Crash from DEMHandler
Mantis Issue 631, reported by gpasero, assigned to gpasero, created: 2013-02-04
Crashes involving the DEMHandler have been observed. The output message is the following : WARNING: In /home/gpasero/ORFEO-TOOLBOX/OTB/Utilities/ITK/Code/Common/itkLightObject.cxx, line 277 LightObject (0x7fffcc0008f0): Trying to delete object with non-zero reference count.
*** glibc detected *** /home/gpasero/ORFEO-TOOLBOX/Stereo/test_stereo: double free or corruption (fasttop): 0x00007fffcc0008f0 ***
And the backtrace : #0 0x00007fffed7d0b25 in *__GI_raise (sig=) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 #1 (closed) 0x00007fffed7d4670 in *__GI_abort () at abort.c:92 #2 (closed) 0x00007fffed80bafb in __libc_message (do_abort=, fmt=) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189 #3 (closed) 0x00007fffed815bb6 in malloc_printerr (action=3, str=0x7fffed8eaf88 "double free or corruption (fasttop)", ptr=) at malloc.c:6266 #4 (closed) 0x00007fffed81c483 in __GI___libc_free (mem=) at malloc.c:3738 #5 (closed) 0x00007ffff3bb45a7 in ~DEMHandler (this=0x7fffcc0008f0, __in_chrg=) at /home/gpasero/ORFEO-TOOLBOX/OTB/Code/UtilitiesAdapters/OssimAdapters/otbDEMHandler.h:168 #6 (closed) 0x00007ffff0ee78db in itk::LightObject::UnRegister (this=0x7fffcc0008f0) at /home/gpasero/ORFEO-TOOLBOX/OTB/Utilities/ITK/Code/Common/itkLightObject.cxx:222 #7 (closed) 0x00007ffff0f0faa6 in itk::Object::UnRegister (this=0x7fffcc0008f0) at /home/gpasero/ORFEO-TOOLBOX/OTB/Utilities/ITK/Code/Common/itkObject.cxx:338 #8 (closed) 0x00007ffff3bb3875 in otb::DEMHandler::Instance () at /home/gpasero/ORFEO-TOOLBOX/OTB/Code/UtilitiesAdapters/OssimAdapters/otbDEMHandler.cxx:43 #9 (closed) 0x00007ffff3bb15f9 in SensorModelAdapter (this=0x7fffdc00c5e0) at /home/gpasero/ORFEO-TOOLBOX/OTB/Code/UtilitiesAdapters/OssimAdapters/otbSensorModelAdapter.cxx:38 #10 (closed) 0x0000000000439d38 in otb::SensorModelBase<double, 3u, 3u>::SensorModelBase() () #11 (closed) 0x000000000044f225 in otb::GenericRSTransform<double, 3u, 3u>::InstanciateTransform() () #12 (closed) 0x0000000000444ae0 in otb::DisparityMapTo3DFilter<otb::Image<float, 2u>, otb::VectorImage<float, 2u>, otb::VectorImage<float, 2u>, otb::Image<float, 2u> >::ThreadedGenerateData(itk::ImageRegion<2u> const&, int) () #13 (closed) 0x0000000000427e59 in itk::ImageSource<otb::VectorImage<float, 2u> >::ThreaderCallback(void) () #14 (closed) 0x00007ffff0ef4711 in itk::MultiThreader::SingleMethodProxy (arg=0x726aa8) at /home/gpasero/ORFEO-TOOLBOX/OTB/Utilities/ITK/Code/Common/itkMultiThreader.cxx:853 #15 (closed) 0x00007fffef45c9ca in start_thread (arg=) at pthread_create.c:300 #16 (closed) 0x00007fffed88621d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112 #17 (closed) 0x0000000000000000 in ?? ()
It seems to be a problem of thread safety. The DEMHandler is a singleton and there is no mutex in the constructor. In the example here, it is called from a ThreadedGenerateData() method. The singleton isn't called anywhere else.
1401176887 - gpaseroThe bug was already fixed in the filter DisparityMapTo3DFilter (transforms stored in private members and instanciated in BeforeThreadedGenerateData).
The same fix has been applied to other classes with the same conception flaw : http://hg.orfeo-toolbox.org/OTB/rev/e5cf70d1d2c7
1429262650 - julienClosing resolved bugs.