Hello, I have this message when I try to compile this file

Hi Picca,

Are you sure?

I get

with 2.68
	malloc(): unsorted double linked list corrupted

with 2.69
	malloc_consolidate(): invalid chunk size

but eps file is created (when used with -f eps), so not really sure what
this might be. I will forward it to upstream.

Best

Norbert

yes

$ dpkg -l | grep asym
ii  asymptote                                    2.69+ds-1
                      amd64        script-based vector graphics language
inspired by MetaPost
ii  asymptote-doc                                2.69+ds-1
                      all          documentation and examples for
asymptote
ii  asymptote-x11                                2.69+ds-1
                      amd64        script-based vector graphics language
inspired by MetaPost - the GUI part

I double checked and I really have this error message

$ make
/usr/bin/asy -config "" -render=4 -f png -o B_b.png B_b.asy
malloc(): unsorted double linked list corrupted


Cheers

Fred

Hi John,

(please keep cc)

with the attached source file I am seeing different error messages
printed:

2.68
	malloc(): unsorted double linked list corrupted

2.69
	malloc_consolidate(): invalid chunk size

(but eps files are created when called with -f eps).

Best

Norbert

Interesting ...

I have
[~] asy -config "" -render=4 -f png -o B_b.png B_b.asy
malloc_consolidate(): invalid chunk size
[~] asy --version
Asymptote version 2.69 [(C) 2004 Andy Hammerlindl, John C. Bowman, Tom Prince]

Seems to depend on other libraries ...

Anyway, I asked John (upstream author).

Best

Norbert

Hi Norbert,
I tried your example and but can't reproduce the error. I even checked that
it runs fine through valgrind, with garbage collection disabled.
Does it happen with -fhtml?
What about if you

configure --disable-gc
make

Maybe it is a bug in your graphics driver?

Hi John,

thanks for the quick check!

No, indeed, here it doesn't happen.

Happens also with --disable-gc here.

Or some other library, indeed.

I guess I leave it at this, right, and we simply ignore since it
produces documents correctly.

Best

Norbert

Hello everyone,
I tried to reproduce this issue inside a minimal qemu VM,
with an available X server, and investigate with the help
of rr-debugger and valgrind.

First in camp::picture::shipout3, line 1404 the process asy
forks, and following failure happens in the child thereof.

In the backtrace [1] the malloc error is written.
This happens while being inside a signal handler of
a SIGSEGV, which attempts to to log something.
As far as I understand are such complex things inside
a signal handler likely to fail.

The SIGSEGV before seems to be caused because by a double free,
once in builtin_builder::release [2] and before that,
once in builtin_builder::~builtin_builder [3],
both below the __run_exit_handlers.
Maybe the order of the exit handlers is important here?

This also shows up with valgrind at the bottom of the run.

rr was working with current git head and the
environment LP_NO_RAST=1 set, otherwise I got a SIGFPE, which
might be an issue in rr.

It seems to depend on using the mesa software renderer.
Therefore it may be better reproducible on regular desktops
with e.g. LIBGL_ALWAYS_SOFTWARE=true and
GALLIUM_DRIVER=llvmpipe.

In my test VM with GALLIUM_DRIVER=softpipe it shows
"malloc_consolidate(): invalid chunk size", but have
not followed that further.

