gnuplot-info

[Gnuplot-info] glibc detected double free

[Olaf T. <ola...@un...>]

Hi,

with gnuplot-4.4.0 and -4.4.3, and with the cvs version of 2011-03-31,
glibc detects a double free. This happens regularly with the same
types of commands (i.e. plotting certain data in a certain way from
Octave), but not reproducibly with an exact procedure. Maybe there is
a racing condition involved (?) (but Gnuplot probably gets the correct
commands over the pipe, since Octave writes to the pipe blocking),
since it does not occur from an ssh login.

The glibc message for the cvs version (2011-03-31) is
attached. addr2line translates the gnuplot-part of the backtrace
to the following lines of code:

unset_tics
/home/olaf/gnuplot-cvs/gnuplot/src/unset.c:1179

unset_minitics
/home/olaf/gnuplot-cvs/gnuplot/src/unset.c:1156

do_line
/home/olaf/gnuplot-cvs/gnuplot/src/command.c:382

com_line
/home/olaf/gnuplot-cvs/gnuplot/src/command.c:332

main
/home/olaf/gnuplot-cvs/gnuplot/src/plot.c:652


which seems weird to me, since unset_minitics does not seem to call
unset_tics; but gnuplot had been compiled with -O2. Compiled without
optimization, the double free did not occur for me as yet under
conditions which most likely would have led to this double free if
compiled with -O2.

Maybe you can make something of this ...

Regards, Olaf

Re: [Gnuplot-info] glibc detected double free

[Hans-Bernhard B. <HBB...@t-...>]

On 05.04.2011 20:07, Olaf Till wrote:

> with gnuplot-4.4.0 and -4.4.3, and with the cvs version of 2011-03-31,
> glibc detects a double free. This happens regularly with the same
> types of commands (i.e. plotting certain data in a certain way from
> Octave), but not reproducibly with an exact procedure. Maybe there is
> a racing condition involved (?) (but Gnuplot probably gets the correct
> commands over the pipe, since Octave writes to the pipe blocking),
> since it does not occur from an ssh login.

Any chance you could exercise that with valgrind, too?  The reports from 
valgrind are much more detailed.

In the case at hand, that backtrace is quite obviously broken.

> unset_tics
> /home/olaf/gnuplot-cvs/gnuplot/src/unset.c:1179
>
> unset_minitics
> /home/olaf/gnuplot-cvs/gnuplot/src/unset.c:1156

> which seems weird to me, since unset_minitics does not seem to call
> unset_tics;

Not only does it not call unset_tics() --- it doesn't call _any_ function.

 > but gnuplot had been compiled with -O2.

That really doesn't matter.  What we're looking at here must be 
something else.  That call stack got corrupted before glibc got to 
analyse it properly.

Re: [Gnuplot-info] glibc detected double free

[Olaf T. <ola...@un...>]

On Tue, Apr 05, 2011 at 11:10:09PM +0200, Hans-Bernhard Bröker wrote:
> Any chance you could exercise that with valgrind, too?  The reports
> from valgrind are much more detailed.

I've arranged gnuplot to be called with valgrind, but, unfortunately,
under these conditions the problem is not triggerd. (As it was not
triggered from an ssh login and if the gnuplot code was compiled
without optimization.)

Olaf