Segmentation fault in `H5FL.c`
- Dominant language
- C
- Stars
- 988
- Forks
- 355
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 12
Description
**Describe the bug**
While testing [python-xbout](https://github.com/boutproject/xBOUT/pull/303) I got some segfaults from python.
While the error is only seemingly random, it always in hdf5 code, in `H5FL.c`
Here are some backtraces:
```
xbout/tests/test_grid.py::TestOpenGrid::test_open_grid_chunks
Thread 4 "python3" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd5f506c0 (LWP 809)]
H5FL_reg_malloc (head=0x7fffe10608e0 ) at ../../src/H5FL.c:345
345 head->list = head->list->next;
#0 H5FL_reg_malloc (head=0x7fffe10608e0 ) at ../../src/H5FL.c:345
#1 0x00007fffe0e71e6d in H5SL__new_node (item=0x555555db3bd0, key=0x555555db3bd0, hashval=1249207996) at ../../src/H5SL.c:633
#2 0x00007fffe0e73d4b in H5SL__insert_common (slist=, item=0x555555db3bd0, key=0x555555db3bd0) at ../../src/H5SL.c:742
#3 0x00007fffe0e7438d in H5SL_insert (slist=, item=, key=) at ../../src/H5SL.c:1035
#4 0x00007fffe0e409f8 in H5P__create (pclass=) at ../../src/H5Pint.c:1881
#5 H5P_create_id (pclass=, app_ref=true) at ../../src/H5Pint.c:1967
#6 0x00007fffe0e16971 in H5Pcreate (cls_id=720575940379279371) at ../../src/H5P.c:237
#7 0x00007fffe11259e2 in NC4_get_vars (ncid=720896, varid=, startp=, countp=, stridep=stridep@entry=0x0, data=0x7fffd00e9d00, mem_nc_type=) at ../libhdf5/../../libhdf5/hdf5var.c:2091
#8 0x00007fffe11261d9 in NC4_get_vara (ncid=, varid=, startp=, countp=, ip=, memtype=) at ../libhdf5/../../libhdf5/hdf5var.c:1402
#9 0x00007fffe10d2bd2 in NC_get_vara (ncid=ncid@entry=720896, varid=varid@entry=1, start=start@entry=0x7fffd00046a0, edges=edges@entry=0x7fffd0026c80, value=value@entry=0x7fffd00e9d00, memtype=6) at ../libdispatch/../../libdispatch/dvarget.c:104
#10 0x00007fffe10d2ce1 in nc_get_vara (ncid=720896, varid=1, startp=startp@entry=0x7fffd00046a0, countp=countp@entry=0x7fffd0026c80, ip=0x7fffd00e9d00) at ../libdispatch/../../libdispatch/dvarget.c:750
#11 0x00007fffe13c7302 in __pyx_pf_7netCDF4_8_netCDF4_8Variable_84_get (__pyx_v_self=0x7fffd69481e0, __pyx_v_start=, __pyx_v_count=, __pyx_v_stride=) at src/netCDF4/_netCDF4.c:80071
#12 __pyx_pw_7netCDF4_8_netCDF4_8Variable_85_get (__pyx_v_self=, __pyx_args=, __pyx_nargs=, __pyx_kwds=) at src/netCDF4/_netCDF4.c:79403
#13 0x00007fffe13f9ed8 in __pyx_pf_7netCDF4_8_netCDF4_8Variable_50__getitem__ (__pyx_v_self=, __pyx_v_elem=) at src/netCDF4/_netCDF4.c:66013
#14 0x00007ffff7b55fd7 in _PyEval_EvalFrameDefault (tstate=, frame=, throwflag=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/generated_cases.c.h:1167
#15 0x00007ffff7bd5d9f in _PyEval_EvalFrame (tstate=0x555555faa340, frame=0x7ffff732e7f0, throwflag=0) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Include/internal/pycore_ceval.h:119
#16 _PyEval_Vector (tstate=0x555555faa340, func=0x7fffdc9087c0, locals=0x0, args=, argcount=, kwnames=0x0) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/ceval.c:1806
```
and
```
[Switching to Thread 0x7fffd574f6c0 (LWP 767)]
0x00007fffe0d7c6c9 in H5FL_fac_free (head=0x31, obj=0x55555e055930) at ../../src/H5FL.c:1774