Kind regards,
Bernhard


[1]
     (rr) bt
     #0  malloc_printerr (str=str@entry=0x7f76cc2c6678 "malloc(): unsorted double linked list corrupted") at malloc.c:5347
     #1  0x00007f76cc1bfd74 in _int_malloc (av=av@entry=0x7f76cc2f5b80 <main_arena>, bytes=bytes@entry=8192) at malloc.c:3744
     #2  0x00007f76cc1c1299 in __GI___libc_malloc (bytes=bytes@entry=8192) at malloc.c:3066
     #3  0x00007f76cc5220b5 in operator new (sz=8192) at ../../../../src/libstdc++-v3/libsupc++/new_op.cc:50
     #4  0x00007f76cc5220f5 in operator new[] (sz=<optimized out>) at ../../../../src/libstdc++-v3/libsupc++/new_opv.cc:32
     #5  0x00007f76cc57c0b4 in std::basic_filebuf<char, std::char_traits<char> >::_M_allocate_internal_buffer (this=0x7ffc31779080) at /build/gcc-10-Km9U7s/gcc-10-10.2.1/build/x86_64-linux-gnu/libstdc++-v3/include/bits/fstream.tcc:49
     #6  std::basic_filebuf<char, std::char_traits<char> >::_M_allocate_internal_buffer (this=0x7ffc31779080) at /build/gcc-10-Km9U7s/gcc-10-10.2.1/build/x86_64-linux-gnu/libstdc++-v3/include/bits/fstream.tcc:49
     #7  0x00007f76cc57ffe3 in std::basic_filebuf<char, std::char_traits<char> >::open (this=0x7ffc31779080, __s=0x7f76ca30f860 "/usr/share/asymptote/three.asy", __mode=std::_S_in) at /build/gcc-10-Km9U7s/gcc-10-10.2.1/build/x86_64-linux-gnu/libstdc++-v3/include/bits/fstream.tcc:188
     #8  0x000055744bd819b9 in std::basic_ifstream<char, std::char_traits<char> >::open (__mode=<optimized out>, __s=<optimized out>, this=<optimized out>) at /usr/include/c++/10/bits/ios_base.h:130
     #9  std::basic_ifstream<char, std::char_traits<char> >::basic_ifstream (__mode=<optimized out>, __s=<optimized out>, this=<optimized out>, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at /usr/include/c++/10/fstream:533
     #10 operator<< (out=..., pos=...) at errormsg.cc:30
     #11 0x000055744bd81fd6 in errorstream::message (this=0x55744bef6270 <em>, pos=..., s="runtime: ") at errormsg.cc:63
     #12 0x000055744bd8220a in errorstream::runtime (this=0x55744bef6270 <em>, pos=...) at errormsg.cc:81
     #13 0x000055744be12ce6 in sigsegv_handler (emergency=<optimized out>) at main.cc:78
     #14 sigsegv_handler (emergency=1277376864) at main.cc:75
     #15 0x00007f76cccc82d0 in sigsegv_handler (sig=<optimized out>, sip=<optimized out>, ucp=0x7ffc31779440) at handler-unix.c:267
     #16 <signal handler called>
     #17 0x00007f76c6b532cf in unsafe_free (info=0x55744c2662a0) at ../src/util/ralloc.c:307
     #18 0x00007f76c6b538a2 in unsafe_free (info=<optimized out>) at ../src/util/ralloc.c:308
     #19 ralloc_free (ptr=0x55744c2339a0) at ../src/util/ralloc.c:278
     #20 ralloc_free (ptr=0x55744c2339a0) at ../src/util/ralloc.c:269
     #21 0x00007f76c6a94b8c in (anonymous namespace)::builtin_builder::release (this=0x7f76c7aacfd0 <builtins>) at ../src/compiler/glsl/builtin_functions.cpp:1326
     #22 _mesa_glsl_builtin_functions_decref () at ../src/compiler/glsl/builtin_functions.cpp:7759
     #23 0x00007f76c6831245 in _mesa_free_context_data (ctx=ctx@entry=0x7f76be008010, destroy_debug_output=destroy_debug_output@entry=false) at ../src/mesa/main/context.c:1402
     #24 0x00007f76c67c2a87 in st_destroy_context (st=0x55744c4aa880) at ../src/mesa/state_tracker/st_context.c:1146
     #25 0x00007f76c67a495e in dri_destroy_context (cPriv=<optimized out>) at ../src/gallium/frontends/dri/dri_context.c:247
     #26 0x00007f76c6ca3903 in driDestroyContext (pcp=0x55744c1ca700) at ../src/mesa/drivers/dri/common/dri_util.c:533
     #27 0x00007f76ca5d1a7f in drisw_destroy_context (context=0x55744c1ca570) at ../src/glx/drisw_glx.c:379
     #28 0x00007f76ca5d722e in glx_display_free (priv=priv@entry=0x55744c1c1a90) at ../src/glx/glxext.c:245
     #29 0x00007f76ca5d72bf in __glXCloseDisplay (dpy=0x55744c1a7870, codes=<optimized out>) at ../src/glx/glxext.c:304
     #30 0x00007f76cc00cbc2 in XCloseDisplay (dpy=0x55744c1a7870) at ../../src/ClDisplay.c:65
     #31 0x00007f76ccceda7f in fgDeinitialize () at freeglut_init.c:524
     #32 fgDeinitialize () at freeglut_init.c:411
     #33 0x00007f76cc1754d7 in __run_exit_handlers (status=0, listp=0x7f76cc2f5718 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:108
     #34 0x00007f76cc17567a in __GI_exit (status=<optimized out>) at exit.c:139
     #35 0x000055744be02ae2 in gl::quit () at glrender.cc:652
     #36 0x000055744be07ebf in gl::glrender (prefix=<error: Cannot access memory at address 0xfc>, pic=0x7f76ca581f20, format=<error reading variable: Cannot access memory at address 0x4669>, width=6.5947378298252455e-96, height=5.4110892682213118e-312, angle=5.4110892682213118e-312, zoom=0, m=..., M=..., shift=..., margin=..., t=0x55744c1a5110, background=0x55744c1969b0, nlightsin=140721138367920, lights=0x7f76c9758548, diffuse=0x7f76c97583f0, specular=0x7f76c9758230, view=false, oldpid=0) at glrender.cc:1866
     #37 0x000055744bb9a01a in camp::picture::shipout3 (this=0x0, prefix=<error: Cannot access memory at address 0x841f0f2e66c3>, format=<error reading variable: Cannot access memory at address 0x4669>, width=6.5947378298252455e-96, height=5.4110892682213118e-312, angle=5.4110892682213118e-312, zoom=0, m=..., M=..., shift=..., margin=..., t=0x55744c1a5110, background=0x55744c1969b0, nlights=3, lights=0x7f76c9758548, diffuse=0x7f76c97583f0, specular=0x7f76c9758230, view=true) at picture.cc:1417
     #38 0x000055744bcf9921 in run::gen_runpicture43 (Stack=0x55744c1969b0) at runpicture.in:485
     #39 0x000055744bd95fee in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c96cfd38, vars=0x4661, parent=0x55744c2662a0) at stack.cc:463
     #40 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c8f1eff0, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #41 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c90e3e68, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #42 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c8f4aaf0, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #43 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c90f52f8, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #44 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c9624c08, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #45 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c985b5d0, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #46 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c9ab6370, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #47 0x000055744bd95f25 in vm::stack::runWithOrWithoutClosure (this=0x7ffc31770fc0, l=0x7f76c9144118, vars=0x4661, parent=0x55744c2662a0) at stack.cc:521
     #48 0x000055744bdc219e in icore::postRun (s=..., this=<optimized out>) at process.cc:211
     #49 ifile::postRun (this=0x7ffc317798b0, e=..., s=...) at process.cc:383
     #50 0x000055744bdc69de in icore::doRun (this=0x55744c2662a0, purge=32, tm=(TRANS_NORMAL | unknown: 0x4660)) at process.cc:238
     #51 0x0000000000000000 in ?? ()
     (rr) when
     Current event: 9570


