Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Segmentation Fault Crash with Specific Large Array Sizes #6234

Open
smoge opened this issue Mar 13, 2024 · 28 comments · May be fixed by #6261
Open

Segmentation Fault Crash with Specific Large Array Sizes #6234

smoge opened this issue Mar 13, 2024 · 28 comments · May be fixed by #6261
Labels
bug Issues that relate to unexpected/unwanted behavior. Don't use for PRs. comp: sclang sclang C++ implementation (primitives, etc.). for changes to class lib use "comp: class library" crash things which cause a crash in the interpreter, servers, or IDE. do not use for PRs

Comments

@smoge
Copy link
Contributor

smoge commented Mar 13, 2024

Ok, so I think the property-based tests found something interesting.

It appears to be triggered by specific array sizes (in the context of the tests, that is, a few arrays are produced, 10 or so). Large Arrays can be used to represent sound files, so I think it's not an extreme case in principle.

The interpreter crashes with a segmentation fault when handling arrays of certain sizes. Specifically, an array size of around 1,850,426 elements consistently triggers this crash. Interestingly, the issue does not occur with all large arrays, as some larger arrays do not cause the interpreter to crash.

Initialize a DoubleArray with approximately 1,850,426 elements. Example data includes [0.0062277317047119, 0.76690030097961, -0.56259202957153, ...] (Array size: 1,850,426).

Observe that the interpreter crashes with a segmentation fault (Exit code: 11).

Test sucessful with case: DoubleArray[0.0062277317047119, 0.76690030097961, -0.56259202957153, -0.25090932846069, -0.074282646179199, 0.41903877258301, 0.38275265693665, 0.5122504234314, -0.21230411529541, 0.42823481559753, 0.72746348381042, 0.86688160896301, 0.88132953643799, 0.51663398742676, -0.44769358634949, -0.89134740829468, -0.6724100112915, 0.79992604255676, -0.49154472351074, -0.38824009895325, 0.61342024803162, 0.73421216011047, -0.56524085998535, 0.60288572311401, -0.30279064178467, 0.0027897357940674, -0.023514747619629...etc...
====> Array size
1850426
Interpreter has crashed or stopped forcefully. [Exit code: 11]
    
    

Test sucessful with case: [0, 1, 0, 0, 0, 1, 1, 0, 0, 2, 0, 0, 1, 1, 1, 0, 1, 0, 0, 2, 0, 2, 2, 0, 0, 1, 1, 2, 2, 1, 1, 2, 0, 0, 2, 2, 1, 1, 1, 2, 2, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 2, 0, 1, 1, 0, 1, 0, 1, 1, 2, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 1, 2, 2, 0, 1, 0, 0, 1, 1, 1, 2, 2, 1, 2, 2, 0, 2, 1, 1, 1, 1, 2, 0, 0, 2, 1, 1, 1, 1, 2, 2, 0, 0, 1, 0, 0, 0, 1, 2, 0, 0, 1, 0, 1, 2, 0, 1, 0, 1, 2, 1, 2, 1, 1, 1, 1, 0, 0, 2, 1, 0, 2, 1, 0, 2, 2, 0, 1, 1, 2, 2, 0, 1, 1, 2, 0, 1, 2, 1, 0, 1, 2, 0, 0, 2, 1, 0, 0, 2, 1, 0, 1, 0, 2, 0, 1, 2, 0, 0...etc...
1824713
Interpreter has crashed or stopped forcefully. [Exit code: 11]

 But even larger Arrays don't have this problem. THIS IS OK:        

