#9880: Segfault in PyNaC 0.2.0.p4
-------------------------+--------------------------------------------------
Reporter: jpflori | Owner: burcin
Type: defect | Status: needs_review
Priority: major | Milestone: sage-4.6.2
Component: symbolics | Keywords: pynac
Author: | Upstream: N/A
Reviewer: | Merged:
Work_issues: |
-------------------------+--------------------------------------------------
Comment(by jpflori):
The detailed description of the segfault mentionned here is available in
the discussion mentionned in the ticket description.
I'll put it here so that everybody finds it:
* the segfault happens in a call to std::sort() in a call to compare()
because the ordering used by pynac is not a strict weak ordering. so it is
kind of random. and I think youre bug is completely unrelated.
* the piece of code in the ticket description do not produce the segfault
anymore since sage 4.6.1 (still present in 4.6.0), however the order was
not changed, so it could still happen with other pieces of code, so here
is a backtrace produce with a previous version of sage:
!#0 GiNaC::power::compare (this=0x449be20, other=...) at !power.cpp:899
[[BR]] !#1 0x00007fffd7a9cc18 in void [[BR]]
std::!__unguarded_linear_insert<!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]] GiNaC::expair, [[BR]]
GiNaC::expair_rest_is_less>(!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]] GiNaC::expair, GiNaC::expair_rest_is_less) () [[BR]] from
/home/jp/boulot/thèse/sage/sage-4.5.2/local/lib/ [[BR]] libpynac-0.2.so.0
[[BR]] !#2 0x00007fffd7a9cefa in void [[BR]]
std::!__final_insertion_sort<!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]]
GiNaC::expair_rest_is_less>(!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]] !__gnu_cxx::!__normal_iterator<GiNaC::expair*, [[BR]]
std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >, [[BR]]
GiNaC::expair_rest_is_less) () from /home/jp/boulot/thèse/sage/ [[BR]]
sage-4.5.2/local/lib/libpynac-0.2.so.0 [[BR]] !#3 0x00007fffd7a95657 in
[[BR]] sort<!__gnu_cxx::!__normal_iterator<GiNaC::expair*, [[BR]]
std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >, [[BR]]
GiNaC::expair_rest_is_less> (this=<value optimized out>) at /usr/ [[BR]]
include/c++/4.4/bits/!stl_algo.h:5260 [[BR]] !#4
GiNaC::expairseq::canonicalize (this=<value optimized out>) at [[BR]]
!expairseq.cpp:1177 [[BR]] !#5 0x00007fffd7a994a4 in
GiNaC::expairseq::construct_from_epvector [[BR]] (this=0x44a5070, v=<value
optimized out>, [[BR]] do_index_renaming=<value optimized out>) at
!expairseq.cpp:1055 [[BR]] !#6 0x00007fffd7a58685 in GiNaC::add::add
(this=0x44a5070, vp=..., [[BR]] oc=<value optimized out>) at !add.cpp:100
[[BR]] !#7 0x00007fffd7a5871f in GiNaC::add::expand (this=0x449eb80,
[[BR]] options=<value optimized out>) at !add.cpp:669 [[BR]] !#8
0x00007fffd7a9231d in GiNaC::ex::expand (this=<value optimized [[BR]]
out>, options=3620337048) at !ex.cpp:78 [[BR]] !#9 0x00007fffd773e386 in
[[BR]] !__pyx_pf_4sage_8symbolic_10expression_10Expression_expand [[BR]]
(!__pyx_v_self=<value optimized out>, [[BR]] !__pyx_args=0x601160,
!__pyx_kwds=0x0) at sage/symbolic/ [[BR]] !expression.cpp:13604 [[BR]]