[2]
     (rr) bt
     #0  0x00007f76c6b5383b in get_header (ptr=<optimized out>) at ../src/util/ralloc.c:96
     #1  ralloc_free (ptr=<optimized out>) at ../src/util/ralloc.c:276
     #2  ralloc_free (ptr=0x55744c2339a0) at ../src/util/ralloc.c:269
     #3  0x00007f76c6a94b8c in (anonymous namespace)::builtin_builder::release (this=0x7f76c7aacfd0 <builtins>) at ../src/compiler/glsl/builtin_functions.cpp:1326
     #4  _mesa_glsl_builtin_functions_decref () at ../src/compiler/glsl/builtin_functions.cpp:7759
     #5  0x00007f76c6831245 in _mesa_free_context_data (ctx=ctx@entry=0x7f76be008010, destroy_debug_output=destroy_debug_output@entry=false) at ../src/mesa/main/context.c:1402
     #6  0x00007f76c67c2a87 in st_destroy_context (st=0x55744c4aa880) at ../src/mesa/state_tracker/st_context.c:1146
     #7  0x00007f76c67a495e in dri_destroy_context (cPriv=<optimized out>) at ../src/gallium/frontends/dri/dri_context.c:247
     #8  0x00007f76c6ca3903 in driDestroyContext (pcp=0x55744c1ca700) at ../src/mesa/drivers/dri/common/dri_util.c:533
     #9  0x00007f76ca5d1a7f in drisw_destroy_context (context=0x55744c1ca570) at ../src/glx/drisw_glx.c:379
     #10 0x00007f76ca5d722e in glx_display_free (priv=priv@entry=0x55744c1c1a90) at ../src/glx/glxext.c:245
     #11 0x00007f76ca5d72bf in __glXCloseDisplay (dpy=0x55744c1a7870, codes=<optimized out>) at ../src/glx/glxext.c:304
     #12 0x00007f76cc00cbc2 in XCloseDisplay (dpy=0x55744c1a7870) at ../../src/ClDisplay.c:65
     #13 0x00007f76ccceda7f in fgDeinitialize () at freeglut_init.c:524
     #14 fgDeinitialize () at freeglut_init.c:411
     #15 0x00007f76cc1754d7 in __run_exit_handlers (status=0, listp=0x7f76cc2f5718 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:108
     #16 0x00007f76cc17567a in __GI_exit (status=<optimized out>) at exit.c:139
     #17 0x000055744be02ae2 in gl::quit () at glrender.cc:652
     ...
     (rr) when
     Current event: 9541


[3]
     (rr) reverse-cont
     Continuing.

