Re: [osg-users] osg(terrain) krasches on a double delete

Mon, 20 Aug 2012 08:29:43 -0700 

Bump. I would really appreciate some info on this problem.
The double delete originates from the DatabasePager, but the destruction of these objects should be safe(ref counted as well as threadsafe) shouldn't it? I would be grateful if someone could take a look at the stacktrace (prev post, below) and see if there is anything suspicious going on. 

Cheers,

Ola


On Fri, 10 Aug 2012 11:01:49 +0200, Ola Nilsson <o...@weatherone.tv> wrote:


I have now also reproduced the crash on darwin/osx in i386 mode.

Cheers,

Ola
On Thu, 09 Aug 2012 17:41:12 +0200, Ola Nilsson <o...@weatherone.tv> wrote: 


Here is some more info on how to reproduce our crash.

1. Compile the attached osgterrain program by overwriting
examples/osgterrain/osgterrain.cpp and recompile.
2. Run the program with
http://www.openscenegraph.org/data/earth_bayarea/earth.ive as input.
3. Wait (no further input is necessary). However, camera movement (tile
loading) produces earlier crashes. The attached image shows performance of 
a typical run (without user input) where the frame time cyclically
increases until the program crashes.

Cheers,

Ola

ps. The output from the program is: iteration sample_ratio frame_time
On Tue, 07 Aug 2012 11:59:00 +0200, Ola Nilsson <o...@weatherone.tv> wrote: 


Hi,

We have been looking for a hard-to-reproduce crash in our software that
seems to originate from a double delete inside osg. I have (finally)
been able to reproduce the crash using a version of the
osgterrain-example that _exaggerates_ the usage pattern that crashes our 
application.

In examples/osgterrain.cpp remove "return viwer.run();" an exchange it
with:

   while(!viewer.done())
     {
        osg::Timer_t start_tick = osg::Timer::instance()->tick();
        float sr = rand() * 1.0 / RAND_MAX ;
        std::cerr << sr;
        
        viewer.getCamera()->setLODScale(sr*10);
        terrain->setSampleRatio( sr );       

        osg::Timer_t middle_tick = osg::Timer::instance()->tick();
        
        std::cerr << osg::Timer::instance()->delta_m(start_tick, middle_tick)
<< std::flush;

        viewer.frame();
        std::cerr << ' ' << osg::Timer::instance()->delta_m(middle_tick,
osg::Timer::instance()->tick()) << std::endl;
     }
   return 0;

When run (tested on ive earth models generated with osgdem) the frame
time slowly increases, and, after a while, it warns about deleting a
still referenced object and then (after arbitrary time) crashes with a
glibc error.

Is this usage (setLODScale + setSampleRatio) safe? If not how should
these functions be called?

If it's a bug, we would be _very_ happy to have it fixed or pointers
about where to look in the code. We've previously submitted a patch that 
switched to a ReentrantMutex in osgTerrain/Terrain.cpp (changeset
12904), could this be a similar issue?

My system is running Centos 6.3 (x86_64) and I compiled osg in debug
mode with gcc 4.4.6. I have tested both against the 3.0.1 tag and trunk
(r13106).

Since I suspect a threading issue; OpenThreads/Config looks like this:
#define _OPENTHREADS_ATOMIC_USE_GCC_BUILTINS
/* #undef _OPENTHREADS_ATOMIC_USE_MIPOSPRO_BUILTINS */
/* #undef _OPENTHREADS_ATOMIC_USE_SUN */
/* #undef _OPENTHREADS_ATOMIC_USE_WIN32_INTERLOCKED */
/* #undef _OPENTHREADS_ATOMIC_USE_BSD_ATOMIC */
/* #undef _OPENTHREADS_ATOMIC_USE_MUTEX */
/* #undef OT_LIBRARY_STATIC */

If I set a break point in the warning for deleting still referenced I
get the following stack trace (using the osg 3.0.1 tag):