1774 head->onlist++;
#0 0x00007fffe0d7c6c9 in H5FL_fac_free (head=0x31, obj=0x55555e055930) at ../../src/H5FL.c:1774
#1 0x00007fffe0e72ef3 in H5SL__insert_common (slist=0x55555f4f2dd0, item=0x555555db3060, key=0x555555db3060) at ../../src/H5SL.c:705
#2 0x00007fffe0e7438d in H5SL_insert (slist=, item=, key=) at ../../src/H5SL.c:1035
#3 0x00007fffe0e4075f in H5P_close (plist=0x5555603d3a20) at ../../src/H5Pint.c:5218
#4 0x00007fffe0e3a88d in H5P__close_list_cb (_plist=, request=) at ../../src/H5Pint.c:730
#5 0x00007fffe0dc1c5b in H5I__dec_ref (id=792633534417612735, request=request@entry=0x0) at ../../src/H5Iint.c:970
#6 0x00007fffe0dc1d0f in H5I_dec_ref (id=) at ../../src/H5Iint.c:1009
#7 0x00007fffe0d0e6aa in H5D_close (dataset=0x55555ffd68b0) at ../../src/H5Dint.c:2020
#8 0x00007fffe0f386ed in H5VL__native_dataset_close (dset=, dxpl_id=, req=) at ../../src/H5VLnative_dataset.c:826
#9 0x00007fffe0f5b628 in H5VL__dataset_close.isra.0 (obj=, dxpl_id=, req=, cls=) at ../../src/H5VLcallback.c:2619
#10 0x00007fffe0f2717f in H5VL_dataset_close (vol_obj=0x55555a766650, dxpl_id=792633534417207304, req=0x0) at ../../src/H5VLcallback.c:2656
#11 0x00007fffe0d0b327 in H5D__close_cb (dset_vol_obj=0x55555a766650, request=) at ../../src/H5Dint.c:298
#12 0x00007fffe0dc1c5b in H5I__dec_ref (id=id@entry=360287970189864103, request=request@entry=0x0) at ../../src/H5Iint.c:970
#13 0x00007fffe0dc1d71 in H5I__dec_app_ref (id=id@entry=360287970189864103, request=request@entry=0x0) at ../../src/H5Iint.c:1041
#14 0x00007fffe0dc1f8b in H5I__dec_app_ref_always_close (id=360287970189864103, request=0x0) at ../../src/H5Iint.c:1150
#15 H5I_dec_app_ref_always_close (id=360287970189864103) at ../../src/H5Iint.c:1191
```
And here is another one:
```
xbout/tests/test_load.py::TestOpen::test_combine_along_t SKIPPED [ 30%]
xbout/tests/test_load.py::TestOpen::test_combine_along_xy[lengths0-False-False]
Thread 1 "python3" received signal SIGSEGV, Segmentation fault.
0x00007fffe0d72503 in H5FL__reg_gc_list (head=0x7fffe105dde0 ) at ../../src/H5FL.c:420
420 tmp = free_list->next;
#0 0x00007fffe0d72503 in H5FL__reg_gc_list (head=0x7fffe105dde0 ) at ../../src/H5FL.c:420
#1 H5FL__reg_gc () at ../../src/H5FL.c:464
#2 H5FL_reg_free (head=, obj=) at ../../src/H5FL.c:307
#3 H5FL_reg_free (head=, obj=) at ../../src/H5FL.c:268
#4 0x00007fffe0dae0a9 in H5HF__hdr_free (hdr=0x555557feb7b0) at ../../src/H5HFhdr.c:1330
#5 0x00007fffe0da557d in H5HF__cache_hdr_free_icr (_thing=) at ../../src/H5HFcache.c:816
#6 0x00007fffe0cd50fd in H5C__flush_single_entry (f=0x55555ba73640, entry_ptr=0x555557feb7b0, flags=24592) at ../../src/H5Centry.c:861
#7 0x00007fffe0ce20df in H5C__flush_invalidate_ring (f=, ring=1, flags=) at ../../src/H5Cint.c:1453
#8 H5C__flush_invalidate_cache (f=0x55555ba73640, flags=) at ../../src/H5Cint.c:1051
#9 0x00007fffe0cd9d24 in H5C_dest (f=0x55555ba73640) at ../../src/H5C.c:501
#10 0x00007fffe0cb5d0f in H5AC_dest (f=0x55555ba73640) at ../../src/H5AC.c:476
#11 0x00007fffe0d49388 in H5F__dest (f=f@entry=0x55555ba73640, flush=flush@entry=true, free_on_failure=free_on_failure@entry=false) at ../../src/H5Fint.c:1536