!#10 0x00007ffff7b107ca in call_function (f=0x44a4580, throwflag=<value
[[BR]] optimized out>) at Python/!ceval.c:3706 [[BR]] !#11
!PyEval_EvalFrameEx (f=0x44a4580, throwflag=<value optimized out>) [[BR]]
at Python/!ceval.c:2389 [[BR]] !#12 0x00007ffff7b124ad in
!PyEval_EvalCodeEx (co=0x79c4c0, [[BR]] globals=<value optimized out>,
locals=<value optimized out>, [[BR]] args=0x0, [[BR]] argcount=<value
optimized out>, kws=0x0, kwcount=0, defs=0x0, [[BR]] defcount=0,
closure=0x0) at Python/!ceval.c:2968 [[BR]] !#13 0x00007ffff7b12582 in
!PyEval_EvalCode (co=0x449be20, [[BR]] globals=0x1135200007879,
locals=0x7fffd7c9f598) at Python/!ceval.c:522 [[BR]] !#14
0x00007ffff7b3014c in run_mod ( [[BR]] . [[BR]] . [[BR]] . [[BR]]
And valgrind output also: [[BR]] ==27910== Invalid read of size 8 [[BR]]
==27910== at 0x282C4BF1: void [[BR]]
std::!__unguarded_linear_insert<!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]] GiNaC::expair, [[BR]]
GiNaC::expair_rest_is_less>(!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]] GiNaC::expair, GiNaC::expair_rest_is_less) (!ptr.h:99) [[BR]]
==27910== by 0x282C4EF9: void [[BR]]
std::!__final_insertion_sort<!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]]
GiNaC::expair_rest_is_less>(!__gnu_cxx::!__normal_iterator<GiNaC::expair*,
[[BR]] std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >,
[[BR]] !__gnu_cxx::!__normal_iterator<GiNaC::expair*, [[BR]]
std::vector<GiNaC::expair, std::allocator<GiNaC::expair> > >, [[BR]]
GiNaC::expair_rest_is_less) (!stl_algo.h:2161) [[BR]] ==27910== by
0x282BD656: GiNaC::expairseq::canonicalize() [[BR]] (!stl_algo.h:5260)
[[BR]] ==27910== by 0x282C14A3: [[BR]]
GiNaC::expairseq::construct_from_epvector(std::vector<GiNaC::expair,
[[BR]] std::allocator<GiNaC::expair> > const&, bool) (!expairseq.cpp:1055)
[[BR]] ==27910== by 0x28280684: [[BR]]
GiNaC::add::add(std::auto_ptr<std::vector<GiNaC::expair, [[BR]]
std::allocator<GiNaC::expair> > >, GiNaC::ex const&) (!add.cpp:100) [[BR]]
==27910== by 0x2828071E: GiNaC::add::expand(unsigned int) const [[BR]]
(!add.cpp:669) [[BR]] ==27910== by 0x282BA31C:
GiNaC::ex::expand(unsigned int) const [[BR]] (!ex.cpp:78) [[BR]] ==27910==
by 0x28811385: [[BR]]
!__pyx_pf_4sage_8symbolic_10expression_10Expression_expand(_object*,
[[BR]] _object*, _object*) (!expression.cpp:13604) [[BR]] ==27910== by
0x4F137C9: !PyEval_EvalFrameEx (!ceval.c:3706) [[BR]] ==27910== by
0x4F154AC: !PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by
0x4F15581: !PyEval_EvalCode (!ceval.c:522) [[BR]] ==27910== by
0x4F3314B: !PyRun_StringFlags (!pythonrun.c:1335) [[BR]] ==27910== by
0x4F122DD: !PyEval_EvalFrameEx (!ceval.c:4437) [[BR]] ==27910== by
0x4F154AC: !PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by
0x4E9BDDE: function_call (!funcobject.c:524) [[BR]] ==27910== by
0x4E6FAA2: !PyObject_Call (!abstract.c:2492) [[BR]] ==27910== by
0xD7E0981: [[BR]] !__pyx_pf_4sage_9structure_11sage_object_load
(!sage_object.c:7304) [[BR]] ==27910== by 0x4F137C9:
!PyEval_EvalFrameEx (!ceval.c:3706) [[BR]] ==27910== by 0x4F154AC:
!PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by 0x4F15581:
!PyEval_EvalCode (!ceval.c:522) [[BR]] ==27910== by 0x4F14853:
!PyEval_EvalFrameEx (!ceval.c:4401) [[BR]] ==27910== by 0x4F154AC:
!PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by 0x4F13844:
!PyEval_EvalFrameEx (!ceval.c:3802) [[BR]] ==27910== by 0x4F154AC:
!PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by 0x4F13844:
!PyEval_EvalFrameEx (!ceval.c:3802) [[BR]] ==27910== Address 0x97e4280 is
16 bytes before a block of size 416 [[BR]] alloc'd [[BR]] ==27910== at
0x4C24CCC: operator new(unsigned long) [[BR]] (!vg_replace_malloc.c:220)
[[BR]] ==27910== by 0x28286727: std::vector<GiNaC::expair, [[BR]]
std::allocator<GiNaC::expair> >::reserve(unsigned long) [[BR]]
(!new_allocator.h:89) [[BR]] ==27910== by 0x282C0D4A: [[BR]]
GiNaC::expairseq::make_flat(std::vector<GiNaC::expair, [[BR]]
std::allocator<GiNaC::expair> > const&, bool) (!expairseq.cpp:1138) [[BR]]
==27910== by 0x282C149B: [[BR]]
GiNaC::expairseq::construct_from_epvector(std::vector<GiNaC::expair,
[[BR]] std::allocator<GiNaC::expair> > const&, bool) (!expairseq.cpp:1051)
[[BR]] ==27910== by 0x28280684: [[BR]]
GiNaC::add::add(std::auto_ptr<std::vector<GiNaC::expair, [[BR]]
std::allocator<GiNaC::expair> > >, GiNaC::ex const&) (!add.cpp:100) [[BR]]
==27910== by 0x2828071E: GiNaC::add::expand(unsigned int) const [[BR]]
(!add.cpp:669) [[BR]] ==27910== by 0x282BA31C:
GiNaC::ex::expand(unsigned int) const [[BR]] (!ex.cpp:78) [[BR]] ==27910==
by 0x28811385: [[BR]]
!__pyx_pf_4sage_8symbolic_10expression_10Expression_expand(_object*,
[[BR]] _object*, _object*) (!expression.cpp:13604) [[BR]] ==27910== by
0x4F137C9: !PyEval_EvalFrameEx (!ceval.c:3706) [[BR]] ==27910== by
0x4F154AC: !PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by
0x4F15581: !PyEval_EvalCode (!ceval.c:522) [[BR]] ==27910== by
0x4F3314B: !PyRun_StringFlags (!pythonrun.c:1335) [[BR]] ==27910== by
0x4F122DD: !PyEval_EvalFrameEx (!ceval.c:4437) [[BR]] ==27910== by
0x4F154AC: !PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by
0x4E9BDDE: function_call (!funcobject.c:524) [[BR]] ==27910== by
0x4E6FAA2: !PyObject_Call (!abstract.c:2492) [[BR]] ==27910== by
0xD7E0981: [[BR]] !__pyx_pf_4sage_9structure_11sage_object_load
(!sage_object.c:7304) [[BR]] ==27910== by 0x4F137C9:
!PyEval_EvalFrameEx (!ceval.c:3706) [[BR]] ==27910== by 0x4F154AC:
!PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by 0x4F15581:
!PyEval_EvalCode (!ceval.c:522) [[BR]] ==27910== by 0x4F14853:
!PyEval_EvalFrameEx (!ceval.c:4401) [[BR]] ==27910== by 0x4F154AC:
!PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by 0x4F13844:
!PyEval_EvalFrameEx (!ceval.c:3802) [[BR]] ==27910== by 0x4F154AC:
!PyEval_EvalCodeEx (!ceval.c:2968) [[BR]] ==27910== by 0x4F13844:
!PyEval_EvalFrameEx (!ceval.c:3802)
--
Ticket URL: <http://trac.sagemath.org/sage_trac/ticket/9880#comment:17>
Sage <http://www.sagemath.org>
Sage: Creating a Viable Open Source Alternative to Magma, Maple, Mathematica,
and MATLAB
--
You received this message because you are subscribed to the Google Groups
"sage-trac" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/sage-trac?hl=en.