Breakpoint 1, osg::Referenced::~Referenced (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:236
236             OSG_WARN<<"Warning: deleting still referenced object
"<<this<<" of type '"<<typeid(this).name()<<"'"<<std::endl;
(gdb) bt
#0  osg::Referenced::~Referenced (this=0xaec2160, __in_chrg=<value
optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:236
#1  0x00007ffff79e467c in osg::Object::~Object (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Object.cpp:45
#2  0x00007ffff79dd71d in osg::Node::~Node (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Node.cpp:94
#3  0x00007ffff7993953 in osg::Group::~Group (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#4  0x00007ffff5df4ae8 in osgTerrain::TerrainTile::~TerrainTile
(this=0xaec2160, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osgTerrain/TerrainTile.cpp:95
#5  0x00007ffff5df4b1e in osgTerrain::TerrainTile::~TerrainTile
(this=0xaec2160, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osgTerrain/TerrainTile.cpp:95
#6  0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0xaec2160, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#7  0x000000000040b07d in osg::Referenced::unref (this=0xaec2160) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#8  0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0x478d410, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#9  0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0x478d410) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#10 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d410, __last=0x478d418) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#11 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d410, __last=0x478d418) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#12 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0x478d410, __last=0x478d418)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#13 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0xaec1fd8,
__in_chrg=<value optimized out>)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#14 0x00007ffff7993926 in osg::Group::~Group (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#15 0x00007ffff79c9838 in osg::LOD::~LOD (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/LOD:127
#16 0x00007ffff79f56ea in osg::PagedLOD::~PagedLOD (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#17 0x00007ffff79f5720 in osg::PagedLOD::~PagedLOD (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#18 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0xaec1f20, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#19 0x000000000040b07d in osg::Referenced::unref (this=0xaec1f20) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#20 0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0x478d590, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#21 0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0x478d590) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#22 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d590, __last=0x478d5a0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#23 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d580, __last=0x478d5a0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#24 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0x478d580, __last=0x478d5a0)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#25 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0xaf84d48,
__in_chrg=<value optimized out>)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#26 0x00007ffff7993926 in osg::Group::~Group (this=0xaf84c90,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#27 0x00007ffff799398a in osg::Group::~Group (this=0xaf84c90,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#28 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0xaf84c90, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#29 0x000000000040b07d in osg::Referenced::unref (this=0xaf84c90) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#30 0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0xb9cf88, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#31 0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0xb9cf88) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#32 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0xb9cf88, __last=0xb9cf90) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#33 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0xb9cf80, __last=0xb9cf90) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#34 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0xb9cf80, __last=0xb9cf90) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#35 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0x948df8,
__in_chrg=<value optimized out>)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#36 0x00007ffff7993926 in osg::Group::~Group (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#37 0x00007ffff79c9838 in osg::LOD::~LOD (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/LOD:127
#38 0x00007ffff79f56ea in osg::PagedLOD::~PagedLOD (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#39 0x00007ffff79f5720 in osg::PagedLOD::~PagedLOD (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#40 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0x948d40, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#41 0x000000000040b07d in osg::Referenced::unref (this=0x948d40) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#42 0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0xa78ba0, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#43 0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0xa78ba0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#44 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0xa78ba0, __last=0xa78bc0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#45 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0xa78ba0, __last=0xa78bc0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#46 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0xa78ba0, __last=0xa78bc0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#47 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0x962e78,
__in_chrg=<value optimized out>)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#48 0x00007ffff7993926 in osg::Group::~Group (this=0x962dc0,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#49 0x00007ffff799398a in osg::Group::~Group (this=0x962dc0,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#50 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0x962dc0, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#51 0x000000000040b07d in osg::Referenced::unref (this=0x962dc0) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#52 0x00007ffff78da577 in osg::ref_ptr<osg::Object>::~ref_ptr
(this=0x114d9e0, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
---Type <return> to continue, or q <return> to quit---
#53 0x00007ffff7aa602e in
__gnu_cxx::new_allocator<osg::ref_ptr<osg::Object> >::destroy
(this=0x7ffff366f9df, __p=0x114d9e0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/ext/new_allocator.h:115
#54 0x00007ffff72d85d3 in std::_List_base<osg::ref_ptr<osg::Object>,
std::allocator<osg::ref_ptr<osg::Object> > >::_M_clear
(this=0x7ffff366fca0)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/list.tcc:76
#55 0x00007ffff72d5a75 in std::_List_base<osg::ref_ptr<osg::Object>,
std::allocator<osg::ref_ptr<osg::Object> > >::~_List_base
(this=0x7ffff366fca0, __in_chrg=<value optimized out>)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_list.h:360
#56 0x00007ffff72d350c in std::list<osg::ref_ptr<osg::Object>,
std::allocator<osg::ref_ptr<osg::Object> > >::~list
(this=0x7ffff366fca0, __in_chrg=<value optimized out>)
     at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_list.h:418
#57 0x00007ffff72cafc6 in osgDB::DatabasePager::DatabaseThread::run
(this=0x632440) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osgDB/DatabasePager.cpp:738
#58 0x00007ffff7dfa5fd in OpenThreads::ThreadPrivateActions::StartThread 
(data=0x632458) at
/home/ola/src/OpenSceneGraph-3.0.1/src/OpenThreads/pthreads/PThread.cpp:181
#59 0x0000003994e07851 in start_thread () from /lib64/libpthread.so.0
#60 0x00000039942e76dd in clone () from /lib64/libc.so.6
(gdb)
(gdb)
(gdb) c
Continuing.
Warning: deleting still referenced object 0xaec2160 of type
'PN3osg10ReferencedE'
          the final reference count was 1, memory corruption possible.

*** glibc detected *** /home/ola/src/osg-3.0.1/bin/osgterraind: free():
invalid pointer: 0x000000000aec2160 ***

Cheers,

Ola

ps, I'll happily supply more data, stack traces, etc if needed.











--
Using Opera's revolutionary email client: http://www.opera.com/mail/
_______________________________________________
osg-users mailing list
osg-users@lists.openscenegraph.org
http://lists.openscenegraph.org/listinfo.cgi/osg-users-openscenegraph.org

Reply via email to