Crash Ginsh when trying to solve equation involving integral numerically
Hi, I tried to solve an equation numerically, using Ginsh from the git repository. When entering fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100) into Ginsh, it crashes, see below. I got the same problem with the version shipped with the latest stable Ubuntu Linux. GCC version is "gcc (Ubuntu 4.4.3-4ubuntu5) 4.4.3". If you need more information, please tell me. Regards, Moritz emh@mate:~/ginac$ ./ginsh/ginsh ginsh - GiNaC Interactive Shell (ginac V1.5.0) __, _______ Copyright (C) 1999-2010 Johannes Gutenberg University Mainz, (__) * | Germany. This is free software with ABSOLUTELY NO WARRANTY. ._) i N a C | You are welcome to redistribute it under certain conditions. <-------------' For details type `warranty;'. Type ?? for a list of help topics.
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100); *** glibc detected *** /home/emh/ginac/ginsh/.libs/lt-ginsh: malloc(): memory corruption (fast): 0x091c7cdf *** ======= Backtrace: ========= /lib/tls/i686/cmov/libc.so.6(+0x6b591)[0x7b3591] /lib/tls/i686/cmov/libc.so.6(+0x6e710)[0x7b6710] /lib/tls/i686/cmov/libc.so.6(__libc_malloc+0x5c)[0x7b7f9c] /usr/lib/libstdc++.so.6(_Znwj+0x27)[0x70fc07] /home/emh/ginac/ginac/.libs/libginac-1.5.so.0(_ZNSt6vectorIN5GiNaC6expairESaIS1_EE7reserveEj+0x62)[0x3d4522] /home/emh/ginac/ginac/.libs/libginac-1.5.so.0(_ZNK5GiNaC9expairseq12subschildrenERKSt3mapINS_2exES2_NS_10ex_is_lessESaISt4pairIKS2_S2_EEEj+0x145)[0x414745] /home/emh/ginac/ginac/.libs/libginac-1.5.so.0(_ZNK5GiNaC9expairseq4subsERKSt3mapINS_2exES2_NS_10ex_is_lessESaISt4pairIKS2_S2_EEEj+0x37)[0x417347] /home/emh/ginac/ginsh/.libs/lt-ginsh(_ZNK5GiNaC9containerISt6vectorE12subschildrenERKSt3mapINS_2exES4_NS_10ex_is_lessESaISt4pairIKS4_S4_EEEj+0x65)[0x8062375] /home/emh/ginac/ginsh/.libs/lt-ginsh(_ZNK5GiNaC9containerISt6vectorE4subsERKSt3mapINS_2exES4_NS_10ex_is_lessESaISt4pairIKS4_S4_EEEj+0x2c)[0x80625fc] /home/emh/ginac/ginac/.libs/libginac-1.5.so.0(_ZNK5GiNaC9expairseq12subschildrenERKSt3mapINS_2exES2_NS_10ex_is_lessESaISt4pairIKS2_S2_EEEj+0x25c)[0x41485c] /home/emh/ginac/ginac/.libs/libginac-1.5.so.0(_ZNK5GiNaC9expairseq4subsERKSt3mapINS_2exES2_NS_10ex_is_lessESaISt4pairIKS2_S2_EEEj+0x37)[0x417347] /home/emh/ginac/ginac/.libs/libginac-1.5.so.0(_ZNK5GiNaC2ex4subsERKS0_j +0x1e0)[0x40eeb0] /home/emh/ginac/ginac/.libs/libginac-1.5.so.0(_ZN5GiNaC6fsolveERKNS_2exERKNS_6symbolERKNS_7numericES8_+0x1bfd)[0x47262d] /home/emh/ginac/ginsh/.libs/lt-ginsh[0x8059103] /home/emh/ginac/ginsh/.libs/lt-ginsh[0x805b52e] /home/emh/ginac/ginsh/.libs/lt-ginsh[0x805d64f] /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0x75ebd6] /home/emh/ginac/ginsh/.libs/lt-ginsh[0x8052ee1] ======= Memory map: ======== 00110000-00144000 r-xp 00000000 08:01 2359427 /lib/libncurses.so.5.7 00144000-00145000 ---p 00034000 08:01 2359427 /lib/libncurses.so.5.7 00145000-00147000 r--p 00034000 08:01 2359427 /lib/libncurses.so.5.7 00147000-00148000 rw-p 00036000 08:01 2359427 /lib/libncurses.so.5.7 00148000-002ca000 r-xp 00000000 08:01 2930970 /usr/lib/libcln.so.6.0.1 002ca000-002cc000 r--p 00182000 08:01 2930970 /usr/lib/libcln.so.6.0.1 002cc000-002d2000 rw-p 00184000 08:01 2930970 /usr/lib/libcln.so.6.0.1 