     Breakpoint 5, 0x00007f76c6b5383b in get_header (ptr=<optimized out>) at ../src/util/ralloc.c:96
     96         ralloc_header *info = (ralloc_header *) (((char *) ptr) -
     1: x/i $pc
     => 0x7f76c6b5383b <ralloc_free+11>:     lea    -0x30(%rdi),%r12
     2: ptr = <optimized out>
     (rr) bt
     #0  0x00007f76c6b5383b in get_header (ptr=<optimized out>) at ../src/util/ralloc.c:96
     #1  ralloc_free (ptr=<optimized out>) at ../src/util/ralloc.c:276
     #2  ralloc_free (ptr=0x55744c2339a0) at ../src/util/ralloc.c:269
     #3  0x00007f76c6a6830d in (anonymous namespace)::builtin_builder::~builtin_builder (this=<optimized out>, __in_chrg=<optimized out>) at ../src/compiler/glsl/builtin_functions.cpp:1280
     #4  0x00007f76cc1754d7 in __run_exit_handlers (status=0, listp=0x7f76cc2f5718 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:108
     #5  0x00007f76cc17567a in __GI_exit (status=<optimized out>) at exit.c:139
     #6  0x000055744be02ae2 in gl::quit () at glrender.cc:652
     #7  0x000055744be07ebf in gl::glrender (prefix="polly-delicm\000polly-enable-delicm\000-passes=licm\000.licm\000enable-loop-versioning-licm\000disable-machine-licm\000disable-postra-machine-licm\000experimental-zbm\000llvm.ppc.vsx.xxgenpcvbm\000llvm.ppc.altivec.vmsumubm\000tbm\000"..., pic=0x0, format=Traceback (most recent call last):  File "/lib/x86_64-linux-gnu/../../share/gcc/python/libstdcxx/v6/printers.py", line 903, in to_string    return ptr.lazy_string (length = length)OverflowError: int too big to convert, width=0, height=2.8480999736851678e-306, angle=2.8480999736437188e-306, zoom=2.8480999736437207e-306, m=..., M=..., shift=..., margin=..., t=0x55744c1a5110, background=0x55744c1969b0, nlightsin=140721138367920, lights=0x7f76c9758548, diffuse=0x7f76c97583f0, specular=0x7f76c9758230, view=false, oldpid=0) at glrender.cc:1866
     #8  0x000055744bb9a01a in camp::picture::shipout3 (this=0x0, prefix=<error reading variable: Cannot access memory at address 0x8>, format=Traceback (most recent call last):  File "/lib/x86_64-linux-gnu/../../share/gcc/python/libstdcxx/v6/printers.py", line 903, in to_string    return ptr.lazy_string (length = length)OverflowError: int too big to convert, width=0, height=2.8480999736851678e-306, angle=2.8480999736437188e-306, zoom=2.8480999736437207e-306, m=..., M=..., shift=..., margin=..., t=0x55744c1a5110, background=0x55744c1969b0, nlights=3, lights=0x7f76c9758548, diffuse=0x7f76c97583f0, specular=0x7f76c9758230, view=true) at picture.cc:1417
     #9  0x000055744bcf9921 in run::gen_runpicture43 (Stack=0x55744c1969b0) at runpicture.in:485
     ...
     (rr) when
     Current event: 9519

Am 15.03.21 um 14:10 schrieb Bernhard Übelacker:


A short offtopic side note to rr sensing this SIGFPE,
not directly related to the malloc message:

This can also be seen in a process without being
recorded by rr by setting LP_NUM_THREADS to zero, so
operations take place without worker threads.
So this might be an additional llvmpipe issue?


export LP_NUM_THREADS=0
gdb -q \
     -ex 'tb camp::picture::shipout3' \
     -ex 'set width 0' \
     -ex 'set pagination off' \
     -ex 'directory /home/benutzer/source/libgl1-mesa-dri/orig/mesa-20.3.4/src' \
     -ex 'display/i $pc' \
     -ex 'run' \
     -ex 'set breakpoint pending on' \
     -ex 'tb lp_rast.c:481' \
     -ex 'b lp_rast_shade_quads_mask_sample+484' \
     -ex 'set follow-fork-mode child' \
     -ex 'cont' \
     -ex 'bt' \
     -ex 'finish' \
     --args /usr/bin/asy -config "" -render=4 -f png -o B_b.png B_b.asy

