Freed-memory write in AtomicXQType

Bug #1097101 reported by Chris Hillery
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Zorba
Fix Released
Critical
Markos Zaharioudakis

Bug Description

Not sure when this cropped up, although I'm nearly sure it wasn't in Zorba 2.7.

Running pretty much any Zorba test through valgrind will report an Invalid Pointer Write during Zorba shutdown. For instance, run

  ctest -R numerics/comp01 -V -T MemCheck

(Linux only). I'll attach the full stack trace.

Revision history for this message
Chris Hillery (ceejatec) wrote :
Download full text (6.7 KiB)

921: ==16746== Invalid read of size 8
921: ==16746== at 0x5C138C4: zorba::SimpleRCObject::removeReference(zorba::RCLock*) (rchandle.h:149)
921: ==16746== by 0x5C344C2: zorba::rchandle<zorba::XQType>::~rchandle() (rchandle.h:201)
921: ==16746== by 0x5C34474: zorba::const_rchandle<zorba::XQType>::~const_rchandle() (rchandle.h:367)
921: ==16746== by 0x5C2B2E4: zorba::const_rchandle<zorba::XQType>::~const_rchandle() (rchandle.h:367)
921: ==16746== by 0x6897D4C: zorba::UserDefinedXQType::~UserDefinedXQType() (typeimpl.h:759)
921: ==16746== by 0x6895FF4: zorba::UserDefinedXQType::~UserDefinedXQType() (typeimpl.h:759)
921: ==16746== by 0x6896017: zorba::UserDefinedXQType::~UserDefinedXQType() (typeimpl.h:759)
921: ==16746== by 0x6895A9A: zorba::XQType::free() (typeimpl.h:338)
921: ==16746== by 0x5C138F0: zorba::SimpleRCObject::removeReference(zorba::RCLock*) (rchandle.h:151)
921: ==16746== by 0x5C344C2: zorba::rchandle<zorba::XQType>::~rchandle() (rchandle.h:201)
921: ==16746== by 0x5C34474: zorba::const_rchandle<zorba::XQType>::~const_rchandle() (rchandle.h:367)
921: ==16746== by 0x5C2B2E4: zorba::const_rchandle<zorba::XQType>::~const_rchandle() (rchandle.h:367)
921: ==16746== by 0x688737F: zorba::RootTypeManager::~RootTypeManager() (in /home/ceej/zo/src/build/src/libzorba_simplestore.so.2.7.0)
921: ==16746== by 0x6880DA7: zorba::RootTypeManager::~RootTypeManager() (root_typemanager.cpp:549)
921: ==16746== by 0x5C5709D: zorba::SimpleRCObject::free() (rchandle.h:141)
921: ==16746== by 0x5C138F0: zorba::SimpleRCObject::removeReference(zorba::RCLock*) (rchandle.h:151)
921: ==16746== by 0x6011FBB: void zorba::RCHelper::removeReference<zorba::RootTypeManager>(zorba::RootTypeManager*) (rchandle.h:420)
921: ==16746== by 0x6011E8E: zorba::GlobalEnvironment::destroy() (globalenv.cpp:139)
921: ==16746== by 0x5C04808: zorba::ZorbaImpl::shutdownInternal(bool) (zorbaimpl.cpp:132)
921: ==16746== by 0x5C046B7: zorba::ZorbaImpl::~ZorbaImpl() (zorbaimpl.cpp:86)
921: ==16746== by 0xA779900: __run_exit_handlers (exit.c:78)
921: ==16746== by 0xA779984: exit (exit.c:100)
921: ==16746== by 0xA75F773: (below main) (libc-start.c:258)
921: ==16746== Address 0xb2d9978 is 8 bytes inside a block of size 40 free'd
921: ==16746== at 0x4C2A366: operator delete(void*) (vg_replace_malloc.c:457)
921: ==16746== by 0x6895D08: zorba::AtomicXQType::~AtomicXQType() (typeimpl.h:451)
921: ==16746== by 0x6886089: zorba::RootTypeManager::~RootTypeManager() (root_typemanager.cpp:626)
921: ==16746== by 0x6880DA7: zorba::RootTypeManager::~RootTypeManager() (root_typemanager.cpp:549)
921: ==16746== by 0x5C5709D: zorba::SimpleRCObject::free() (rchandle.h:141)
921: ==16746== by 0x5C138F0: zorba::SimpleRCObject::removeReference(zorba::RCLock*) (rchandle.h:151)
921: ==16746== by 0x6011FBB: void zorba::RCHelper::removeReference<zorba::RootTypeManager>(zorba::RootTypeManager*) (rchandle.h:420)
921: ==16746== by 0x6011E8E: zorba::GlobalEnvironment::destroy() (globalenv.cpp:139)
921: ==16746== by 0x5C04808: zorba::ZorbaImpl::shutdownInternal(bool) (zorbaimpl.cpp:132)
921: ==16746== by 0x5C046B7: zorba::Z...

Read more...

Changed in zorba:
importance: Undecided → Critical
milestone: none → 2.8
assignee: nobody → Markos Zaharioudakis (markos-za)
Revision history for this message
Chris Hillery (ceejatec) wrote :

Assigning to Markos as he wrote or approved most of the recent changes to root_typemanager.cpp, although I can't be sure that is the location of the problem.

Changed in zorba:
status: New → Fix Committed
Changed in zorba:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.