002d2000-002d4000 rw-p 00000000 00:00 0 002d4000-002f1000 r-xp 00000000 08:01 2359423 /lib/libgcc_s.so.1 002f1000-002f2000 r--p 0001c000 08:01 2359423 /lib/libgcc_s.so.1 002f2000-002f3000 rw-p 0001d000 08:01 2359423 /lib/libgcc_s.so.1 002f3000-002f5000 r-xp 00000000 08:01 2363303 /lib/tls/i686/cmov/libdl-2.11.1.so 002f5000-002f6000 r--p 00001000 08:01 2363303 /lib/tls/i686/cmov/libdl-2.11.1.so 002f6000-002f7000 rw-p 00002000 08:01 2363303 /lib/tls/i686/cmov/libdl-2.11.1.so 00365000-00649000 r-xp 00000000 08:01 1250386 /home/emh/ginac/ginac/.libs/libginac-1.5.so.0.0.0 00649000-0064f000 r--p 002e3000 08:01 1250386 /home/emh/ginac/ginac/.libs/libginac-1.5.so.0.0.0 0064f000-00651000 rw-p 002e9000 08:01 1250386 /home/emh/ginac/ginac/.libs/libginac-1.5.so.0.0.0 00651000-00652000 rw-p 00000000 00:00 0 00652000-0073b000 r-xp 00000000 08:01 2885327 /usr/lib/libstdc ++.so.6.0.13 0073b000-0073c000 ---p 000e9000 08:01 2885327 /usr/lib/libstdc ++.so.6.0.13 0073c000-00740000 r--p 000e9000 08:01 2885327 /usr/lib/libstdc ++.so.6.0.13 00740000-00741000 rw-p 000ed000 08:01 2885327 /usr/lib/libstdc ++.so.6.0.13 00741000-00748000 rw-p 00000000 00:00 0 00748000-0089b000 r-xp 00000000 08:01 2363300 /lib/tls/i686/cmov/libc-2.11.1.so 0089b000-0089c000 ---p 00153000 08:01 2363300 /lib/tls/i686/cmov/libc-2.11.1.so 0089c000-0089e000 r--p 00153000 08:01 2363300 /lib/tls/i686/cmov/libc-2.11.1.so 0089e000-0089f000 rw-p 00155000 08:01 2363300 /lib/tls/i686/cmov/libc-2.11.1.so 0089f000-008a2000 rw-p 00000000 00:00 0 008c5000-00924000 r-xp 00000000 08:01 2915588 /usr/lib/libgmp.so.3.5.2 00924000-00925000 r--p 0005e000 08:01 2915588 /usr/lib/libgmp.so.3.5.2 00925000-00926000 rw-p 0005f000 08:01 2915588 /usr/lib/libgmp.so.3.5.2 009e8000-00a03000 r-xp 00000000 08:01 2359473 /lib/ld-2.11.1.so 00a03000-00a04000 r--p 0001a000 08:01 2359473 /lib/ld-2.11.1.so 00a04000-00a05000 rw-p 0001b000 08:01 2359473 /lib/ld-2.11.1.so 00a1c000-00a40000 r-xp 00000000 08:01 2363304 /lib/tls/i686/cmov/libm-2.11.1.so 00a40000-00a41000 r--p 00023000 08:01 2363304 /lib/tls/i686/cmov/libm-2.11.1.so 00a41000-00a42000 rw-p 00024000 08:01 2363304 /lib/tls/i686/cmov/libm-2.11.1.so 00c1d000-00c1e000 r-xp 00000000 00:00 0 [vdso] 00c66000-00c95000 r-xp 00000000 08:01 2359739 /lib/libreadline.so.6.1 00c95000-00c96000 r--p 0002e000 08:01 2359739 /lib/libreadline.so.6.1 00c96000-00c99000 rw-p 0002f000 08:01 2359739 /lib/libreadline.so.6.1 00c99000-00c9a000 rw-p 00000000 00:00 0 08048000-0806f000 r-xp 00000000 08:01 1250662 /home/emh/ginac/ginsh/.libs/lt-ginsh 0806f000-08070000 r--p 00026000 08:01 1250662 /home/emh/ginac/ginsh/.libs/lt-ginsh 08070000-08071000 rw-p 00027000 08:01 1250662 /home/emh/ginac/ginsh/.libs/lt-ginsh 08071000-08072000 rw-p 00000000 00:00 0 09197000-091d9000 rw-p 00000000 00:00 0 [heap] b7600000-b7621000 rw-p 00000000 00:00 0 b7621000-b7700000 ---p 00000000 00:00 0 b77cb000-b780a000 r--p 00000000 08:01 2889421 /usr/lib/locale/en_US.utf8/LC_CTYPE b780a000-b780e000 rw-p 00000000 00:00 0 b7825000-b782c000 r--s 00000000 08:01 2960058 /usr/lib/gconv/gconv-modules.cache b782c000-b782f000 rw-p 00000000 00:00 0 bff86000-bff9b000 rw-p 00000000 00:00 0 [stack] Aborted
* Ernst Moritz Hahn <emh@cs.uni-sb.de> [Aug 17. 2010 09:46]:
