Bug#803985: mapnik: Often get free(): invalid pointer

[Ruben Undheim]

Source: mapnik
Severity: important
Tags: upstream patch
Version: 3.0.8+ds-1

Dear Maintainer,


Quite often mapnik crashes. As for example described here:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799473

The upstream issue is here:
 https://github.com/mapnik/mapnik/issues/3090

and it has already been fixed upstream:
 https://github.com/mapnik/mapnik/commit/b99a20378dfcf8b94cbe228ef8a3775516dbb065


I've confirmed that after this has been fixed, it's once again possible to render
tiles with tools such as tilelite and the openstreetmap-carto style sheet.


A patch is below:

--- mapnik-3.0.8+ds.orig/include/mapnik/util/variant.hpp
+++ mapnik-3.0.8+ds/include/mapnik/util/variant.hpp
@@ -240,6 +240,19 @@ struct variant_helper<T, Types...>
             variant_helper<Types...>::copy(old_id, old_value, new_value);
         }
     }
+    VARIANT_INLINE static void direct_swap(const std::size_t id, void * lhs, void * rhs)
+    {
+        using std::swap; //enable ADL
+        if (id == sizeof...(Types))
+        {
+            // both lhs and rhs hold T
+            swap(*reinterpret_cast<T*>(lhs), *reinterpret_cast<T*>(rhs));
+        }
+        else
+        {
+            variant_helper<Types...>::direct_swap(id, lhs, rhs);
+        }
+    }
 };
 
 template<> struct variant_helper<>
@@ -247,6 +260,7 @@ template<> struct variant_helper<>
     VARIANT_INLINE static void destroy(const std::size_t, void *) {}
     VARIANT_INLINE static void move(const std::size_t, void *, void *) {}
     VARIANT_INLINE static void copy(const std::size_t, const void *, void *) {}
+    VARIANT_INLINE static void direct_swap(const std::size_t, void *, void *) {}
 };
 
 namespace detail {
@@ -274,7 +288,7 @@ struct unwrapper<recursive_wrapper<T>>
     {
         return obj.get();
     }
-    
+
     auto operator() (recursive_wrapper<T> & obj) const
         -> typename recursive_wrapper<T>::type &
     {
@@ -595,16 +609,24 @@ public:
         helper_type::move(old.type_index, &old.data, &data);
     }
 
-    friend void swap(variant<Types...> & first, variant<Types...> & second)
+    void assign(variant<Types...> & rhs)
     {
-        using std::swap; //enable ADL
-        swap(first.type_index, second.type_index);
-        swap(first.data, second.data);
+        if (type_index == rhs.type_index)
+        {
+            helper_type::direct_swap(rhs.type_index, &rhs.data, &data);
+        }
+        else
+        {
+            helper_type::destroy(type_index, &data);
+            type_index = detail::invalid_value;
+            helper_type::copy(rhs.type_index, &rhs.data, &data);
+            type_index = rhs.type_index;
+        }
     }
 
     VARIANT_INLINE variant<Types...>& operator=(variant<Types...> other)
     {
-        swap(*this, other);
+        assign(other);
         return *this;
     }
 
@@ -614,7 +636,7 @@ public:
     VARIANT_INLINE variant<Types...>& operator=(T && rhs) noexcept
     {
         variant<Types...> temp(std::forward<T>(rhs));
-        swap(*this, temp);
+        assign(temp);
         return *this;
     }
 
@@ -623,7 +645,7 @@ public:
     VARIANT_INLINE variant<Types...>& operator=(T const& rhs)
     {
         variant<Types...> temp(rhs);
-        swap(*this, temp);
+        assign(temp);
         return *this;
     }
 

Best regards,
Ruben
 

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, armel

Kernel: Linux 4.2.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-grass-devel/attachments/20151103/02cfb59a/attachment.sig>