Hi,
We have been looking for a hard-to-reproduce crash in our software that
seems to originate from a double delete inside osg. I have (finally)
been able to reproduce the crash using a version of the
osgterrain-example that _exaggerates_ the usage pattern that crashes our
application.
In examples/osgterrain.cpp remove "return viwer.run();" an exchange it
with:
while(!viewer.done())
{
osg::Timer_t start_tick = osg::Timer::instance()->tick();
float sr = rand() * 1.0 / RAND_MAX ;
std::cerr << sr;
viewer.getCamera()->setLODScale(sr*10);
terrain->setSampleRatio( sr );
osg::Timer_t middle_tick = osg::Timer::instance()->tick();
std::cerr << osg::Timer::instance()->delta_m(start_tick, middle_tick)
<< std::flush;
viewer.frame();
std::cerr << ' ' << osg::Timer::instance()->delta_m(middle_tick,
osg::Timer::instance()->tick()) << std::endl;
}
return 0;
When run (tested on ive earth models generated with osgdem) the frame
time slowly increases, and, after a while, it warns about deleting a
still referenced object and then (after arbitrary time) crashes with a
glibc error.
Is this usage (setLODScale + setSampleRatio) safe? If not how should
these functions be called?
If it's a bug, we would be _very_ happy to have it fixed or pointers
about where to look in the code. We've previously submitted a patch that
switched to a ReentrantMutex in osgTerrain/Terrain.cpp (changeset
12904), could this be a similar issue?
My system is running Centos 6.3 (x86_64) and I compiled osg in debug
mode with gcc 4.4.6. I have tested both against the 3.0.1 tag and trunk
(r13106).
Since I suspect a threading issue; OpenThreads/Config looks like this:
#define _OPENTHREADS_ATOMIC_USE_GCC_BUILTINS
/* #undef _OPENTHREADS_ATOMIC_USE_MIPOSPRO_BUILTINS */
/* #undef _OPENTHREADS_ATOMIC_USE_SUN */
/* #undef _OPENTHREADS_ATOMIC_USE_WIN32_INTERLOCKED */
/* #undef _OPENTHREADS_ATOMIC_USE_BSD_ATOMIC */
/* #undef _OPENTHREADS_ATOMIC_USE_MUTEX */
/* #undef OT_LIBRARY_STATIC */
If I set a break point in the warning for deleting still referenced I
get the following stack trace (using the osg 3.0.1 tag):
Breakpoint 1, osg::Referenced::~Referenced (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:236
236 OSG_WARN<<"Warning: deleting still referenced object
"<<this<<" of type '"<<typeid(this).name()<<"'"<<std::endl;
(gdb) bt
#0 osg::Referenced::~Referenced (this=0xaec2160, __in_chrg=<value
optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:236
#1 0x00007ffff79e467c in osg::Object::~Object (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Object.cpp:45
#2 0x00007ffff79dd71d in osg::Node::~Node (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Node.cpp:94
#3 0x00007ffff7993953 in osg::Group::~Group (this=0xaec2160,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#4 0x00007ffff5df4ae8 in osgTerrain::TerrainTile::~TerrainTile
(this=0xaec2160, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osgTerrain/TerrainTile.cpp:95
#5 0x00007ffff5df4b1e in osgTerrain::TerrainTile::~TerrainTile
(this=0xaec2160, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osgTerrain/TerrainTile.cpp:95
#6 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0xaec2160, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#7 0x000000000040b07d in osg::Referenced::unref (this=0xaec2160) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#8 0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0x478d410, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#9 0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0x478d410) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#10 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d410, __last=0x478d418) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#11 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d410, __last=0x478d418) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#12 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0x478d410, __last=0x478d418)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#13 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0xaec1fd8,
__in_chrg=<value optimized out>)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#14 0x00007ffff7993926 in osg::Group::~Group (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#15 0x00007ffff79c9838 in osg::LOD::~LOD (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/LOD:127
#16 0x00007ffff79f56ea in osg::PagedLOD::~PagedLOD (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#17 0x00007ffff79f5720 in osg::PagedLOD::~PagedLOD (this=0xaec1f20,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#18 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0xaec1f20, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#19 0x000000000040b07d in osg::Referenced::unref (this=0xaec1f20) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#20 0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0x478d590, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#21 0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0x478d590) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#22 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d590, __last=0x478d5a0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#23 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0x478d580, __last=0x478d5a0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#24 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0x478d580, __last=0x478d5a0)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#25 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0xaf84d48,
