Debian Bug report logs - #892288
arrayfire FTBFS on i386: test segfaults

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Adrian Bunk <bunk@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: arrayfire FTBFS on i386: test segfaults

Date: Wed, 07 Mar 2018 23:26:42 +0200

Source: arrayfire
Version: 3.3.2+dfsg1-4
Severity: serious
Tags: buster sid

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/i386/arrayfire.html

...
98% tests passed, 2 tests failed out of 95

Total Test time (real) =  53.16 sec

The following tests FAILED:
	  4 - Test_assign_cpu (SEGFAULT)
	 43 - Test_index_cpu (SEGFAULT)
Errors while running CTest
Makefile:143: recipe for target 'test' failed
make[2]: *** [test] Error 8


Whatever broke it was not yet in unstable on 2017-12-31,
but likely entered buster before 2018-01-31:
https://tests.reproducible-builds.org/debian/history/arrayfire.html

Message #12 received at 892288@bugs.debian.org (full text, mbox, reply):

From: Bernhard Übelacker <bernhardu@mailbox.org>

To: 892288@bugs.debian.org, Adrian Bunk <bunk@debian.org>

Subject: Re: arrayfire FTBFS on i386: test segfaults

Date: Thu, 2 Aug 2018 15:59:23 +0200

[Message part 1 (text/plain, inline)]

Hello,
tried to reproduce this, but unfortunately it fails to build against
gcc-8, for which #897707 is already open.

Therefore tried to reproduce it with gcc-7.
I think this is what happens:

- test Asssign_LinearAssignGenSeq_Test::TestBody allocates a buffer
- buffer gets deleted
- the same buffer gets deleted again - therefore in the linked list we
  have now an entry that points to itself.
- test allocates again and receives the twice deleted buffer and
  writes a value to it - therefore the first entry in the linked list
  is our already allocated buffer and the next pointer points to the
  value the test has written before.
- next allocation crashes because the next pointer contains no valid
  address.


(gdb) bt
#0  0xb6abce2a in tcache_put (tc_idx=5, chunk=0x5fd798) at malloc.c:2932
#1  _int_free (av=0xb6c1b7a0 <main_arena>, p=0x5fd798, have_lock=0) at malloc.c:4173
#2  0xb6cd1668 in operator delete (ptr=0x5fd7a0) at ../../../../src/libstdc++-v3/libsupc++/del_op.cc:49
#3  0xb6e65477 in cpu::destroyArray<float> (A=0x5fd7a0) at ./src/backend/cpu/Array.cpp:223
#4  0xb77f7a6e in releaseHandle<float> (arr=0x5fd7a0) at ./src/api/c/handle.hpp:109
#5  af_release_array (arr=0x5fd7a0) at ./src/api/c/array.cpp:189
#6  0xb78625d5 in af_assign_seq (out=0xbffff328, lhs=0x5faea0, ndims=<optimized out>, index=0x5fd800, rhs=<optimized out>) at ./src/api/c/assign.cpp:135
#7  0xb7865bd7 in af_assign_gen (out=0xbffff328, lhs=0x5faea0, ndims=1, indexs=0xbffff35c, rhs_=0x5fae20) at ./src/api/c/assign.cpp:223
#8  0x00429b7c in Asssign_LinearAssignGenSeq_Test::TestBody (this=0x5faf90) at ./test/assign.cpp:926
#9  0x00563605 in testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void> (location=0x574590 "the test body", method=&virtual testing::Test::TestBody(), object=0x5faf90) at /usr/src/gtest/src/gtest.cc:2402
#10 testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void> (object=0x5faf90, method=&virtual testing::Test::TestBody(), location=0x574590 "the test body") at /usr/src/gtest/src/gtest.cc:2438
#11 0x00557c0e in testing::Test::Run (this=this@entry=0x5faf90) at /usr/src/gtest/src/gtest.cc:2474
#12 0x00557ed4 in testing::Test::Run (this=0x5faf90) at /usr/src/gtest/src/gtest.cc:2466
#13 testing::TestInfo::Run (this=0x5f9410) at /usr/src/gtest/src/gtest.cc:2656
#14 0x00558087 in testing::TestInfo::Run (this=<optimized out>) at /usr/src/gtest/src/gtest.cc:2631
#15 testing::TestCase::Run (this=0x5f9230) at /usr/src/gtest/src/gtest.cc:2776
#16 0x00558695 in testing::TestCase::Run (this=<optimized out>) at /usr/src/gtest/src/gtest.cc:2762
#17 testing::internal::UnitTestImpl::RunAllTests (this=<optimized out>) at /usr/src/gtest/src/gtest.cc:4651
#18 0x0055889d in testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> (location=0x573adc "auxiliary test code (environments or event listeners)", method=<optimized out>, object=0x5ddc60) at /usr/src/gtest/src/gtest.cc:2402
#19 testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> (location=0x573adc "auxiliary test code (environments or event listeners)", method=(bool (testing::internal::UnitTestImpl::*)(testing::internal::UnitTestImpl * const)) 0x5581f0 <testing::internal::UnitTestImpl::RunAllTests()>, object=0x5ddc60) at /usr/src/gtest/src/gtest.cc:2438
#20 testing::UnitTest::Run (this=0x5c91e0 <testing::UnitTest::GetInstance()::instance>) at /usr/src/gtest/src/gtest.cc:4259
#21 0x00423f1a in RUN_ALL_TESTS () at /usr/src/gtest/include/gtest/gtest.h:2233
#22 main (argc=<optimized out>, argv=0xbffff654) at /usr/src/gtest/src/gtest_main.cc:37



