Bug#1078154: libtickit-widget-scrollbox-perl: FTBFS with Perl 5.40: malloc_consolidate(): unaligned fastbin chunk detected

[Niko Tyni]

Control: reassign -1 libtickit-perl 0.73-1

On Wed, Aug 07, 2024 at 04:04:59PM +0300, Niko Tyni wrote:
> Package: libtickit-widget-scrollbox-perl
> Version: 0.12-1
> Severity: important
> Tags: trixie sid
> User: debian-perl at lists.debian.org
> Usertags: perl-5.40-transition
> 
> This package fails to build from source with Perl 5.40 (currently in
> experimental.)

>   malloc_consolidate(): unaligned fastbin chunk detected

>   t/03input-mouse.t         (Wstat: 6 (Signal: ABRT) Tests: 14 Failed: 0)
>     Non-zero wait status: 6

> This seems to be almost deterministic on perl.debian.net. The build
> succeeded once with perl_5.40.0~rc1-1 but has failed consistently 12 times
> now with perl_5.40.0-1 while building fine on sid / Perl 5.38 every time.

This is memory corruption in libtickit-perl, not specific to Perl
5.40. The current 5.40 build is apparently just more sensitive to
it. There's past reports of similar issues in #1013526 and #1006658.
I don't think they got ever fixed properly, they just stopped crashing
by chance.

It shows well on current sid / Perl 5.38 with

  $ valgrind perl -MTickit -e '$w=Tickit->new()->rootwin; $w->make_sub(0,0,1,1); $w->expose'

and even better with debugperl and a DEB_BUILD_OPTIONS=noopt Tickit build,
as seen below.

Looks like something goes wrong with DESTROY methods and the
tickit_window_unref() calls, but I'm not at the bottom of it yet.

==3459274== Memcheck, a memory error detector
==3459274== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==3459274== Using Valgrind-3.20.0 and LibVEX; rerun with -h for copyright info
==3459274== Command: debugperl -Iblib/lib -Iblib/arch -MTickit -e $w=Tickit-\>new()-\>rootwin;\ $w-\>make_sub(0,0,1,1);\ $w-\>expose
==3459274== 
==3459274== Invalid write of size 8
==3459274==    at 0x53DD1CF: tickit_window_destroy (in /usr/lib/x86_64-linux-gnu/libtickit.so.3.0.0)
==3459274==    by 0x53B11D9: XS_Tickit__Window_DESTROY (Tickit.xs:3512)
==3459274==    by 0x2BD616: Perl_pp_entersub (pp_hot.c:5555)
==3459274==    by 0x26C491: Perl_runops_debug (dump.c:2864)
==3459274==    by 0x17CA7A: Perl_call_sv (perl.c:3150)
==3459274==    by 0x2C721A: S_curse (sv.c:7144)
==3459274==    by 0x2C7DBC: Perl_sv_clear (sv.c:6685)
==3459274==    by 0x2C8F37: Perl_sv_free2 (sv.c:7244)
==3459274==    by 0x2C9D6D: S_visit (sv.c:394)
==3459274==    by 0x2C9D6D: Perl_sv_clean_objs (sv.c:545)
==3459274==    by 0x181863: perl_destruct (perl.c:928)
==3459274==    by 0x14E571: main (perlmain.c:139)
==3459274==  Address 0x5715f10 is 0 bytes inside a block of size 96 free'd
==3459274==    at 0x48451EF: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3459274==    by 0x53DD1CE: tickit_window_destroy (in /usr/lib/x86_64-linux-gnu/libtickit.so.3.0.0)
==3459274==    by 0x53B11D9: XS_Tickit__Window_DESTROY (Tickit.xs:3512)
==3459274==    by 0x2BD616: Perl_pp_entersub (pp_hot.c:5555)
==3459274==    by 0x26C491: Perl_runops_debug (dump.c:2864)
==3459274==    by 0x17CA7A: Perl_call_sv (perl.c:3150)
==3459274==    by 0x2C721A: S_curse (sv.c:7144)
==3459274==    by 0x2C7DBC: Perl_sv_clear (sv.c:6685)
==3459274==    by 0x2C8F37: Perl_sv_free2 (sv.c:7244)
==3459274==    by 0x2C9D6D: S_visit (sv.c:394)
==3459274==    by 0x2C9D6D: Perl_sv_clean_objs (sv.c:545)
==3459274==    by 0x181863: perl_destruct (perl.c:928)
==3459274==    by 0x14E571: main (perlmain.c:139)
==3459274==  Block was alloc'd at
==3459274==    at 0x4842808: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==3459274==    by 0x53DD069: tickit_window_new (in /usr/lib/x86_64-linux-gnu/libtickit.so.3.0.0)
==3459274==    by 0x53B0F00: XS_Tickit__Window__make_sub (Tickit.xs:3499)
==3459274==    by 0x2BD616: Perl_pp_entersub (pp_hot.c:5555)
==3459274==    by 0x26C491: Perl_runops_debug (dump.c:2864)
==3459274==    by 0x188C4F: S_run_body (perl.c:2812)
==3459274==    by 0x188C4F: perl_run (perl.c:2727)
==3459274==    by 0x14E4F8: main (perlmain.c:127)
==3459274== 
==3459274== 
==3459274== HEAP SUMMARY:
==3459274==     in use at exit: 1,861,759 bytes in 2,530 blocks
==3459274==   total heap usage: 38,628 allocs, 36,098 frees, 8,866,689 bytes allocated
==3459274== 
==3459274== LEAK SUMMARY:
==3459274==    definitely lost: 169,752 bytes in 313 blocks
==3459274==    indirectly lost: 1,678,485 bytes in 2,188 blocks
==3459274==      possibly lost: 0 bytes in 0 blocks
==3459274==    still reachable: 13,522 bytes in 29 blocks
==3459274==         suppressed: 0 bytes in 0 blocks
==3459274== Rerun with --leak-check=full to see details of leaked memory
==3459274== 
==3459274== For lists of detected and suppressed errors, rerun with: -s
==3459274== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

-- 
Niko Tyni   ntyni at debian.org