Re: [Pyode-user] bug: read from free'd memory when joint in jointgroup

[Chris B. <chr...@gm...>]

On 15/08/06, Chris Bainbridge <chr...@gm...> wrote:
> On 15/08/06, Matthias Baas <ba...@ir...> wrote:
> > Could it be that you had a JointGroup object that you didn't empty
> > explicitly (by calling the empty() method)?
> > In this case, the destructor of the JointGroup object only calls
> > dJointGroupDestroy() without notifying the contained Python joints about
> > the destruction of the ODE joints.
> > I have just committed a fix for this. Let me know if this has also fixed
> > your problem.

Argh, I spoke too soon. It fixed the problem, mostly, but I am still
getting double frees. I think the problem now is that dWorldDestroy is
destroying all of the joints that aren't part of a joint group, and
then the destructors again get called by pyode when the joint object
is freed. From your fix it looks like every python Joint object that
isn't in a group will have to be notified about the destruction of the
underlying object in World.__dealloc__

Log:

==3141== Invalid free() / delete / delete[]
==3141==    at 0x401C12D: free (in
/usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==3141==    by 0x463A2AB: dJointDestroy (ode.cpp:989)
==3141==    by 0x45EA930: __pyx_tp_dealloc_3ode_Joint (ode_trimesh.c:5613)
==3141==    by 0x45D8169: __pyx_tp_dealloc_3ode_AMotor (ode_trimesh.c:16542)
==3141==    by 0x409259C: (within /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x407F117: PyDict_Clear (in /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x4081032: (within /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x40DB82F: (within /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x40DC0C5: PyGC_Collect (in /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x40D4EC5: Py_Finalize (in /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x40D3EF9: Py_Exit (in /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x40D3FC1: (within /usr/lib/libpython2.4.so.1.0)
==3141==  Address 0x4BA88B0 is 0 bytes inside a block of size 560 free'd
==3141==    at 0x401C12D: free (in
/usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==3141==    by 0x463B907: dWorldDestroy (ode.cpp:1266)
==3141==    by 0x45E122A: __pyx_tp_dealloc_3ode_World (ode_trimesh.c:2366)
==3141==    by 0x45E83FA: __pyx_tp_dealloc_3ode_Body (ode_trimesh.c:14884)
==3141==    by 0x45EA8A7: __pyx_tp_dealloc_3ode_Joint (ode_trimesh.c:15277)
==3141==    by 0x45D7E4B: __pyx_tp_dealloc_3ode_HingeJoint (ode_trimesh.c:15619)
==3141==    by 0x407F2E9: (within /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x45F679E: __pyx_tp_dealloc_3ode_GeomObject (ode_trimesh.c:16716)
==3141==    by 0x45D869F: __pyx_tp_dealloc_3ode_GeomCCylinder
(ode_trimesh.c:17976)
==3141==    by 0x407F117: PyDict_Clear (in /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x4081032: (within /usr/lib/libpython2.4.so.1.0)
==3141==    by 0x40DB82F: (within /usr/lib/libpython2.4.so.1.0)