[Octave-bug-tracker] [bug #59228] embedded.cc example crashes with segfault

[Carlo de Falco]

Follow-up Comment #7, bug #59228 (project octave):

Here is the stripped down example I had promised :


#include <octave/oct.h>
#include <octave/parse.h>
#include <iostream>


struct s_ {
  octave::interpreter* interp;
  s_ () {
    std::cout << "ctor" << std::endl;
    interp = new octave::interpreter ();
    int status = interp->execute ();
    std::cout << "status = " << status << std::endl;
  }
 ~s_ () {
   std::cout << "dtor" << std::endl;
   interp->shutdown ();
   delete interp;
 }

  void
  write_stuff () {
    try {
      octave_value_list out;
      interp->feval ("date", out, 1);      
    }
    catch (octave::execution_exception& ) {
      std::cerr << "exception raised" << std::endl;
    }
  }
};



// uncomment next line to produce crash
// s_ s;

int main () {
  // comment next line to produce crash
  s_ s;
  s.write_stuff (); 
  return 0;
}                            


The scope in which the object "s" is created is relevant in order for the
crash to happen.
The crash does not happen at every run, when it does occur I get the following
output :


$ mkoctfile --link-stand-alone -O0 -g prova4.cc -o prova4
$ ./prova4
ctor
status = 0
dtor

$ ./prova4
ctor
status = 0
dtor
prova4(7839,0x10c6965c0) malloc: *** error for object 0x7fb4ba8edf20: pointer
being freed was not allocated
prova4(7839,0x10c6965c0) malloc: *** set a breakpoint in malloc_error_break to
debug
Abort trap: 6

$ 



if I run in the debugger I get the following backtrace :