> Whatever broke it was not yet in unstable on 2017-12-31,
> but likely entered buster before 2018-01-31:

Was that probably the time as buster switched to libstdc++6 from gcc-8 ?
(But did still have gcc-7 as default compile?)


Built the package with "DEB_BUILD_MAINT_OPTIONS = hardening=+all sanitize=+address"
But then Test_assign_cpu succeeded, but tests 43 and 78 failed.


Nevertheless, because gcc-8 is default in buster this report
should probably be marked as blocked by #897707 ?


Kind regards,
Bernhard

[debugging.txt (text/plain, attachment)]

Message #17 received at 892288@bugs.debian.org (full text, mbox, reply):

From: "Rebecca N. Palmer" <rebecca_palmer@zoho.com>

To: 892288@bugs.debian.org

Subject: Re: arrayfire test crash

Date: Sun, 3 Feb 2019 15:01:35 +0000

While this doesn't crash on amd64, valgrind does find a double free in 
test_index - and a comment in the test says checking that there isn't a 
double free is the whole point of that test: 
https://sources.debian.org/src/arrayfire/3.3.2+dfsg1-4/test/index.cpp/#L1255

==4773== Invalid free() / delete / delete[] / realloc()
==4773==    at 0x4836EAB: operator delete(void*) (in 
/usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==4773==    by 0x525D4A4: releaseHandle<int> (handle.hpp:109)
==4773==    by 0x525D4A4: af_release_array (array.cpp:194)
==4773==    by 0x1587FA: Indexing_SNIPPET_indexing_copy_Test::TestBody() 
(index.cpp:1258)
==4773==    by 0x291109: 
HandleSehExceptionsInMethodIfSupported<testing::Test, void> (gtest.cc:2443)
==4773==    by 0x291109: void 
testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, 
void>(testing::Test*, void (testing::Test::*)(), char const*) 
(gtest.cc:2479)
==4773==    by 0x28780B: testing::Test::Run() [clone .part.611] 
(gtest.cc:2517)
==4773==    by 0x287AB4: Run (gtest.cc:2509)
==4773==    by 0x287AB4: testing::TestInfo::Run() [clone .part.612] 
(gtest.cc:2693)
==4773==    by 0x287C53: Run (gtest.cc:2668)
==4773==    by 0x287C53: testing::TestCase::Run() [clone .part.613] 
(gtest.cc:2813)
==4773==    by 0x2882C2: Run (gtest.cc:2799)
==4773==    by 0x2882C2: testing::internal::UnitTestImpl::RunAllTests() 
(gtest.cc:5179)
==4773==    by 0x291619: 
HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, 
bool> (gtest.cc:2443)
==4773==    by 0x291619: bool 
testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, 
bool>(testing::internal::UnitTestImpl*, bool 
(testing::internal::UnitTestImpl::*)(), char const*) (gtest.cc:2479)
==4773==    by 0x288452: testing::UnitTest::Run() (gtest.cc:4788)
==4773==    by 0x15820F: RUN_ALL_TESTS (gtest.h:2341)
==4773==    by 0x15820F: main (gtest_main.cc:36)
==4773==  Address 0x9d8d680 is 0 bytes inside a block of size 152 free'd
==4773==    at 0x4836EAB: operator delete(void*) (in 
/usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==4773==    by 0x525D4A4: releaseHandle<int> (handle.hpp:109)
==4773==    by 0x525D4A4: af_release_array (array.cpp:194)
==4773==    by 0x1587F2: Indexing_SNIPPET_indexing_copy_Test::TestBody() 
(index.cpp:1259)
==4773==    by 0x291109: 
HandleSehExceptionsInMethodIfSupported<testing::Test, void> (gtest.cc:2443)
==4773==    by 0x291109: void 
testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, 
void>(testing::Test*, void (testing::Test::*)(), char const*) 
(gtest.cc:2479)
==4773==    by 0x28780B: testing::Test::Run() [clone .part.611] 
(gtest.cc:2517)
==4773==    by 0x287AB4: Run (gtest.cc:2509)