Test sucessful with case: [0, 2, 0, 0, 2, 2, 1, 0, 0, 2, 1, 1, 0, 2, 2, 2, 0, 1, 0, 0, 2, 1, 2, 0, 0, 2, 1, 0, 0, 2, 0, 0, 1,  2, 2, 1, 0, 0, 2, 0, 0, 1, 2, 2, 1, 0, 1, 1, 1, 0, 0, 0, 2, 2, 0, 1, 2, 2, 2, 2, 0, 2, 2, 1, 2, 2, 1, 0, 0, 2, 1, 0, 2, 0, 0, 0, 2, 2, 0, 1, 2, 1, 0, 1, 0, 1, 1, 0, 1, 2, 0, 2, 2, 1, 2, 1, 1, 0, 0, 1, 2, 1, 0, 0, 1, 1, 1, 1, 0, 1, 2, 1, 0, 1, 2, 2, 1, 1, 0, 1, 0, 0, 0, 2, 2, 1, 1, 2, 2, 2, 2, 2, 0, 2, 0, 0, 2, 1, 0, 2, 1, 0, 2, 1, 2, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 2, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 2, 2, 1...etc...
2279156
[1, 0, 2, 0, 1, 1, 1, 2, 0, 1, 2, 0, 0, 2, 1, 2, 2, 2, 2, 0, 0, 2, 1, 0, 2, 2, 0, 0, 0, 2, 2, 2, 1, 1, 1, 0, 2, 2, 1, 1, 0, 2, 2, 0, 0, 2, 2, 1, 1, 2, 0, 1, 2, 2, 1, 0, 0, 2, 1, 2, 0, 1, 0, 1, 0, 2, 1, 1, 0, 2, 2, 2, 1, 1, 1, 1, 2, 1, 0, 1, 2, 0, 2, 1, 0, 1, 2, 2, 2, 2, 2, 2, 1, 2, 1, 2, 2, 1, 2, 2, 2, 2, 1, 1, 1, 2, 2, 2, 0, 0, 0, 2, 1, 2, 0, 2, 1, 1, 1, 2, 0, 2, 0, 1, 2, 1, 0, 2, 1, 2, 2, 2, 2, 0, 1, 2, 0, 0, 2, 0, 1, 0, 1, 0, 0, 1, 0, 1, 2, 2, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 2, 1, 2, 1, 0, 2, 0, 2, 1, 2...etc...
Test 9 with case: [1, 0, 2, 0, 1, 1, 1, 2, 0, 1, 2, 0, 0, 2, 1, 2, 2, 2, 2, 0, 0, 2, 1, 0, 2, 2, 0, 0, 0, 2, 2, 2, 1, 1, 1, 0, 2, 2, 1, 1, 0, 2, 2, 0, 0, 2, 2, 1, 1, 2, 0, 1, 2, 2, 1, 0, 0, 2, 1, 2, 0, 1, 0, 1, 0, 2, 1, 1, 0, 2, 2, 2, 1, 1, 1, 1, 2, 1, 0, 1, 2, 0, 2, 1, 0, 1, 2, 2, 2, 2, 2, 2, 1, 2, 1, 2, 2, 1, 2, 2, 2, 2, 1, 1, 1, 2, 2, 2, 0, 0, 0, 2, 1, 2, 0, 2, 1, 1, 1, 2, 0, 2, 0, 1, 2, 1, 0, 2, 1, 2, 2, 2, 2, 0, 1, 2, 0, 0, 2, 0, 1, 0, 1, 0, 0, 1, 0, 1, 2, 2, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 2, 1, 2, 1, 0, 2, 0, 2, 1, 2...etc...

Notably, the crash occurs with numerical data: floats (64-bit "doubles" ) and arrays filled with simple numbers (Integers), indicating that the content of the array does not affect the crash's occurrence, just the size.

Affected Array Sizes: Crash: Array sizes around 1,850,426 and 1,824,713 elements.
No Crash: Larger arrays, such as one with 2,279,156 elements, do not trigger the crash.

Anything less than those values is consistently correct. Even larger Arrays have not been tested in the same way yet. The pattern is not clear yet.

As I understand, large objects like this have a special treatment in the language (LargeObjSizeClass).

SYSTEM DETAILS:

GNU/Linux - Fedora 39 6.7.6-200 Intel x86_64
Custom compilation latest develop branch with native flags and -DNATIVE=ON

@smoge smoge added the bug Issues that relate to unexpected/unwanted behavior. Don't use for PRs. label Mar 13, 2024
@smoge
Copy link
Contributor Author

smoge commented Mar 14, 2024

>  gdb -w  --args sclang ~/test.scd 
GNU gdb (Fedora Linux) 14.1-4.fc39
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from sclang...
(gdb) run
Starting program: /usr/local/bin/sclang /home/bbarros/test.scd

