Bug#834396: gnuplot-x11: more info and workaround
Mo Jun
royclark086 at gmail.com
Thu Jan 26 05:55:56 UTC 2017
Package: gnuplot-x11
Version: 5.0.5+dfsg1-5
Followup-For: Bug #834396
Dear Maintainer,
I provide more infomation, new method to reproduce this bug and a
workaround.
I think this bug can be more exactly described as "crash randomly with wxt
terminal on multi-core-cpu system".
Contents:
1. Description
2. Reproduce
3. Workaround
4. Related bug
1. Description
1) The crashes may be
A Aborted
A1 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:337:miSetExtents:
assertion failed: (pExtents->y1 < pExtents->y2)
A2 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:1310:miSubtractNonO1:
assertion failed: (r->x1<r->x2)
A3 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:1453:miSubtractO:
assertion failed: (x1<r1->x2)
A4 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:1110:miUnionNonO:
assertion failed: (y1 < y2)
A5 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:564:miIntersectO:
assertion failed: (pReg->numRects <= pReg->size)
A6 not assertion failed. Usually Backtrace and Memory map are
printed in terminal.
B Trace/breakpoint trap, with
(gnuplot-x11:24414): GLib-ERROR **:
/build/glib2.0-m2w47E/glib2.0-2.50.2/./glib/gmem.c:378: overflow
allocating 18446744073709551615*16 bytes
The GLib-ERROR message is always the same one expect the pid of
gnuplot-x11.
C Segmentation fault
2) This bug appears randomly.
3) This bug appears with wxt term, not with x11 term.
4) The running thread is always thread 1 when crash happened.
5) This bug appears on my physical system with a 2-core CPU; It can not be
reproduced on system in virtualbox with a single-core CPU.
6) On my system, this bug appears frequently when total CPU usage is around
50% and appears less when total CPU usage is around 0% or 100%.
2. Reproduce
It is assumed that below commands are run on a 2-core-CPU system.
1) Close CPU-consuming programs. Then open a terminal and run:
$ while : ; do : ; done
The purpose is to make total CPU usage about 50%.
2) Open another terminal and run:
$ ./gnuplot-bug-test.sh &> gnuplot-crash.log
The script gnuplot-bug-test.sh is attached. The main job of the
script is let gnuplot repeatedly "plot x".
A 800-loop run resulted in 770 crashes, with
675 Aborted
75 Segmentation fault
20 Trace/breakpoint trap
596 of 675 Aborted are assertion failed:
3 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:1110:miUnionNonO:
assertion failed: (y1 < y2)
28 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:1310:miSubtractNonO1:
assertion failed: (r->x1<r->x2)
8 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:1453:miSubtractO:
assertion failed: (x1<r1->x2)
555 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:337:miSetExtents:
assertion failed: (pExtents->y1 < pExtents->y2)
2 Gdk:ERROR:/build/gtk+2.0-pW7LUB/gtk+2.0-2.24.31/gdk/gdkregion-generic.c:564:miIntersectO:
assertion failed: (pReg->numRects <= pReg->size)
Several full backtraces are attached of some type of crash. If it is needed,
I can provided all backtraces. I will keep all core files for a while. If it
is needed, I can provide them. Each core file have a size of about 40 MB;
after compressed, the size reduces to about 700kB.
Below are the locations of code when crash happened(address are removed
to count each type):
675 #0 __GI_raise (sig=sig at entry=6) at
../sysdeps/unix/sysv/linux/raise.c:58
20 #0 _g_log_abort (breakpoint=1) at ././glib/gmessages.c:487
20 #0 in ?? ()
2 #0 in main_arena () from /lib/x86_64-linux-gnu/libc.so.6
5 #0 in malloc_consolidate (av=av at entry= <main_arena>) at malloc.c:4210
12 #0 in miCoalesce (prevStart=prevStart at entry=0, curStart=-1,
curStart at entry=1, pReg=<optimized out>, pReg=<optimized out>) at
./gdk/gdkregion-generic.c:781
1 #0 _int_malloc (av=av at entry= <main_arena>,
bytes=bytes at entry=32) at malloc.c:3413
2 #0 in wxGDIObject::IsOk (this=) at ../include/wx/gdiobj.h:49
1 #0 in wxLog::CallDoLogNow (this= <vtable for
wxObjectListNode+16>, level=level at entry=6, msg=..., info=...) at
../src/common/log.cpp:436
1 #0 magazine_chain_pop_head (magazine_chunks=<optimized out>)
at ././glib/gslice.c:535
2 #0 magazine_chain_pop_head (magazine_chunks=<optimized out>)
at ././glib/gslice.c:539
22 #0 malloc_consolidate (av=av at entry= <main_arena>) at malloc.c:4204
7 #0 malloc_consolidate (av=av at entry= <main_arena>) at malloc.c:4210
As mentioned in 1., Backtrace and Memory map may be printed in
terminal; they can not be redirected. I copy and save them into
term.log as attached. Below are summary of Error in term.log(address
is also removed):
1 *** Error in `/usr/bin/gnuplot-x11': corrupted double-linked list:
77 *** Error in `/usr/bin/gnuplot-x11': double free or corruption
(fasttop):
15 *** Error in `/usr/bin/gnuplot-x11': double free or corruption (out):
3 *** Error in `/usr/bin/gnuplot-x11': double free or corruption (!prev):
3 *** Error in `/usr/bin/gnuplot-x11': invalid fastbin entry (free):
12 *** Error in `/usr/bin/gnuplot-x11': malloc(): memory
corruption (fast):
3. Workaround
Rebuild the gnuplot package with --with-wx-single-threaded option as
shown in the attached patch "debdiff".
4. Related bug
#841137 has a similar behavior with this bug.
Regards,
Mo Jun
-- System Information:
Debian Release: 9.0
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.8.0-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages gnuplot-x11 depends on:
ii gnuplot-data 5.0.5+dfsg1-5
ii libc6 2.24-9
ii libcairo2 1.14.8-1
ii libedit2 3.1-20160903-3
ii libgcc1 1:6.3.0-5
ii libgd3 2.2.4-2
ii libglib2.0-0 2.50.2-2
ii liblua5.1-0 5.1.5-8.1+b2
ii libpango-1.0-0 1.40.3-3
ii libpangocairo-1.0-0 1.40.3-3
ii libstdc++6 6.3.0-5
ii libwxbase3.0-0v5 3.0.2+dfsg-2
ii libwxgtk3.0-0v5 3.0.2+dfsg-2
ii libx11-6 2:1.6.4-2
gnuplot-x11 recommends no packages.
Versions of packages gnuplot-x11 suggests:
pn gnuplot-doc <none>
-- debconf-show failed
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gnuplot-bug-test.sh
Type: application/x-sh
Size: 453 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0001.sh>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gnuplot-crash.log.gz
Type: application/x-gzip
Size: 13194 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: term.log.gz
Type: application/x-gzip
Size: 157701 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: A1-Aborted-core.1-backtrace
Type: application/octet-stream
Size: 14035 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0006.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: A2-Aborted-core.25-backtrace
Type: application/octet-stream
Size: 19103 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0007.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: A6-Aborted-core.26-backtrace
Type: application/octet-stream
Size: 18919 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0008.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: B-Trace_breakpoint_trap-core.39-backtrace
Type: application/octet-stream
Size: 18797 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0009.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: C-Segmentation_fault.10-backtrace
Type: application/octet-stream
Size: 33066 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0010.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: debdiff
Type: application/octet-stream
Size: 1268 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20170126/24e1fe54/attachment-0011.obj>
More information about the debian-science-maintainers
mailing list