__in_chrg=<value optimized out>)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#26 0x00007ffff7993926 in osg::Group::~Group (this=0xaf84c90,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#27 0x00007ffff799398a in osg::Group::~Group (this=0xaf84c90,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#28 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0xaf84c90, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#29 0x000000000040b07d in osg::Referenced::unref (this=0xaf84c90) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#30 0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0xb9cf88, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#31 0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0xb9cf88) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#32 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0xb9cf88, __last=0xb9cf90) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#33 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0xb9cf80, __last=0xb9cf90) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#34 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0xb9cf80, __last=0xb9cf90) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#35 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0x948df8,
__in_chrg=<value optimized out>)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#36 0x00007ffff7993926 in osg::Group::~Group (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#37 0x00007ffff79c9838 in osg::LOD::~LOD (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/LOD:127
#38 0x00007ffff79f56ea in osg::PagedLOD::~PagedLOD (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#39 0x00007ffff79f5720 in osg::PagedLOD::~PagedLOD (this=0x948d40,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/PagedLOD.cpp:73
#40 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0x948d40, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#41 0x000000000040b07d in osg::Referenced::unref (this=0x948d40) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#42 0x000000000040cd3b in osg::ref_ptr<osg::Node>::~ref_ptr
(this=0xa78ba0, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
#43 0x00007ffff799627e in std::_Destroy<osg::ref_ptr<osg::Node> >
(__pointer=0xa78ba0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:83
#44 0x00007ffff7996084 in
std::_Destroy_aux<false>::__destroy<osg::ref_ptr<osg::Node>*>
(__first=0xa78ba0, __last=0xa78bc0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:93
#45 0x00007ffff7995dcf in std::_Destroy<osg::ref_ptr<osg::Node>*>
(__first=0xa78ba0, __last=0xa78bc0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:116
#46 0x00007ffff7995847 in std::_Destroy<osg::ref_ptr<osg::Node>*,
osg::ref_ptr<osg::Node> > (__first=0xa78ba0, __last=0xa78bc0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_construct.h:142
#47 0x00007ffff7994e56 in std::vector<osg::ref_ptr<osg::Node>,
std::allocator<osg::ref_ptr<osg::Node> > >::~vector (this=0x962e78,
__in_chrg=<value optimized out>)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_vector.h:313
#48 0x00007ffff7993926 in osg::Group::~Group (this=0x962dc0,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#49 0x00007ffff799398a in osg::Group::~Group (this=0x962dc0,
__in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Group.cpp:53
#50 0x00007ffff7a131a6 in osg::Referenced::signalObserversAndDelete
(this=0x962dc0, signalDelete=true, doDelete=true) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osg/Referenced.cpp:323
#51 0x000000000040b07d in osg::Referenced::unref (this=0x962dc0) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/Referenced:198
#52 0x00007ffff78da577 in osg::ref_ptr<osg::Object>::~ref_ptr
(this=0x114d9e0, __in_chrg=<value optimized out>) at
/home/ola/src/OpenSceneGraph-3.0.1/include/osg/ref_ptr:35
---Type <return> to continue, or q <return> to quit---
#53 0x00007ffff7aa602e in
__gnu_cxx::new_allocator<osg::ref_ptr<osg::Object> >::destroy
(this=0x7ffff366f9df, __p=0x114d9e0) at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/ext/new_allocator.h:115
#54 0x00007ffff72d85d3 in std::_List_base<osg::ref_ptr<osg::Object>,
std::allocator<osg::ref_ptr<osg::Object> > >::_M_clear
(this=0x7ffff366fca0)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/list.tcc:76
#55 0x00007ffff72d5a75 in std::_List_base<osg::ref_ptr<osg::Object>,
std::allocator<osg::ref_ptr<osg::Object> > >::~_List_base
(this=0x7ffff366fca0, __in_chrg=<value optimized out>)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_list.h:360
#56 0x00007ffff72d350c in std::list<osg::ref_ptr<osg::Object>,
std::allocator<osg::ref_ptr<osg::Object> > >::~list
(this=0x7ffff366fca0, __in_chrg=<value optimized out>)
at
/usr/lib/gcc/x86_64-redhat-linux/4.4.6/../../../../include/c++/4.4.6/bits/stl_list.h:418
#57 0x00007ffff72cafc6 in osgDB::DatabasePager::DatabaseThread::run
(this=0x632440) at
/home/ola/src/OpenSceneGraph-3.0.1/src/osgDB/DatabasePager.cpp:738
#58 0x00007ffff7dfa5fd in OpenThreads::ThreadPrivateActions::StartThread
(data=0x632458) at
/home/ola/src/OpenSceneGraph-3.0.1/src/OpenThreads/pthreads/PThread.cpp:181
#59 0x0000003994e07851 in start_thread () from /lib64/libpthread.so.0
#60 0x00000039942e76dd in clone () from /lib64/libc.so.6
(gdb)
(gdb)
(gdb) c
Continuing.
Warning: deleting still referenced object 0xaec2160 of type
'PN3osg10ReferencedE'
the final reference count was 1, memory corruption possible.
*** glibc detected *** /home/ola/src/osg-3.0.1/bin/osgterraind: free():
invalid pointer: 0x000000000aec2160 ***
Cheers,
Ola
ps, I'll happily supply more data, stack traces, etc if needed.