This GDB supports auto-downloading debuginfo from the following URLs:
  <https://debuginfod.fedoraproject.org/>
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
[Thread debugging using libthread_db enabled]                                               
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffe82006c0 (LWP 1765497)]                                                   
[New Thread 0x7fffe78006c0 (LWP 1765498)]
compiling class library (debug build)...
[New Thread 0x7fffd98006c0 (LWP 1765499)]                                                   
QSocketNotifier: Can only be used with threads started with QThread                         
[New Thread 0x7fffd3e006c0 (LWP 1765501)]                                                   
[New Thread 0x7fffd34006c0 (LWP 1765502)]
[New Thread 0x7fffd2a006c0 (LWP 1765503)]
[New Thread 0x7fffd20006c0 (LWP 1765504)]                                                   
[New Thread 0x7fffd16006c0 (LWP 1765505)]                                                   
[New Thread 0x7fffd0c006c0 (LWP 1765506)]                                                   
[New Thread 0x7fffcbe006c0 (LWP 1765507)]
[New Thread 0x7fffc8e006c0 (LWP 1765510)]                                                   
[New Thread 0x7fffbfe006c0 (LWP 1765511)]
[New Thread 0x7fffbf4006c0 (LWP 1765512)]
[New Thread 0x7fffbea006c0 (LWP 1765513)]
[New Thread 0x7fffbe0006c0 (LWP 1765514)]
[New Thread 0x7fffbd6006c0 (LWP 1765515)]
[New Thread 0x7fffbcc006c0 (LWP 1765516)]
[Thread 0x7fffbcc006c0 (LWP 1765516) exited]
[New Thread 0x7fffbcc006c0 (LWP 1765517)]
[New Thread 0x7fffb3e006c0 (LWP 1765518)]
[Thread 0x7fffbcc006c0 (LWP 1765517) exited]
[New Thread 0x7fffbcc006c0 (LWP 1765519)]
[New Thread 0x7fffb34006c0 (LWP 1765520)]
[Thread 0x7fffbcc006c0 (LWP 1765519) exited]
[Thread 0x7fffb3e006c0 (LWP 1765518) exited]
[Thread 0x7fffb34006c0 (LWP 1765520) exited]
[New Thread 0x7fffb34006c0 (LWP 1765521)]                                                   
[New Thread 0x7fffb3e006c0 (LWP 1765522)]
[New Thread 0x7fffbcc006c0 (LWP 1765523)]
[New Thread 0x7fffb0e006c0 (LWP 1765524)]
[Thread 0x7fffb0e006c0 (LWP 1765524) exited]
[Thread 0x7fffbcc006c0 (LWP 1765523) exited]
[Thread 0x7fffb3e006c0 (LWP 1765522) exited]
[Thread 0x7fffb34006c0 (LWP 1765521) exited]
[New Thread 0x7fffb34006c0 (LWP 1765525)]
[Detaching after fork from child process 1765526]
[Detaching after fork from child process 1765527]
[Detaching after fork from child process 1765528]
[New Thread 0x7fffb3e006c0 (LWP 1765531)]
[New Thread 0x7fffbcc006c0 (LWP 1765532)]
[New Thread 0x7fffb0e006c0 (LWP 1765533)]
[New Thread 0x7fff9be006c0 (LWP 1765534)]
[New Thread 0x7fff9b4006c0 (LWP 1765535)]
[New Thread 0x7fff9aa006c0 (LWP 1765536)]
[New Thread 0x7fff9a0006c0 (LWP 1765537)]
[New Thread 0x7fff996006c0 (LWP 1765538)]
[New Thread 0x7fff8fe006c0 (LWP 1765539)]
[New Thread 0x7fff8f4006c0 (LWP 1765540)]
[New Thread 0x7fff8ea006c0 (LWP 1765541)]
[New Thread 0x7fff8e0006c0 (LWP 1765542)]
[New Thread 0x7fff8d6006c0 (LWP 1765543)]
[New Thread 0x7fff8cc006c0 (LWP 1765544)]
[Thread 0x7fff8cc006c0 (LWP 1765544) exited]
[Thread 0x7fff8d6006c0 (LWP 1765543) exited]
[New Thread 0x7fff8d6006c0 (LWP 1765545)]
[New Thread 0x7fff8cc006c0 (LWP 1765546)]
[Thread 0x7fff8cc006c0 (LWP 1765546) exited]
[Thread 0x7fff8d6006c0 (LWP 1765545) exited]
[New Thread 0x7fff8d6006c0 (LWP 1765547)]
[New Thread 0x7fff8cc006c0 (LWP 1765548)]
[Thread 0x7fff8cc006c0 (LWP 1765548) exited]
[Thread 0x7fff8d6006c0 (LWP 1765547) exited]
[New Thread 0x7fff8d6006c0 (LWP 1765549)]
[New Thread 0x7fff8cc006c0 (LWP 1765550)]
[New Thread 0x7fff83e006c0 (LWP 1765551)]
	Found 871 primitives.
	Compiling directory '/usr/local/share/SuperCollider/SCClassLibrary'
	Compiling directory '/usr/local/share/SuperCollider/Extensions'
	Compiling directory '/home/bbarros/.local/share/SuperCollider/Extensions'
	Compiling directory '/home/bbarros/.local/share/SuperCollider/downloaded-quarks/PolyBuf'
	Compiling directory '/home/bbarros/.local/share/SuperCollider/downloaded-quarks/XML'
[New Thread 0x7fff98c006c0 (LWP 1765552)]
[New Thread 0x7fff834006c0 (LWP 1765553)]
[New Thread 0x7fff82a006c0 (LWP 1765554)]
[New Thread 0x7fff820006c0 (LWP 1765555)]
[New Thread 0x7fff816006c0 (LWP 1765556)]
[New Thread 0x7fff80c006c0 (LWP 1765557)]
[New Thread 0x7fff77e006c0 (LWP 1765558)]
	numentries = 918287 / 15082260 = 0.061
	6131 method selectors, 2460 classes
	method table size 14959216 bytes, big table size 120658080
[Thread 0x7fff77e006c0 (LWP 1765558) exited]
[Thread 0x7fff80c006c0 (LWP 1765557) exited]
[Thread 0x7fff816006c0 (LWP 1765556) exited]
[Thread 0x7fff820006c0 (LWP 1765555) exited]
[Thread 0x7fff82a006c0 (LWP 1765554) exited]
[Thread 0x7fff834006c0 (LWP 1765553) exited]
[Thread 0x7fff98c006c0 (LWP 1765552) exited]
	Number of Symbols 14114
	Byte Code Size 441840
	compiled 420 files in 3.38 seconds

