** Description changed:
From 3.0.0 to 3.0.2, pybind11 has a regression causing crashes during
interpreter shutdown with `py::enum_<>` by duplicating late-added
`def_property_static` argument strings and `function_record` heap-type
deallocation to call `PyObject_Free()` and decref the type.
This was first reported in #2163679 where autopkgtest was failing for
ecflow with a `free(): invalid pointer` crash. This can be better seen
in the stacktrace:
...
#7 malloc_printerr (str=<optimized out>) at ./malloc/malloc.c:5341
No locals.
#8 0x00007ffff7cb0b44 in malloc_printerr_tail (str=<optimized out>) at
./malloc/malloc.c:5358
No locals.
#9 0x00007ffff6d47e6c in pybind11::cpp_function::destruct (rec=0xd940e0,
free_strings=true) at /usr/include/pybind11/pybind11.h:769
arg = @0xd94290: {name = 0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}
__for_range = std::vector of length 1, capacity 1 = {{name =
0x7ffff72523e7 "self", descr = 0x0, value =
{<pybind11::detail::object_api<pybind11::handle>> =
{<pybind11::detail::pyobject_tag> = {<No data fields>}, <No data fields>},
m_ptr = 0x0}, convert = true, none = false}}
__for_begin = <optimized out>
__for_end = <optimized out>
next = 0x0
#10 pybind11::detail::function_record_PyTypeObject_methods::tp_dealloc_impl
(self=0x7ffff68e97d0) at /usr/include/pybind11/pybind11.h:1250
py_func_rec = 0x7ffff68e97d0
#11 0x0000000000514c33 in _Py_Dealloc ()
No symbol table info available.
#12 0x0000000000537d59 in ?? ()
No symbol table info available.
#13 0x0000000000514c33 in _Py_Dealloc ()
No symbol table info available.
#14 0x0000000000691dc3 in ?? ()
No symbol table info available.
...
After some digging I found this upstream PR [1] that introduced a latent
bug where a `free()` is called on string-literals. This was then noted
by the following upstream issues [2] and [3], and addressed with the
following PRs [4] and [5]. The eventual stable version of pybind11 is
3.0.3 (see: [6]).
Since the current version of pybind11 for both Resolute and Stonking is
3.0.1-3, it can be assumed that all the following reverse-dependencies
- are affected (reverse-depends -b pybind11-dev) in both Resolute and
+ could be affected (reverse-depends -b pybind11-dev) in both Resolute and
Stonking:
- adios2
- amgcl
- aoflagger
- bespokesynth
- camitk
- cctbx
- darkradiant
- dart
- dm-tree
- dolfin
- ecflow
- freecad
- gnuradio
- gr-limesdr
- gridtools
- gtsam
- gudhi
- halide
- kms++
- netgen
- nmodl
- odil
- open3d
- opencc
- opencolorio
- opengv
- openimageio
- opm-common
- opm-simulators
- orocos-kdl
- pybind11-json
- pycuda
- pyosmium
- pytango
- python-awkward
- python-boost-histogram
- python-laszip
- python-mapbox-earcut
- python-samplerate
- pytorch
- pytorch-audio
- pytorch-cluster
- pytorch-rocm
- pytorch-scatter
- pytorch-sparse
- scikit-build-core
- sfst
- simgrid
- spglib
- tinyobjloader
- votca
- xeus-python
- xrt
- ycmd
1. https://github.com/pybind/pybind11/pull/5486
2. https://github.com/pybind/pybind11/issues/5976
3. https://github.com/pybind/pybind11/issues/5991
4. https://github.com/pybind/pybind11/pull/6010
5. https://github.com/pybind/pybind11/pull/6015
6. https://github.com/pybind/pybind11/releases#release-v3.0.3
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164501
Title:
regression: free() invalid pointer
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pybind11/+bug/2164501/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