(lldb) run
Process 7946 launched: '/tmp/prova4' (x86_64)
ctor
status = 0
dtor
prova4(7946,0x1000af5c0) malloc: *** error for object 0x109c3d2a0: pointer
being freed was not allocated
prova4(7946,0x1000af5c0) malloc: *** set a breakpoint in malloc_error_break to
debug
Process 7946 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff5c7da2c2 libsystem_kernel.dylib`__pthread_kill + 10
libsystem_kernel.dylib`__pthread_kill:
->  0x7fff5c7da2c2 <+10>: jae    0x7fff5c7da2cc            ; <+20>
    0x7fff5c7da2c4 <+12>: movq   %rax, %rdi
    0x7fff5c7da2c7 <+15>: jmp    0x7fff5c7d4453            ; cerror_nocancel
    0x7fff5c7da2cc <+20>: retq   
Target 0: (prova4) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff5c7da2c2 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fff5c895bf1 libsystem_pthread.dylib`pthread_kill + 284
    frame #2: 0x00007fff5c7446a6 libsystem_c.dylib`abort + 127
    frame #3: 0x00007fff5c853077 libsystem_malloc.dylib`malloc_vreport + 545
    frame #4: 0x00007fff5c852e38 libsystem_malloc.dylib`malloc_report + 151
    frame #5: 0x00000001000030ea prova4`dim_vector::freerep() + 122
    frame #6: 0x00000001000dcf67
liboctinterp.8.dylib`dim_vector::~dim_vector(this=0x00007ffeefbfc3d0) at
dim-vector.h:325:7
    frame #7: 0x00000001000dcd45
liboctinterp.8.dylib`dim_vector::~dim_vector(this=0x00007ffeefbfc3d0) at
dim-vector.h:319:3
    frame #8: 0x00000001001d4fa9
liboctinterp.8.dylib`octave_base_value::isempty(this=0x0000000109ad3190) const
at ov-base.h:357:31
    frame #9: 0x0000000100590eb8
liboctinterp.8.dylib`octave_value::isempty(this=0x0000000109ae5ba0) const at
ov.h:558:17
    frame #10: 0x0000000100e25b8f
liboctinterp.8.dylib`Fget(interp=0x000000010a01ba00, args=0x00007ffeefbfd2b8,
(null)=1) at graphics.cc:12886:15
    frame #11: 0x00000001005f83d8
liboctinterp.8.dylib`octave_builtin::execute(this=0x0000000109a47b20,
tw=0x000000010a01c540, nargout=1, args=0x00007ffeefbfd2b8) at
ov-builtin.cc:65:16
    frame #12: 0x00000001006b2dc9
liboctinterp.8.dylib`octave_function::call(this=0x0000000109a47b20,
tw=0x000000010a01c540, nargout=1, args=0x00007ffeefbfd2b8) at ov-fcn.cc:57:10
    frame #13: 0x00000001009ad834
liboctinterp.8.dylib`octave::tree_index_expression::evaluate_n(this=0x000000010e8079a0,
tw=0x000000010a01c540, nargout=1) at pt-idx.cc:402:35
    frame #14: 0x00000001009af2b2
liboctinterp.8.dylib`octave::tree_index_expression::evaluate(this=0x000000010e8079a0,
tw=0x000000010a01c540, nargout=1) at pt-idx.h:107:34
    frame #15: 0x000000010092109e
liboctinterp.8.dylib`octave::tree_simple_assignment::evaluate(this=0x000000010e8e4390,
tw=0x000000010a01c540, (null)=0) at pt-assign.cc:101:43
    frame #16: 0x0000000100955d08
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement(this=0x000000010a01c540,
stmt=0x0000000109ab3750) at pt-eval.cc:3031:49
    frame #17: 0x00000001009d1821
liboctinterp.8.dylib`octave::tree_statement::accept(this=0x0000000109ab3750,
tw=0x000000010a01c540) at pt-stmt.h:124:10
    frame #18: 0x0000000100956059
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement_list(this=0x000000010a01c540,
lst=0x000000010e8e43d0) at pt-eval.cc:3090:18
    frame #19: 0x000000010054ea91
liboctinterp.8.dylib`octave::tree_statement_list::accept(this=0x000000010e8e43d0,
tw=0x000000010a01c540) at pt-stmt.h:201:10
    frame #20: 0x000000010095552b
liboctinterp.8.dylib`octave::tree_evaluator::visit_if_command_list(this=0x000000010a01c540,
lst=0x0000000109ac0960) at pt-eval.cc:2885:25
    frame #21: 0x0000000100955391
liboctinterp.8.dylib`octave::tree_if_command_list::accept(this=0x0000000109ac0960,
tw=0x000000010a01c540) at pt-select.h:118:10
    frame #22: 0x0000000100955344
liboctinterp.8.dylib`octave::tree_evaluator::visit_if_command(this=0x000000010a01c540,
cmd=0x000000010e8093c0) at pt-eval.cc:2863:12
    frame #23: 0x00000001009cffe1
liboctinterp.8.dylib`octave::tree_if_command::accept(this=0x000000010e8093c0,
tw=0x000000010a01c540) at pt-select.h:151:10
    frame #24: 0x0000000100955be7
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement(this=0x000000010a01c540,
stmt=0x000000010e8e3a80) at pt-eval.cc:3008:22
    frame #25: 0x00000001009d1821
liboctinterp.8.dylib`octave::tree_statement::accept(this=0x000000010e8e3a80,
tw=0x000000010a01c540) at pt-stmt.h:124:10
    frame #26: 0x0000000100956059
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement_list(this=0x000000010a01c540,