Info: 8 methods are currently overwritten by extensions. To see which, execute:
MethodOverride.printAll

compile done
localhost : setting clientID to 0.
internal : setting clientID to 0.
[New Thread 0x7fff77e006c0 (LWP 1765559)]
Class tree inited in 0.01 seconds


*** Welcome to SuperCollider 3.14.0-dev. *** For help type ctrl-c ctrl-h (Emacs) or :SChelp (vim) or ctrl-U (sced/gedit).
[New Thread 0x7fff80c006c0 (LWP 1765560)]
WARNING: keyword arg 'verbose' not found in call to Meta_PropertyBasedTest:new
293686
[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
Test 1 with case: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
Test sucessful with case: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
41630
[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
Test 2 with case: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
Test sucessful with case: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
1858348

Thread 1 "sclang" received signal SIGSEGV, Segmentation fault.
PyrGC::ScanSlots (inNumToScan=<optimized out>, inSlots=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:166
166	            if (obj->gc_color == whiteColor) {
(gdb)

@smoge
Copy link
Contributor Author

smoge commented Mar 14, 2024

0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
Test sucessful with case: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...etc...
1835846

Thread 1 "sclang" received signal SIGSEGV, Segmentation fault.
PyrGC::ScanSlots (inNumToScan=<optimized out>, inSlots=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:166
166	            if (obj->gc_color == whiteColor) {
(gdb) bt
#0  PyrGC::ScanSlots (inNumToScan=<optimized out>, inSlots=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:166
#1  PyrGC::ScanSlots (inNumToScan=-2130504259, inSlots=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:148
#2  PyrGC::DoPartialScan (inObjSize=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:509
#3  PyrGC::ScanOneObj (this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:552
#4  PyrGC::Collect (this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:676
#5  0x000000000045ead5 in PyrGC::Allocate
    (inRunCollection=<optimized out>, sizeclass=3, inNumBytes=128, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.h:307
#6  PyrGC::NewFrame
    (this=0xb03900, inNumBytes=128, inFlags=inFlags@entry=0, inFormat=inFormat@entry=1, inAccount=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:393
#7  0x000000000046f81f in executeMethod
    (g=0x847640 <gVMGlobals>, meth=0x17dc180, numArgsPushed=1)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrMessage.cpp:1055
#8  0x000000000045f2c7 in Interpret (g=0x9c, g@entry=0x847640 <gVMGlobals>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrInterpreter3.cpp:3035
#9  0x000000000056fbf0 in runInterpreter
    (g=0x847640 <gVMGlobals>, selector=0xa46758, numArgsPushed=1)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrInterpreter3.cpp:127
#10 0x0000000000575be7 in runLibrary (selector=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrLexer.cpp:2274
#11 0x00000000005ba48a in SC_LanguageClient::runLibrary
    (symbol=0xa46758, this=0x830fe0 <gLangMutex>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/SC_LanguageClient.cpp:160
#12 SC_LanguageClient::executeFile
    (this=this@entry=0x93c310, fileName=fileName@entry=0x7fffffffda43 "/home/bbarros/test.scd") at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/SC_LanguageClient.cpp:180
#13 0x0000000000474642 in SC_TerminalClient::run
    (this=0x93c310, argc=<optimized out>, argv=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/SC_TerminalClient.cpp:266
#14 0x0000000000459abd in main (argc=2, argv=0x7fffffffd5a8)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/cmdLineFuncs.cpp:27
(gdb)