==4773==    by 0x287AB4: testing::TestInfo::Run() [clone .part.612] 
(gtest.cc:2693)
==4773==    by 0x287C53: Run (gtest.cc:2668)
==4773==    by 0x287C53: testing::TestCase::Run() [clone .part.613] 
(gtest.cc:2813)
==4773==    by 0x2882C2: Run (gtest.cc:2799)
==4773==    by 0x2882C2: testing::internal::UnitTestImpl::RunAllTests() 
(gtest.cc:5179)
==4773==    by 0x291619: 
HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, 
bool> (gtest.cc:2443)
==4773==    by 0x291619: bool 
testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, 
bool>(testing::internal::UnitTestImpl*, bool 
(testing::internal::UnitTestImpl::*)(), char const*) (gtest.cc:2479)
==4773==    by 0x288452: testing::UnitTest::Run() (gtest.cc:4788)
==4773==    by 0x15820F: RUN_ALL_TESTS (gtest.h:2341)
==4773==    by 0x15820F: main (gtest_main.cc:36)
==4773==  Block was alloc'd at
==4773==    at 0x4835DEF: operator new(unsigned long) (in 
/usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==4773==    by 0x495AD03: cpu::Array<int>* cpu::initArray<int>() 
(Array.cpp:162)
==4773==    by 0x525DEE4: retainHandle<int> (array.cpp:216)
==4773==    by 0x525DEE4: retain(void*) (array.cpp:227)
==4773==    by 0x525E32F: af_retain_array (array.cpp:245)
==4773==    by 0x55304C3: af::index::index(af::array const&) (index.cpp:71)
==4773==    by 0x1587DF: Indexing_SNIPPET_indexing_copy_Test::TestBody() 
(index.cpp:1259)
==4773==    by 0x291109: 
HandleSehExceptionsInMethodIfSupported<testing::Test, void> (gtest.cc:2443)
==4773==    by 0x291109: void 
testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, 
void>(testing::Test*, void (testing::Test::*)(), char const*) 
(gtest.cc:2479)
==4773==    by 0x28780B: testing::Test::Run() [clone .part.611] 
(gtest.cc:2517)
==4773==    by 0x287AB4: Run (gtest.cc:2509)
==4773==    by 0x287AB4: testing::TestInfo::Run() [clone .part.612] 
(gtest.cc:2693)
==4773==    by 0x287C53: Run (gtest.cc:2668)
==4773==    by 0x287C53: testing::TestCase::Run() [clone .part.613] 
(gtest.cc:2813)
==4773==    by 0x2882C2: Run (gtest.cc:2799)
==4773==    by 0x2882C2: testing::internal::UnitTestImpl::RunAllTests() 
(gtest.cc:5179)
==4773==    by 0x291619: 
HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, 
bool> (gtest.cc:2443)
==4773==    by 0x291619: bool 
testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, 
bool>(testing::internal::UnitTestImpl*, bool 
(testing::internal::UnitTestImpl::*)(), char const*) (gtest.cc:2479)

Message #22 received at 892288@bugs.debian.org (full text, mbox, reply):

From: "Rebecca N. Palmer" <rebecca_palmer@zoho.com>

To: 892288@bugs.debian.org

Subject: Re: arrayfire test crash

Date: Tue, 5 Feb 2019 22:32:45 +0000

Control: tags -1 fixed-upstream patch

These look like the upstream fixes, though I haven't actually tried them 
yet.

for index:

https://github.com/arrayfire/arrayfire/commit/58ac59497b50257631713e689a6b0ddffb73361a

for assign:

https://github.com/arrayfire/arrayfire/commit/1b18226dfec811e4b7b7254f5cfc85a3116a3dc2

Message #29 received at 892288@bugs.debian.org (full text, mbox, reply):

From: "Rebecca N. Palmer" <rebecca_palmer@zoho.com>

To: 892288@bugs.debian.org

Subject: Re: arrayfire test crash

Date: Wed, 6 Feb 2019 20:33:23 +0000

On i386 with the above patches (plus the gcc8 build fix from the other 
bug), all tests pass in the build but Test_gfor_cpu fails in the 
autopkgtest; I don't yet know why.

Send a report that this bug log contains spam.