    newplot at line 205 column 2
warning: text_renderer: skipping missing glyph for character '32'
warning: called from
    newplot at line 205 column 2
warning: text_renderer: skipping missing glyph for character '30'
warning: called from
    newplot at line 205 column 2
<...deleted...>

Dmitri A. Sergatskov <dasergatskov>
Wed 01 Feb 2017 08:17:53 PM UTC, comment #12: 

I still can't reproduce this using


newplot; newplot


but clearly I am in the minority.

If the problem is with allchild, does this quick fix work?


diff -r 35e3d199527c scripts/plot/util/newplot.m
--- a/scripts/plot/util/newplot.m       Tue Jan 31 17:29:32 2017 -0800
+++ b/scripts/plot/util/newplot.m       Wed Feb 01 12:16:16 2017 -0800
@@ -198,7 +198,10 @@ function hax = newplot (hsave = [])
           delete (ca);
           ca = axes ();
         elseif (do_reset)
-          delete (allchild (ca));
+          ht = [get(ca, {"xlabel", "ylabel", "zlabel", "title"}){:}];
+          ac = allchild (ca);
+          hdel = setdiff (ac, ht);
+          delete (hdel);
           reset (ca);
         endif
       endif


The diff is attached as well if you want to download for testing.


(file #39642)

Rik <rik5>
Group administrator
Wed 01 Feb 2017 07:22:07 PM UTC, comment #11: 

I don't think the changeset 5dca1727ce94 is necessarily the problem.  It may be that it is just triggering a long-standing bug.

One thing that is definitely wrong is that allchild returns handles for xlabel, ylabel, zlabel, and title properties.  I don't think that Matlab has these as children.  They are not hidden children, they are special objects that are part of the axes object.

I don't see a one-line fix for this problem because there are a number of places that treat these objects as if they are children of the axes object.

John W. Eaton <jwe>
Group administrator
Wed 01 Feb 2017 07:13:35 PM UTC, comment #10: 

This problem definitely shows up for me at


changeset:   23013:5dca1727ce94
user:        Pantxo Diribarne <pantxo.diribarne@gmail.com>
date:        Thu Jan 05 09:55:28 2017 +0100
summary:     cla.m, newplot.m: make use of reset function to cleanup listeners (bug #49980).


I can trigger the crash with something as simple as


newplot; newplot


I.e., two successive calls to newplot without an intervening call to drawnow.

This happens for sphere because it calls surf and both call newplot.

The crash happens on the second call to newplot, around line 200.  At that point I think the axes object is newly created and has four children (text objects) and deleting them and calling reset isn't the right thing.  Actually, just the call to reset seems to be causing the trouble because commenting that out appears to allow the code to work.  I'm not sure whether this sequence of commands makes sense, but even if they are nonsensical, they shouldn't crash Octave.

John W. Eaton <jwe>
Group administrator
Wed 01 Feb 2017 06:50:03 PM UTC, comment #9: 

I just built
   HG ID for this build is "35e3d199527c"
on Xeon with Nvidia card (nouveau/Galium)
I see it hangs in about ~50% cases.
(It is also Fedora 25 / Gnome desktop)

Dmitri.

Dmitri A. Sergatskov <dasergatskov>
Wed 01 Feb 2017 04:50:04 PM UTC, comment #8: 

I was testing in a virtual machine with Ubuntu 16.10 (Unity desktop) on a host with Intel i5 CPU with integrated graphics.

It also hangs or crashes on Windows 10 which is the host OS. Changing affected OS to "Any".

Markus Mützel <mmuetzel>
Group administrator
Wed 01 Feb 2017 04:04:45 PM UTC, comment #7: 

FWIW, I'm running a KDE desktop and intel i7 with integrated graphics.  It works for me.

Rik <rik5>
Group administrator
Wed 01 Feb 2017 10:31:18 AM UTC, comment #6: 

I can confirm that the first affected revision is indeed http://hg.savannah.gnu.org/hgweb/octave/rev/5dca1727ce94

I am getting the same behaviour as described by Pantxo: sometimes it crashes immediately, sometimes I get messages about missing glyphs or Octave might hang. For spheres with less faces it sometimes works without an issue.