@Spacechild1
Copy link
Contributor

inNumToScan=-2130504259

Looks a lot like signed integer overflow (which is undefined behavior). Unfortunately, sclang still uses 32-bit signed integers (instead of size_t) throughout the codebase, causing all sorts of bugs on modern systems.

However, 1,850,426 doubles (= 14,803,408 bytes) is way below INT_MAX...

Please share a minimal code example that triggers the crash.

@smoge
Copy link
Contributor Author

smoge commented Mar 14, 2024

It also happens with Arrays with Ints. The numbers are produced with a pattern. They are produced with an Array.fill(NUMBER, {STREAM.next}). Nothing else.

Larger numbers do not trigger the bug: 2,279,156

Test sucessful with case: [0, 2, 0, 0, 2, 2, 1, 0, 0, 2, 1, 1, 0, 2, 2, 2, 0, 1, 0, 0, 2, 1, 2, 0, 0, 2, 1, 0, 0, 2, 0, 0, 1,  2, 2, 1, 0, 0, 2, 0, 0, 1, 2, 2, 1, 0, 1, 1, 1, 0, 0, 0, 2, 2, 0, 1, 2, 2, 2, 2, 0, 2, 2, 1, 2, 2, 1, 0, 0, 2, 1, 0, 2, 0, 0, 0, 2, 2, 0, 1, 2, 1, 0, 1, 0, 1, 1, 0, 1, 2, 0, 2, 2, 1, 2, 1, 1, 0, 0, 1, 2, 1, 0, 0, 1, 1, 1, 1, 0, 1, 2, 1, 0, 1, 2, 2, 1, 1, 0, 1, 0, 0, 0, 2, 2, 1, 1, 2, 2, 2, 2, 2, 0, 2, 0, 0, 2, 1, 0, 2, 1, 0, 2, 1, 2, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 2, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 2, 2, 1...etc...
2279156
[1, 0, 2, 0, 1, 1, 1, 2, 0, 1, 2, 0, 0, 2, 1, 2, 2, 2, 2, 0, 0, 2, 1, 0, 2, 2, 0, 0, 0, 2, 2, 2, 1, 1, 1, 0, 2, 2, 1, 1, 0, 2, 2, 0, 0, 2, 2, 1, 1, 2, 0, 1, 2, 2, 1, 0, 0, 2, 1, 2, 0, 1, 0, 1, 0, 2, 1, 1, 0, 2, 2, 2, 1, 1, 1, 1, 2, 1, 0, 1, 2, 0, 2, 1, 0, 1, 2, 2, 2, 2, 2, 2, 1, 2, 1, 2, 2, 1, 2, 2, 2, 2, 1, 1, 1, 2, 2, 2, 0, 0, 0, 2, 1, 2, 0, 2, 1, 1, 1, 2, 0, 2, 0, 1, 2, 1, 0, 2, 1, 2, 2, 2, 2, 0, 1, 2, 0, 0, 2, 0, 1, 0, 1, 0, 0, 1, 0, 1, 2, 2, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 2, 1, 2, 1, 0, 2, 0, 2, 1, 2...etc...
Test 9 with case: [1, 0, 2, 0, 1, 1, 1, 2, 0, 1, 2, 0, 0, 2, 1, 2, 2, 2, 2, 0, 0, 2, 1, 0, 2, 2, 0, 0, 0, 2, 2, 2, 1, 1, 1, 0, 2, 2, 1, 1, 0, 2, 2, 0, 0, 2, 2, 1, 1, 2, 0, 1, 2, 2, 1, 0, 0, 2, 1, 2, 0, 1, 0, 1, 0, 2, 1, 1, 0, 2, 2, 2, 1, 1, 1, 1, 2, 1, 0, 1, 2, 0, 2, 1, 0, 1, 2, 2, 2, 2, 2, 2, 1, 2, 1, 2, 2, 1, 2, 2, 2, 2, 1, 1, 1, 2, 2, 2, 0, 0, 0, 2, 1, 2, 0, 2, 1, 1, 1, 2, 0, 2, 0, 1, 2, 1, 0, 2, 1, 2, 2, 2, 2, 0, 1, 2, 0, 0, 2, 0, 1, 0, 1, 0, 0, 1, 0, 1, 2, 2, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 2, 1, 2, 1, 0, 2, 0, 2, 1, 2...etc...

