Package: pybind11-dev Version: 3.0.1-3 Severity: important X-Debbugs-Cc: [email protected]
Dear Maintainer, Imported from Ubuntu bug https://bugs.launchpad.net/ubuntu/+source/pybind11/+bug/2164501 >From 3.0.0 to 3.0.2, pybind11 has a regression causing crashes during >interpreter shutdown with `py::enum_<>` by duplicating late-added >`def_property_static` argument strings and `function_record` heap-type >deallocation to call `PyObject_Free()` and decref the type. This was first reported in #2163679 where autopkgtest was failing for ecflow with a `free(): invalid pointer` crash. This can be better seen in the stacktrace: ... #7 malloc_printerr (str=<optimized out>) at ./malloc/malloc.c:5341 No locals. #8 0x00007ffff7cb0b44 in malloc_printerr_tail (str=<optimized out>) at ./malloc/malloc.c:5358 No locals. #9 0x00007ffff6d47e6c in pybind11::cpp_function::destruct (rec=0xd940e0, free_strings=true) at /usr/include/pybind11/pybind11.h:769 arg = @0xd94290: {name = 0x7ffff72523e7 "self", descr = 0x0, value = {<pybind11::detail::object_api<pybind11::handle>> = {<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>}, m_ptr = 0x0}, convert = true, none = false} __for_range = std::vector of length 1, capacity 1 = {{name = 0x7ffff72523e7 "self", descr = 0x0, value = {<pybind11::detail::object_api<pybind11::handle>> = {<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>}, m_ptr = 0x0}, convert = true, none = false}} __for_begin = <optimized out> __for_end = <optimized out> next = 0x0 #10 pybind11::detail::function_record_PyTypeObject_methods::tp_dealloc_impl (self=0x7ffff68e97d0) at /usr/include/pybind11/pybind11.h:1250 py_func_rec = 0x7ffff68e97d0 #11 0x0000000000514c33 in _Py_Dealloc () No symbol table info available. #12 0x0000000000537d59 in ?? () No symbol table info available. #13 0x0000000000514c33 in _Py_Dealloc () No symbol table info available. #14 0x0000000000691dc3 in ?? () No symbol table info available. ... After some digging I found this upstream PR [1] that introduced a latent bug where a `free()` is called on string-literals. This was then noted by the following upstream issues [2] and [3], and addressed with the following PRs [4] and [5]. The eventual stable version of pybind11 is 3.0.3 (see: [6]). Since the current version of pybind11 for both Resolute and Stonking is 3.0.1-3, it can be assumed that all the following reverse-dependencies are affected (reverse-depends -b pybind11-dev) in both Resolute and Stonking: - adios2 - amgcl - aoflagger - bespokesynth - camitk - cctbx - darkradiant - dart - dm-tree - dolfin - ecflow - freecad - gnuradio - gr-limesdr - gridtools - gtsam - gudhi - halide - kms++ - netgen - nmodl - odil - open3d - opencc - opencolorio - opengv - openimageio - opm-common - opm-simulators - orocos-kdl - pybind11-json - pycuda - pyosmium - pytango - python-awkward - python-boost-histogram - python-laszip - python-mapbox-earcut - python-samplerate - pytorch - pytorch-audio - pytorch-cluster - pytorch-rocm - pytorch-scatter - pytorch-sparse - scikit-build-core - sfst - simgrid - spglib - tinyobjloader - votca - xeus-python - xrt - ycmd 1. https://github.com/pybind/pybind11/pull/5486 2. https://github.com/pybind/pybind11/issues/5976 3. https://github.com/pybind/pybind11/issues/5991 4. https://github.com/pybind/pybind11/pull/6010 5. https://github.com/pybind/pybind11/pull/6015 6. https://github.com/pybind/pybind11/releases#release-v3.0.3 -- debian-science-maintainers mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-science-maintainers