Is it possible that FreeType needs to initialize the fonts (or something) that was implicitly done by _go_axes_init_ before that change? I am wondering why it wouldn't find the glyphs.

Markus Mützel <mmuetzel>
Group administrator
Wed 01 Feb 2017 09:19:56 AM UTC, comment #5: 

@Dmitri: same config here with integrated graphics chipset and I also often get the warning about missing glyph "3x". When it doesn't crash immediately I either see a hang (then I have to kill the process) or a crash at exit.

Marking the bug confirmed even though not as badly.

Pantxo Diribarne <pantxo>
Group Member
Wed 01 Feb 2017 04:50:57 AM UTC, comment #4: 

On i7-2600 computer I get sporadic crash or near endless list of warnings about unknown glyph (30), but then it just works
many times in a row.
HG ID for this build is "35e3d199527c"

I wonder if this is desktop dependent -- I have gnome and may
be Qt needs to initialize something (fonts handling), which is
active on Qt-based desktops.

Dmitri.

Dmitri A. Sergatskov <dasergatskov>
Wed 01 Feb 2017 12:59:22 AM UTC, comment #3: 

This works for me.  On the development branch with


parent: 23128:982042b59c0a tip
 build: Eliminate unused parameter warning in octave-qt-link.cc.


and


./run-octave -f
sphere


Anything else I can try?  This is with Qt5.4.2.

Rik <rik5>
Group administrator
Tue 31 Jan 2017 11:48:34 AM UTC, comment #2: 

The segfault happens while trying to render the string "0.6" using ft_text_renderer::text_to_pixels which leads me to two remarks:

  • we are trying to render the default axes (the expected 3D final axes does not have "0.6" ticklabel) which I wouldn't expect unless a spurious drawnow is called in the middle of the process
  • the ft_renderer tries to find the character '%x'. What does this mean??? I am clueless



Pantxo Diribarne <pantxo>
Group Member
Tue 31 Jan 2017 10:30:55 AM UTC, comment #1: 

I attached the backtrace which I produced with the GUI enabled (with --no-gui I can see the crash sometimes but not always), using instructions from [1]. I didn't look into it but it seams the segfault happens in the text_renderer.

If I force the axes to be reset in nemplot.m, by replacing "elsif (do_reset)" by "else", then I see no crash anymore.

[1] http://wiki.octave.org/Debugging_Octave

(file #39624)

Pantxo Diribarne <pantxo>
Group Member
Mon 30 Jan 2017 09:47:56 PM UTC, original submission:  

I can reliably crash octave with the current tip (17a3567a7b01) if I try to plot a sphere with qt toolkit (fltk is ok). The following is enough


# axes ()
sphere (64)


It has to be run as the first plotting command. Adding "axes ()" prior to plotting the sphere is enough to avoid the crash, which makes me think it has to do with this cset:
http://hg.savannah.gnu.org/hgweb/octave/rev/5dca1727ce94

I'll try to run this in gdb ASAP

Pantxo Diribarne <pantxo>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #39645:  txt_renderer.patch added by pantxo (2KiB - text/x-diff)
file #39644:  diffs.txt added by jwe (743B - text/plain)
file #39642:  newplot.diff added by rik5 (562B - application/x-download)
file #39624:  bt.txt added by pantxo (9KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jwe (Posted a comment)
  • -email is unavailable- added by mmuetzel (Posted a comment)
  • -email is unavailable- added by dasergatskov (Posted a comment)
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by pantxo (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 11 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-02 jwe Open/ClosedOpen Closed
    2017-02-02 pantxo StatusConfirmed Fixed
    2017-02-01 pantxo Attached File- Added txt_renderer.patch, #39645
    2017-02-01 jwe Attached File- Added diffs.txt, #39644
    2017-02-01 rik5 Attached File- Added newplot.diff, #39642
    2017-02-01 mmuetzel Operating SystemGNU/Linux Any
    2017-02-01 rik5 StatusNone Confirmed
    2017-02-01 mmuetzel StatusConfirmed None
    2017-02-01 pantxo StatusWorks For Me Confirmed
    2017-02-01 rik5 StatusNone Works For Me
    2017-01-31 pantxo Attached File- Added bt.txt, #39624

    Back to the top

    Powered by Savane 3.14-f13d.
    Corresponding source code