Is it possible that it is triggered by compilation with compiler optimizations? -DNATIVE=ON?

@Spacechild1
Copy link
Contributor

Again, please share a minimal code example that triggers the crash. I don't want to guess, I want to copy, paste and run.

@smoge
Copy link
Contributor Author

smoge commented Mar 14, 2024


a = Pwhite.new(1802903, 1924888, inf).asStream;
b = Pwhite.new(0, 10, inf).asStream;

10 do: {
  Array.fill(a.next.round.asInteger.postln, {b.next})
}
    
1870189
Interpreter has crashed or stopped forcefully. [Exit code: 11]

@smoge
Copy link
Contributor Author

smoge commented Mar 14, 2024


*** Welcome to SuperCollider 3.14.0-dev. *** For help type ctrl-c ctrl-h (Emacs) or :SChelp (vim) or ctrl-U (sced/gedit).
[New Thread 0x7fff7f4006c0 (LWP 7937)]
1853747

Thread 1 "sclang" received signal SIGSEGV, Segmentation fault.
PyrGC::ScanSlots (inNumToScan=<optimized out>, inSlots=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:166
166	            if (obj->gc_color == whiteColor) {
(gdb) bt
#0  PyrGC::ScanSlots (inNumToScan=<optimized out>, inSlots=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:166
#1  PyrGC::ScanSlots (inNumToScan=-2076031525, inSlots=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:148
#2  PyrGC::DoPartialScan (inObjSize=<optimized out>, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:509
#3  PyrGC::ScanOneObj (this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:552
#4  PyrGC::Collect (this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:676
#5  0x000000000045e8c5 in PyrGC::Allocate
    (inRunCollection=<optimized out>, sizeclass=2, inNumBytes=7, this=0xb03900)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.h:307
#6  PyrGC::New
    (this=0xb03900, inNumBytes=7, inFlags=0, inFormat=7, inRunCollection=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/GC.cpp:358
#7  0x0000000000585b36 in newPyrString
    (gc=0xb03900, s=s@entry=0x7fffffffca80 "1807923", flags=flags@entry=0, runGC=runGC@entry=true) at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrObject.cpp:2449
#8  0x000000000048ad03 in prObjectString
    (g=0x847640 <gVMGlobals>, numArgsPushed=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangPrimSource/PyrPrimitive.cpp:433
#9  0x000000000049725a in doPrimitive
    (g=0x847640 <gVMGlobals>, meth=0x17dc880, numArgsPushed=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangPrimSource/PyrPrimitive.cpp:3888
#10 0x000000000045f2c7 in Interpret (g=0x74, g@entry=0x847640 <gVMGlobals>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrInterpreter3.cpp:3035
#11 0x000000000056fbf0 in runInterpreter
    (g=0x847640 <gVMGlobals>, selector=0xa46758, numArgsPushed=1)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrInterpreter3.cpp:127
#12 0x0000000000575be7 in runLibrary (selector=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/PyrLexer.cpp:2274
#13 0x00000000005ba48a in SC_LanguageClient::runLibrary
    (symbol=0xa46758, this=0x830fe0 <gLangMutex>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/SC_LanguageClient.cpp:160
#14 SC_LanguageClient::executeFile
    (this=this@entry=0x93c310, fileName=fileName@entry=0x7fffffffda43 "/home/bbarros/test.scd") at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/SC_LanguageClient.cpp:180
#15 0x0000000000474642 in SC_TerminalClient::run
    (this=0x93c310, argc=<optimized out>, argv=<optimized out>)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/SC_TerminalClient.cpp:266
#16 0x0000000000459abd in main (argc=2, argv=0x7fffffffd5a8)
    at /home/bbarros/scwork/git/2/curry_server/lang/LangSource/cmdLineFuncs.cpp:27
(gdb) 


@Spacechild1
Copy link
Contributor

Thanks! Unfortunately, I can't reproduce this here on Windows 10 with SC 3.13...