Thread 2.1 "asy" received signal SIGFPE, Arithmetic exception.
0x00007ffff7fc2df1 in ?? ()
1: x/i $pc
=> 0x7ffff7fc2df1:      vdivps %ymm0,%ymm5,%ymm1

#0  lp_rast_shade_quads_mask_sample (task=task@entry=0x555555aab538, inputs=inputs@entry=0x5555565105f0, x=x@entry=36, y=100, mask=17476) at ../src/gallium/drivers/llvmpipe/lp_rast.c:481
#1  0x00007ffff1d0713d in do_block_4_3 (c=<optimized out>, y=<optimized out>, x=<optimized out>, plane=<optimized out>, tri=<optimized out>, task=<optimized out>) at ../src/gallium/drivers/llvmpipe/lp_rast_tri_tmp.h:88
#2  do_block_16_3 (c=0x7fffffff4270, y=96, x=32, plane=0x7fffffff42b0, tri=<optimized out>, task=0x555555aab538) at ../src/gallium/drivers/llvmpipe/lp_rast_tri_tmp.h:173
#3  lp_rast_triangle_3 (task=<optimized out>, arg=...) at ../src/gallium/drivers/llvmpipe/lp_rast_tri_tmp.h:326
#4  0x00007ffff1d04a16 in do_rasterize_bin (bin=<optimized out>, bin=<optimized out>, x=<optimized out>, y=<optimized out>, task=<optimized out>) at ../src/gallium/drivers/llvmpipe/lp_rast.c:658
#5  rasterize_bin (y=<optimized out>, x=<optimized out>, bin=<optimized out>, task=0x555555aab538) at ../src/gallium/drivers/llvmpipe/lp_rast.c:677
#6  rasterize_scene (task=task@entry=0x555555aab538, scene=scene@entry=0x7fffea222010) at ../src/gallium/drivers/llvmpipe/lp_rast.c:738
#7  0x00007ffff1d0521b in lp_rast_queue_scene (rast=0x555555aab520, scene=scene@entry=0x7fffea222010) at ../src/gallium/drivers/llvmpipe/lp_rast.c:786
#8  0x00007ffff1d11645 in lp_setup_rasterize_scene (setup=0x555555b55120) at ../src/gallium/drivers/llvmpipe/lp_setup.c:181
#9  set_scene_state (setup=setup@entry=0x555555b55120, new_state=new_state@entry=SETUP_FLUSHED, reason=<optimized out>) at ../src/gallium/drivers/llvmpipe/lp_setup.c:332
#10 0x00007ffff1d11ef3 in lp_setup_flush (setup=0x555555b55120, fence=0x0, reason=<optimized out>) at ../src/gallium/drivers/llvmpipe/lp_setup.c:361
#11 0x00007ffff173ac49 in st_flush (flags=0, fence=0x0, st=0x555555d23de0) at ../src/mesa/state_tracker/st_cb_flush.c:60
#12 st_glFlush (ctx=<optimized out>) at ../src/mesa/state_tracker/st_cb_flush.c:101
#13 0x000055555586c9ed in trEndTile (tr=0x55555632b620) at tr.cc:378
...

I still can't reproduce the error. A SIGFPE may indicate a bug in the
rendering library; I recall encountering something like this before and
working around it. Will try to track down what that was all about....

The file B_b.asy runs fine on the Asymptote Web Application, using the mesa
software renderer to
download an eps or png file:

http://asymptote.ualberta.ca/

Am 15.03.21 um 16:36 schrieb John Bowman:

Hello John,
sorry, I noted the details for the SIGFPE in my
second mail just for completeness about debugging.


The issue starting it all seems the SIGSEGV from my first mail.
On a second look it seems that the descructor of
the builtin_builder object is called first, and
just afterwards the method relase on that deleted object.

Therefore the same pointer gets freed by ralloc_free twice.

Attached is a "one-liner" to illustrate how to drive gdb to
the SIGSEGV and the malloc issue.
And an example output.

And yes, it might be an mesa issue, not being
prepared of having __run_exit_handlers
calling the destructor of builtin_builder before
calling fgDeinitialize:
     mesa-20.3.4/src/compiler/glsl/builtin_functions.cpp:7736:static builtin_builder builtins;

Kind regards,
Bernhard