buggnubg - Bugs: bug #29880, crash after rollout

 
 

bug #29880: crash after rollout

Submitter:  orlowski <jo6>
Submitted:  Fri 14 May 2010 10:58:03 AM UTC
   
 
Originator Name:  orlowski Item Group:  * Crash error
Category:  * Rollouts Release:  * 0.90-devel
Privacy:  Public Operating System:  * Linux
Severity:  3 - Normal Open/Closed:  Closed
Assigned to:  None Priority:  5 - Normal
Status:  Fixed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sun 21 Nov 2010 11:36:12 AM UTC, comment #7: 

IMHO the biggest problem is MT_WAitForTasks in multithread.c and the way it is used.  The tasks registered can never get cancelled.  That means that they can get executed in a completely different context, where they can wreck havoc.

It looks as it was originally planned to make these tasks cancellable.  The variables as_source and cb_source in multithread.c are already assigned the ids of the tasks but these ids/variables are never used.

I'm not sure whether fixing this would help with the problem that Philippe reports but it would probably make it easier to understand.


Guido Flohr <gflohr>
Group Member
Sat 20 Nov 2010 10:17:26 PM UTC, comment #6: 

Guido's patch alleviates another rollout crash that happened even when compiled with --enable-threads in the following circumstances :
- rollout some cmarked moves or cube decisions
- increase number of trials and try to extend one of the rollouts from the analysis panel

It used to crash. With the patch it gives something like attachment below (this is an extension from 324 to 360 and it stops immediately, nothing is done). This is better than a core dump but still inadequate.



Philippe Michel <plm>
Group administrator
Tue 16 Nov 2010 03:19:14 PM UTC, comment #5: 

You have to disable threads in order to reproduce the crash.

The reason is that UpdateProgress() in rollout.c is scheduled for later execution as a timeout callback but never unregistered.  After a rollout, the first time the event loop is entered, the function is executed and segfaults because all the data it uses is now invalid.

The attached patch should fix this problem plus a minor memory leak when rollouts are interrupted (rngctxMTRollout was not freed).

People that compile gnubg themselves can circumvent the problem by calling configure with --enable-threads.

(file #22034)

Guido Flohr <gflohr>
Group Member
Thu 04 Nov 2010 04:29:18 PM UTC, comment #4: 

Every rollout initiated from the Gtk GUI crashes here, too.

Another flavor: I start the tty version with "gnubg -t", then I type "new game", "rollout", and then CTRL-C after a couple of seconds.

After "quit" the program segfaults most of the time.

Valgrind brought me a little closer: The segfault is caused by OutputRolloutResult() in format.c, called from TextRolloutProgress in progress.c.  I could no longer reproduce the segfault, when I just return the pointer sz in OutputRolloutResult() after it was initialized to the empty string.

OutputRolloutResult(shudder, what an ugly mess!) is seemingly not the problem because the function works okay while the rollout is in progress.

The segfault happens in the clean-up code: gnubg.c:PromptForExit() calls ProcessEvents() which calls g_main_context_iteration().  There I lost track.

You can probably reproduce the problem even without the crash: If the program does not crash, then you can see that the rollout interrupted with CTRL-C, and finished after that, is somehow still active.  After confirming the quit, TextRolloutProgress() is called again, and outputs the rollout results (again), and most probably the buffers used by the function are no longer valid at this time.

I don't understand enough of the code but it looks to me that after the rollout is finished, some code has to be removed from the event loop and it isn't.

I can reproduce the behavior with today's CVS snapshot, with Gentoo build from 2010-01-07, and with earlier CVS versions from autumn 2009.  If you need more detailled information (the valgrind output or tests I should run) just tell me.

Hope that helps,
Guido

Guido Flohr <gflohr>
Group Member
Sun 12 Sep 2010 01:15:27 PM UTC, comment #3: 

on ubuntu 10.04.1 or 10.04. (netbook-version) it is always the same:
you can start the ROLLOUT, but when you stop it, or when the rollout has finished the programme GNUBG crashes.

thanx a lot to every1 who can tell me what I could do to get rid of this or to the developer who solves it if it is a general bug!

kind regards
jürgen

orlowski <jo6>
Fri 14 May 2010 11:33:03 AM UTC, comment #2: 

i installed gnubg the following way:

first i took the latest source from here:
http://gnubg.org/media/sources/
and extracted it to the directory ~/gnubg.

then I run the following script:

-------------------

sudo apt-get update

sudo apt-get -y install autoconf
sudo apt-get -y install automake
sudo apt-get -y install libtool
sudo apt-get -y install libglib2.0-dev
sudo apt-get -y install libxml2-dev
sudo apt-get -y install libfreetype6-dev
sudo apt-get -y install libpng12-dev
sudo apt-get -y install flex
sudo apt-get -y install bison
sudo apt-get -y install python-dev
sudo apt-get -y install libgtk2.0-dev
sudo apt-get -y install libgtkglext1
sudo apt-get -y install libgtkglext1-dev
sudo apt-get -y install libgstreamer0.10-dev
sudo apt-get -y install libsqlite3-dev
sudo apt-get -y install libreadline5-dev

cd ~/gnubg

./autogen.sh
./configure
./autogen.sh
./configure
make
sudo make install

--------------------

thank you for your quick reply!
best regards from germany
jürgen


orlowski <jo6>
Fri 14 May 2010 11:21:02 AM UTC, comment #1: 

Since you report linux as OS, we need to now the origin of the executable. Did you compile it yourself?


Christian Anthon <c_anthon>
Group administrator
Fri 14 May 2010 10:58:03 AM UTC, original submission:  

gnubg always crashes after rollout.
no matter if you start the rollout via HINT, or via ANALYSE.
100% reproducible.

Version GNU Backgammon 0.90.0  Mar  5 2010

orlowski <jo6>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #22070:  gsnapshot.png added by plm (34KiB - image/png)
file #22034:  rollout_segfault.patch added by gflohr (2KiB - application/octet-stream - Avoid execution of UpdateProgress() after rollout is terminated.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by plm (Updated the item)
  • -email is unavailable- added by gflohr (Posted a comment)
  • -email is unavailable- added by c_anthon (Posted a comment)
  • -email is unavailable- added by jo6 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-01-05 plm Open/ClosedOpen Closed
        StatusNeed Info Fixed
    2010-11-20 plm Attached File- Added gsnapshot.png, #22070
    2010-11-16 gflohr Attached File- Added rollout_segfault.patch, #22034
    2010-05-14 c_anthon StatusNone Need Info

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code