BTW, please add the OS version and SC version to your issue description.

@smoge
Copy link
Contributor Author

smoge commented Mar 15, 2024

Updated the ISSUE with

SYSTEM DETAILS:

GNU/Linux - Fedora 39 6.7.6-200 Intel x86_64
Custom compilation latest develop branch with native flags and -DNATIVE=ON

@smoge
Copy link
Contributor Author

smoge commented Mar 16, 2024

@JordanHendersonMusic It's more mysterious than that. It's a specific range (unrelated to anything like that), at least not related to this kind of overflow. I wonder if it has to do with optimizations because I didn't get that with another compilation with conservative flags.

I understand I should not guess, but it's just strange.

@mtmccrea
Copy link
Member

Ran the loop provided a handful of times and no crash on MacOS 14.4 M1 Pro 32GB memory, 3.14.0-dev.

@JordanHendersonMusic
Copy link
Contributor

JordanHendersonMusic commented Mar 25, 2024

Crashes immediately over here...

3.14.0-dev (develop branch)
Manjaro linux

Native and LTO.

OH NO — Does not crash in debug mode...

@JordanHendersonMusic
Copy link
Contributor

JordanHendersonMusic commented Mar 25, 2024

Further...

// crashes
b = Pwhite.new(0, 10, inf).asStream;
Array.fill(1810000, {b.next});

// does not crash
Array.fill(1810000, {1});

// does NOT crash
b = Routine({ loop { 1.yield } });
Array.fill(1810000, {b.next});

Seems like it might be in PWhite embedInStream?

@smoge
Copy link
Contributor Author

smoge commented Mar 29, 2024

OH NO — Does not crash in debug mode...

Here, it crashes with a debug build with native flags.

It seems related to Streams since the original crash used a stream.

In the past, I also experienced some rare crashes like this, specific to some linux builds.

@muellmusik
Copy link
Contributor

It’s happening in the garbage collector. Looks like there’s a memory bug been introduced somewhere, which may explain a few other issues. I’ll take a look when I get a minute.

@muellmusik
Copy link
Contributor

// crashes
b = Pwhite.new(0, 10, inf).asStream;
Array.fill(1810000, {b.next});

// does not crash
Array.fill(1810000, {1});

// does NOT crash
b = Routine({ loop { 1.yield } });
Array.fill(1810000, {b.next});

Tested with latest source, Release mode, MacOS 13.5.2. Does not crash.

@muellmusik
Copy link
Contributor

Debug build also does not crash

@muellmusik
Copy link
Contributor

@JordanHendersonMusic or @smoge could you do a fresh build and confirm for sanity?

I'm at 28a0b12

@JordanHendersonMusic
Copy link
Contributor

Yes same commit.

Build options
-DNATIVE=OFF -DINSTALL_HELP=ON -DSC_EL=OFF -DSYSTEM_BOOST=ON
boost 1.83.0-5

Manjaro linux.

Does not crash in debug here, but may trace is a little different, but if I remove all the HOT macros it looks the same.