Hi,
I tried to solve an equation numerically, using Ginsh from the git repository. When entering
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100)
into Ginsh, it crashes, see below. I got the same problem with the version shipped with the latest stable Ubuntu Linux. [...]
I can reproduces this. AMD64 openSUSE 11.3 gcc version 4.5.0 20100604 [gcc-4_5-branch revision 160292] (SUSE Linux) gmp-5.0.1 cln-1.3.1 ginac-1.5.8 Type ?? for a list of help topics.
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100) *** glibc detected *** ginsh: malloc(): memory corruption (fast): 0x000000000071517f *** ======= Backtrace: ========= [etc.]
Hello, On Tue, Aug 17, 2010 at 12:30:08PM +0200, Joerg Arndt wrote:
I can reproduces this.
AMD64 openSUSE 11.3 gcc version 4.5.0 20100604 [gcc-4_5-branch revision 160292] (SUSE Linux)
gmp-5.0.1 cln-1.3.1 ginac-1.5.8
Type ?? for a list of help topics.
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100) *** glibc detected *** ginsh: malloc(): memory corruption (fast): 0x000000000071517f *** ======= Backtrace: ========= [etc.]
Could you please post the actual backtrace? Best regards, Alexei
* Alexei Sheplyakov <alexei.sheplyakov@gmail.com> [Aug 18. 2010 20:12]:
Hello,
[...]
Could you please post the actual backtrace?
Attached the file ginsh-backtrace.txt
Best regards, Alexei
_______________________________________________ GiNaC-list mailing list GiNaC-list@ginac.de https://www.cebix.net/mailman/listinfo/ginac-list
Valgrind may be of help: % valgrind --leak-check=full --show-reachable=yes ginsh ==5369== Memcheck, a memory error detector ==5369== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al. ==5369== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info ==5369== Command: ginsh ==5369== ginsh - GiNaC Interactive Shell (ginac V1.5.8) __, _______ Copyright (C) 1999-2010 Johannes Gutenberg University Mainz, (__) * | Germany. This is free software with ABSOLUTELY NO WARRANTY. ._) i N a C | You are welcome to redistribute it under certain conditions. <-------------' For details type `warranty;'. Type ?? for a list of help topics.
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100) ==5369== Invalid read of size 4 ==5369== at 0x4F64D60: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (object.h:211) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369== Address 0x7064b90 is 0 bytes inside a block of size 16 free'd ==5369== at 0x4C25C8D: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==5369== by 0x4EC9064: GiNaC::add::~add() (new_allocator.h:95) ==5369== by 0x4F63D85: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (ex.h:66) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369== ==5369== Invalid write of size 4 ==5369== at 0x4F64D67: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (object.h:211) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369== Address 0x7064b90 is 0 bytes inside a block of size 16 free'd ==5369== at 0x4C25C8D: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==5369== by 0x4EC9064: GiNaC::add::~add() (new_allocator.h:95) ==5369== by 0x4F63D85: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (ex.h:66) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369==
Note no segfault happens.