lst=0x000000010e8e3ab0) at pt-eval.cc:3090:18
    frame #27: 0x000000010054ea91
liboctinterp.8.dylib`octave::tree_statement_list::accept(this=0x000000010e8e3ab0,
tw=0x000000010a01c540) at pt-stmt.h:201:10
    frame #28: 0x000000010095552b
liboctinterp.8.dylib`octave::tree_evaluator::visit_if_command_list(this=0x000000010a01c540,
lst=0x000000010e8093f0) at pt-eval.cc:2885:25
    frame #29: 0x0000000100955391
liboctinterp.8.dylib`octave::tree_if_command_list::accept(this=0x000000010e8093f0,
tw=0x000000010a01c540) at pt-select.h:118:10
    frame #30: 0x0000000100955344
liboctinterp.8.dylib`octave::tree_evaluator::visit_if_command(this=0x000000010a01c540,
cmd=0x000000010e8d6cf0) at pt-eval.cc:2863:12
    frame #31: 0x00000001009cffe1
liboctinterp.8.dylib`octave::tree_if_command::accept(this=0x000000010e8d6cf0,
tw=0x000000010a01c540) at pt-select.h:151:10
    frame #32: 0x0000000100955be7
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement(this=0x000000010a01c540,
stmt=0x000000010e8d6d20) at pt-eval.cc:3008:22
    frame #33: 0x00000001009d1821
liboctinterp.8.dylib`octave::tree_statement::accept(this=0x000000010e8d6d20,
tw=0x000000010a01c540) at pt-stmt.h:124:10
    frame #34: 0x0000000100956059
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement_list(this=0x000000010a01c540,
lst=0x000000010e8d6d50) at pt-eval.cc:3090:18
    frame #35: 0x000000010054ea91
liboctinterp.8.dylib`octave::tree_statement_list::accept(this=0x000000010e8d6d50,
tw=0x000000010a01c540) at pt-stmt.h:201:10
    frame #36: 0x000000010095552b
liboctinterp.8.dylib`octave::tree_evaluator::visit_if_command_list(this=0x000000010a01c540,
lst=0x0000000109ab5f00) at pt-eval.cc:2885:25
    frame #37: 0x0000000100955391
liboctinterp.8.dylib`octave::tree_if_command_list::accept(this=0x0000000109ab5f00,
tw=0x000000010a01c540) at pt-select.h:118:10
    frame #38: 0x0000000100955344
liboctinterp.8.dylib`octave::tree_evaluator::visit_if_command(this=0x000000010a01c540,
cmd=0x000000010e8ec540) at pt-eval.cc:2863:12
    frame #39: 0x00000001009cffe1
liboctinterp.8.dylib`octave::tree_if_command::accept(this=0x000000010e8ec540,
tw=0x000000010a01c540) at pt-select.h:151:10
    frame #40: 0x0000000100955be7
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement(this=0x000000010a01c540,
stmt=0x000000010e8ec570) at pt-eval.cc:3008:22
    frame #41: 0x00000001009d1821
liboctinterp.8.dylib`octave::tree_statement::accept(this=0x000000010e8ec570,
tw=0x000000010a01c540) at pt-stmt.h:124:10
    frame #42: 0x0000000100956059
liboctinterp.8.dylib`octave::tree_evaluator::visit_statement_list(this=0x000000010a01c540,
lst=0x000000010e8c9af0) at pt-eval.cc:3090:18
    frame #43: 0x000000010054ea91
liboctinterp.8.dylib`octave::tree_statement_list::accept(this=0x000000010e8c9af0,
tw=0x000000010a01c540) at pt-stmt.h:201:10
    frame #44: 0x00000001009547c8
liboctinterp.8.dylib`octave::tree_evaluator::execute_user_function(this=0x000000010a01c540,
user_function=0x000000010e8d2000, nargout=0, xargs=0x00007ffeefbff410) at
pt-eval.cc:2770:19
    frame #45: 0x000000010078dc12
liboctinterp.8.dylib`octave_user_function::execute(this=0x000000010e8d2000,
tw=0x000000010a01c540, nargout=0, args=0x00007ffeefbff410) at
ov-usr-fcn.cc:496:13
    frame #46: 0x000000010078db1c
liboctinterp.8.dylib`octave_user_function::call(this=0x000000010e8d2000,
tw=0x000000010a01c540, nargout=0, args=0x00007ffeefbff410) at
ov-usr-fcn.cc:489:10
    frame #47: 0x0000000100ed8113
liboctinterp.8.dylib`octave::interpreter::feval(this=0x000000010a01ba00,
name="close", args=0x00007ffeefbff410, nargout=0) at interpreter.cc:1534:16
    frame #48: 0x0000000100ed70fb
liboctinterp.8.dylib`octave::interpreter::feval(this=0x000000010a01ba00,
name="close", args=0x00007ffeefbff410, nargout=0) at interpreter.cc:1520:12
    frame #49: 0x0000000100ed434b
liboctinterp.8.dylib`octave::interpreter::shutdown(this=0x000000010a01ba00) at
interpreter.cc:874:5
    frame #50: 0x00000001000029c8 prova4`s_::~s_() + 88
    frame #51: 0x0000000100001b95 prova4`s_::~s_() + 21
    frame #52: 0x00007fff5c7453cf libsystem_c.dylib`__cxa_finalize_ranges +
319
    frame #53: 0x00007fff5c7456b3 libsystem_c.dylib`exit + 55
    frame #54: 0x00007fff5c69f3dc libdyld.dylib`start + 8
(lldb) 


    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?59228>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/