** Description changed:
Since 3.0.0 to 3.0.2, pybind11 has a regression causing crashes during
interpreter shutdown with `py::enum_<>` by duplicating late-added
`def_property_static` argument strings and `function_record` heap-type
deallocation to call `PyObject_Free()` and decref the type.
This was first reported in #2163679 where autopkgtest was failing for
ecflow with a `free(): invalid pointer` crash. This can be better seen
in the stacktrace:
...
#7 malloc_printerr (str=<optimized out>) at ./malloc/malloc.c:5341
No locals.
#8 0x00007ffff7cb0b44 in malloc_printerr_tail (str=<optimized out>) at
./malloc/malloc.c:5358
No locals.
#9 0x00007ffff6d47e6c in pybind11::cpp_function::destruct (rec=0xd940e0,
free_strings=true) at /usr/include/pybind11/pybind11.h:769
- arg = @0xd94290: {name = 0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}
- __for_range = std::vector of length 1, capacity 1 = {{name =
0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}}
- __for_begin = <optimized out>
- __for_end = <optimized out>
- next = 0x0
+ arg = @0xd94290: {name = 0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}
+ __for_range = std::vector of length 1, capacity 1 = {{name =
0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}}
+ __for_begin = <optimized out>
+ __for_end = <optimized out>
+ next = 0x0
#10 pybind11::detail::function_record_PyTypeObject_methods::tp_dealloc_impl
(self=0x7ffff68e97d0) at /usr/include/pybind11/pybind11.h:1250
- py_func_rec = 0x7ffff68e97d0
+ py_func_rec = 0x7ffff68e97d0
#11 0x0000000000514c33 in _Py_Dealloc ()
No symbol table info available.
#12 0x0000000000537d59 in ?? ()
No symbol table info available.
#13 0x0000000000514c33 in _Py_Dealloc ()
No symbol table info available.
#14 0x0000000000691dc3 in ?? ()
No symbol table info available.
...
+
+ After some digging I found this upstream PR [1] that introduced a latent
+ bug where a `free()` is called on string-literals. This was then noted
+ by the following upstream issues [2] and [3], and addressed with the
+ following PRs [4] and [5]. The eventual stable version of pybind11 is
+ 3.0.3 (see: [6]).
+
+ Since the current version of pybind11 for both Resolute and Stonking is
+ 3.0.1-3, it can be assumed that all the following reverse-dependencies
+ are affected (reverse-depends -b pybind11-dev) in both Resolute and
+ Stonking:
+
+ - adios2
+ - amgcl
+ - aoflagger
+ - bespokesynth
+ - camitk
+ - cctbx
+ - darkradiant
+ - dart
+ - dm-tree
+ - dolfin
+ - ecflow
+ - freecad
+ - gnuradio
+ - gr-limesdr
+ - gridtools
+ - gtsam
+ - gudhi
+ - halide
+ - kms++
+ - netgen
+ - nmodl
+ - odil
+ - open3d
+ - opencc
+ - opencolorio
+ - opengv
+ - openimageio
+ - opm-common
+ - opm-simulators
+ - orocos-kdl
+ - pybind11-json
+ - pycuda
+ - pyosmium
+ - pytango
+ - python-awkward
+ - python-boost-histogram
+ - python-laszip
+ - python-mapbox-earcut
+ - python-samplerate
+ - pytorch
+ - pytorch-audio
+ - pytorch-cluster
+ - pytorch-rocm
+ - pytorch-scatter
+ - pytorch-sparse
+ - scikit-build-core
+ - sfst
+ - simgrid
+ - spglib
+ - tinyobjloader
+ - votca
+ - xeus-python
+ - xrt
+ - ycmd
+
+ 1. https://github.com/pybind/pybind11/pull/5486
+ 2. https://github.com/pybind/pybind11/issues/5976
+ 3. https://github.com/pybind/pybind11/issues/5991
+ 4. https://github.com/pybind/pybind11/pull/6010
+ 5. https://github.com/pybind/pybind11/pull/6015
+ 6. https://github.com/pybind/pybind11/releases#release-v3.0.3
** Description changed:
- Since 3.0.0 to 3.0.2, pybind11 has a regression causing crashes during
+ From 3.0.0 to 3.0.2, pybind11 has a regression causing crashes during
interpreter shutdown with `py::enum_<>` by duplicating late-added
`def_property_static` argument strings and `function_record` heap-type
deallocation to call `PyObject_Free()` and decref the type.
This was first reported in #2163679 where autopkgtest was failing for
ecflow with a `free(): invalid pointer` crash. This can be better seen
in the stacktrace:
...
#7 malloc_printerr (str=<optimized out>) at ./malloc/malloc.c:5341
No locals.
#8 0x00007ffff7cb0b44 in malloc_printerr_tail (str=<optimized out>) at
./malloc/malloc.c:5358
No locals.
#9 0x00007ffff6d47e6c in pybind11::cpp_function::destruct (rec=0xd940e0,
free_strings=true) at /usr/include/pybind11/pybind11.h:769
arg = @0xd94290: {name = 0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}
__for_range = std::vector of length 1, capacity 1 = {{name =
0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}}
__for_begin = <optimized out>
__for_end = <optimized out>
next = 0x0
#10 pybind11::detail::function_record_PyTypeObject_methods::tp_dealloc_impl
(self=0x7ffff68e97d0) at /usr/include/pybind11/pybind11.h:1250
py_func_rec = 0x7ffff68e97d0
#11 0x0000000000514c33 in _Py_Dealloc ()
No symbol table info available.
#12 0x0000000000537d59 in ?? ()
No symbol table info available.
#13 0x0000000000514c33 in _Py_Dealloc ()
No symbol table info available.
#14 0x0000000000691dc3 in ?? ()
No symbol table info available.
...
After some digging I found this upstream PR [1] that introduced a latent
bug where a `free()` is called on string-literals. This was then noted
by the following upstream issues [2] and [3], and addressed with the
following PRs [4] and [5]. The eventual stable version of pybind11 is
3.0.3 (see: [6]).
Since the current version of pybind11 for both Resolute and Stonking is
3.0.1-3, it can be assumed that all the following reverse-dependencies
are affected (reverse-depends -b pybind11-dev) in both Resolute and
Stonking:
- adios2
- amgcl
- aoflagger
- bespokesynth
- camitk
- cctbx
- darkradiant
- dart
- dm-tree
- dolfin
- ecflow
- freecad
- gnuradio
- gr-limesdr
- gridtools
- gtsam
- gudhi
- halide
- kms++
- netgen
- nmodl
- odil
- open3d
- opencc
- opencolorio
- opengv
- openimageio
- opm-common
- opm-simulators
- orocos-kdl
- pybind11-json
- pycuda
- pyosmium
- pytango
- python-awkward
- python-boost-histogram
- python-laszip
- python-mapbox-earcut
- python-samplerate
- pytorch
- pytorch-audio
- pytorch-cluster
- pytorch-rocm
- pytorch-scatter
- pytorch-sparse
- scikit-build-core
- sfst
- simgrid
- spglib
- tinyobjloader
- votca
- xeus-python
- xrt
- ycmd
1. https://github.com/pybind/pybind11/pull/5486
2. https://github.com/pybind/pybind11/issues/5976
3. https://github.com/pybind/pybind11/issues/5991
4. https://github.com/pybind/pybind11/pull/6010
5. https://github.com/pybind/pybind11/pull/6015
6. https://github.com/pybind/pybind11/releases#release-v3.0.3
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164501
Title:
regression: free() invalid pointer
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pybind11/+bug/2164501/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