When running

b = Pwhite.new(0, 10, inf).asStream;
Array.fill(1810000, {b.next});
[sclang] PyrGC::ScanSlots(pyrslot*, long) 0x00005555555bd538
[sclang] PyrGC::DoPartialScan(int) 0x00005555556da257
[sclang] PyrGC::ScanOneObj() 0x00005555556da440
[sclang] PyrGC::Collect() 0x00005555556da958
[sclang] PyrGC::NewFrame(unsigned long, long, long, bool) 0x00005555555d7040
[sclang] executeMethod(VMGlobals*, PyrMethod*, long) 0x00005555555df508
[sclang] Interpret(VMGlobals*) 0x00005555555d784d
[sclang] runInterpreter 0x00005555556dcd18
[sclang] runLibrary 0x00005555556e3067
[sclang] SC_LanguageClient::runLibrary(PyrSymbol*) 0x0000555555717fa4
[sclang] SC_TerminalClient::interpretInput() 0x00005555555e5fa4
[sclang] boost::asio::detail::completion_handler<boost::_bi::bind_t<void, boost::_mfi::mf0<void, SC_TerminalClient>, boost::_bi::list1<boost::_bi::value<SC_TerminalClient*> > >, boost::asio::io_context::basic_executor_type<std::allocator<void>, 0ul> >::do_complete(void*, boost::asio::detail::scheduler_operation*, boost::system::error_code const&, unsigned long) 0x00005555555f094c
[sclang] QtCollider::LangClient::customEvent(QEvent*) 0x00005555555f4b31
[libQt5Core.so.5] QObject::event(QEvent*) 0x00007fffee78c905
[libQt5Widgets.so.5] QApplicationPrivate::notify_helper(QObject*, QEvent*) 0x00007ffff791a8ff
[libQt5Core.so.5] QCoreApplication::notifyInternal2(QObject*, QEvent*) 0x00007fffee764ef8
[libQt5Core.so.5] QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) 0x00007fffee769e5b
[libQt5Core.so.5] <unknown> 0x00007fffee7afec8
[libglib-2.0.so.0] <unknown> 0x00007fffe7dc1f69
[libglib-2.0.so.0] <unknown> 0x00007fffe7e203a7
[libglib-2.0.so.0] g_main_context_iteration 0x00007fffe7dc0162
[libQt5Core.so.5] QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) 0x00007fffee7b3d0c
[libQt5Core.so.5] QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) 0x00007fffee763c04
[libQt5Core.so.5] QCoreApplication::exec() 0x00007fffee7650a3
[sclang] non-virtual thunk to QtCollider::LangClient::commandLoop() 0x00005555555f46d9
[sclang] SC_TerminalClient::run(int, char**) 0x00005555555e41a7
[sclang] main 0x00005555555d274d
[libc.so.6] <unknown> 0x00007fffed864cd0
[libc.so.6] __libc_start_main 0x00007fffed864d8a
[sclang] _start 0x00005555555e1d25

@JordanHendersonMusic
Copy link
Contributor

If I add this line...

COLD void PyrGC::ScanSlots(PyrSlot* inSlots, long inNumToScan) {
    std::cout << "innumtoscan " << inNumToScan << std::endl;

It prints innumtoscan -2128397868

@muellmusik
Copy link
Contributor

For laughs I downloaded the latest 'bleeding edge' build, which is from January 24th. That crashes, but I can't see any commits in the interim that should do that.

@muellmusik
Copy link
Contributor

Hmm. I'm using boost 1.74 from the packaged external_libraries. This did cause me a problem in hash.cpp with Xcode 15 because of std::unary_function being removed.

@JordanHendersonMusic
Copy link
Contributor

JordanHendersonMusic commented Apr 17, 2024

After a lot of debugging...

A single static cast fixed this for me.
I guess it has something to do with right shifting a signed integer, which when negative, is implementation defined.

#6256

@muellmusik
Copy link
Contributor

Okay, got it to build using -DCMAKE_CXX_FLAGS="--std=c++17 -D_LIBCPP_ENABLE_CXX17_REMOVED_FEATURES"

Debug build does not crash. Release does crash.

@muellmusik
Copy link
Contributor

See my comment on #6257. I think this is not a bug, but just integer overflow on mNumToScan due to the large number of frames created. It might be worth considering increase it to int64 but that's another topic. In the meantime it would be good if someone could check my conclusions there.

@muellmusik muellmusik added comp: sclang sclang C++ implementation (primitives, etc.). for changes to class lib use "comp: class library" crash things which cause a crash in the interpreter, servers, or IDE. do not use for PRs labels Apr 19, 2024
@JordanHendersonMusic
Copy link
Contributor

I believe this is due to the temporary function objects not being free'd until the entire line has been executed, which in turn, causes an overflow when trying to print the result to the post window. It actually has little to do with arrays.

See #6257 (comment)

@smoge
Copy link
Contributor Author

smoge commented Apr 21, 2024

@JordanHendersonMusic or @smoge could you do a fresh build and confirm for sanity?

I'm at 28a0b12

I've just got this update, I'll check that soon.

@muellmusik
Copy link
Contributor

I think we’re good actually! Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Issues that relate to unexpected/unwanted behavior. Don't use for PRs. comp: sclang sclang C++ implementation (primitives, etc.). for changes to class lib use "comp: class library" crash things which cause a crash in the interpreter, servers, or IDE. do not use for PRs
Projects
None yet
5 participants