On Tue, Aug 17, 2010 at 01:49:19PM +0200, Joerg Arndt wrote:
Valgrind may be of help:
% valgrind --leak-check=full --show-reachable=yes ginsh ==5369== Memcheck, a memory error detector ==5369== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al. ==5369== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info ==5369== Command: ginsh ==5369== ginsh - GiNaC Interactive Shell (ginac V1.5.8) __, _______ Copyright (C) 1999-2010 Johannes Gutenberg University Mainz, (__) * | Germany. This is free software with ABSOLUTELY NO WARRANTY. ._) i N a C | You are welcome to redistribute it under certain conditions. <-------------' For details type `warranty;'.
Type ?? for a list of help topics.
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100) ==5369== Invalid read of size 4 ==5369== at 0x4F64D60: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (object.h:211) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369== Address 0x7064b90 is 0 bytes inside a block of size 16 free'd ==5369== at 0x4C25C8D: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==5369== by 0x4EC9064: GiNaC::add::~add() (new_allocator.h:95) ==5369== by 0x4F63D85: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (ex.h:66) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369== ==5369== Invalid write of size 4 ==5369== at 0x4F64D67: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (object.h:211) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369== Address 0x7064b90 is 0 bytes inside a block of size 16 free'd ==5369== at 0x4C25C8D: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==5369== by 0x4EC9064: GiNaC::add::~add() (new_allocator.h:95) ==5369== by 0x4F63D85: GiNaC::fsolve(GiNaC::ex const&, GiNaC::symbol const&, GiNaC::numeric const&, GiNaC::numeric const&) (ex.h:66) ==5369== by 0x4118B7: f_fsolve(GiNaC::container<std::vector> const&) (ginsh_parser.yy:442) ==5369== by 0x416B6C: yyparse() (ginsh_parser.yy:256) ==5369== by 0x417C0F: main (ginsh_parser.yy:960) ==5369==
This looks like a double free/delete. It might be the cause of memory corruption reported by glibc. Still I don't quite understand what's going on. Perhaps our wrapped (a.k.a. "smart") pointers are not that smart, and got the reference counting wrong in some corner case(s). Or refcount get corrupted even earlier (due to some different bug).
Note no segfault happens.
I guess valgrind detects the double delete attempt and does not actually delete the dead object. Best regards, Alexei
Hello, On Mon, Aug 16, 2010 at 10:09:01PM +0200, Ernst Moritz Hahn wrote:
I tried to solve an equation numerically, using Ginsh from the git repository. When entering
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100)
into Ginsh, it crashes, see below. I got the same problem with the version shipped with the latest stable Ubuntu Linux.
GCC version is "gcc (Ubuntu 4.4.3-4ubuntu5) 4.4.3".
Thanks for a bug report. I'm working on this (no fix yet, sorry). Best regards, Alexei
Hello, On Mon, Aug 16, 2010 at 10:09:01PM +0200, Ernst Moritz Hahn wrote:
I tried to solve an equation numerically, using Ginsh from the git repository. When entering
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100)
into Ginsh, it crashes, see below. I got the same problem with the version shipped with the latest stable Ubuntu Linux.
I've posted patches which should fix this bug to ginac-devel (the combined patch is attached for convenience). Could you please check if they work for you? Best regards, Alexei
* Alexei Sheplyakov <alexei.sheplyakov@gmail.com> [Aug 22. 2010 14:57]:
Hello,
On Mon, Aug 16, 2010 at 10:09:01PM +0200, Ernst Moritz Hahn wrote:
I tried to solve an equation numerically, using Ginsh from the git repository. When entering
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100)
into Ginsh, it crashes, see below. I got the same problem with the version shipped with the latest stable Ubuntu Linux.
I've posted patches which should fix this bug to ginac-devel (the combined patch is attached for convenience). Could you please check if they work for you?
Best regards, Alexei
[...]
Sehr gut! Erfolg! Jawohl! % ginsh ginsh - GiNaC Interactive Shell (ginac V1.5.8) __, _______ Copyright (C) 1999-2010 Johannes Gutenberg University Mainz, (__) * | Germany. This is free software with ABSOLUTELY NO WARRANTY. ._) i N a C | You are welcome to redistribute it under certain conditions. <-------------' For details type `warranty;'. Type ?? for a list of help topics.
fsolve((1/(sqrt(2*Pi)))*integral(t,0,x,exp(-1/2*t^2))==0.5,x,0,100); 6.4971304904725288433
participants (3)
-
Alexei Sheplyakov
-
Ernst Moritz Hahn
-
Joerg Arndt