#12 0x00007fffe0d4c6d4 in H5F_try_close (f=0x55555ba73640, was_closed=was_closed@entry=0x0) at ../../src/H5Fint.c:2653
#13 0x00007fffe0d4ca91 in H5F__close (f=) at ../../src/H5Fint.c:2455
#14 0x00007fffe0f3a36d in H5VL__native_file_close (file=0x55555ba73640, dxpl_id=, req=) at ../../src/H5VLnative_file.c:777
#15 0x00007fffe0f5aeb8 in H5VL__file_close.isra.0 (obj=, dxpl_id=, req=, cls=) at ../../src/H5VLcallback.c:4121
#16 0x00007fffe0f30dcf in H5VL_file_close (vol_obj=0x5555586924f0, dxpl_id=792633534417207304, req=0x0) at ../../src/H5VLcallback.c:4152
#17 0x00007fffe0d45d52 in H5F__close_cb (file_vol_obj=0x5555586924f0, request=) at ../../src/H5Fint.c:217
#18 0x00007fffe0dc1c5b in H5I__dec_ref (id=id@entry=72057594037929534, request=request@entry=0x0) at ../../src/H5Iint.c:970
#19 0x00007fffe0dc1d71 in H5I__dec_app_ref (id=72057594037929534, request=request@entry=0x0) at ../../src/H5Iint.c:1041
#20 0x00007fffe0dc1e2f in H5I_dec_app_ref (id=) at ../../src/H5Iint.c:1086
#21 0x00007fffe0d3f2f8 in H5Fclose (file_id=72057594037929534) at ../../src/H5F.c:1046
#22 0x00007fffe111b835 in nc4_close_netcdf4_file (h5=0x55555cc048e0, abort=0, memio=0x0) at ../libhdf5/../../libhdf5/hdf5file.c:233
#23 0x00007fffe1120138 in NC4_close (ncid=, params=) at ../libhdf5/../../libhdf5/hdf5file.c:633
#24 0x00007fffe10d806b in nc_close (ncid=131072) at ../libdispatch/../../libdispatch/dfile.c:1308
#25 0x00007fffe132421e in __pyx_pf_7netCDF4_8_netCDF4_7Dataset_14_close (__pyx_v_self=0x7fffd8be6240, __pyx_v_check_err=True) at src/netCDF4/_netCDF4.c:30377
#26 __pyx_pw_7netCDF4_8_netCDF4_7Dataset_15_close (__pyx_v_self=, __pyx_args=, __pyx_nargs=1, __pyx_kwds=) at src/netCDF4/_netCDF4.c:30326
#27 0x00007fffe1323853 in __pyx_pf_7netCDF4_8_netCDF4_7Dataset_18close (__pyx_v_self=) at src/netCDF4/_netCDF4.c:30925
#28 __pyx_pw_7netCDF4_8_netCDF4_7Dataset_19close (__pyx_v_self=, __pyx_args=, __pyx_nargs=, __pyx_kwds=) at src/netCDF4/_netCDF4.c:30813
#29 0x00007ffff7b42fd7 in _PyObject_VectorcallTstate (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=<_cython_3_0_11.cython_function_or_method at remote 0x7fffe15217d0>, args=, nargsf=, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Include/internal/pycore_call.h:168
#30 PyObject_Vectorcall (callable=<_cython_3_0_11.cython_function_or_method at remote 0x7fffe15217d0>, args=, nargsf=, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:327
#31 0x00007ffff7b58e2f in _PyEval_EvalFrameDefault (tstate=, frame=, throwflag=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/generated_cases.c.h:813
#32 0x00007ffff7b8745f in _PyObject_VectorcallTstate (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, args=0x7fffffffbcf8, nargsf=9223372036854775809, kwnames=0x0) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Include/internal/pycore_call.h:168
#33 PyObject_CallOneArg (func=, arg=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:395
#34 0x00007ffff7c7a606 in slot_tp_finalize (self=, _args=('/tmp/pytest-of-mockbuild/pytest-8/test_reload_separate_variables_time_split1/temp_boutdata_1_T.nc',), _mode='r', _kwargs={'clobber': True, 'diskless': False, 'persist': False, 'format': 'NETCDF4'}, _use_default_lock=True, _lock=<_thread.lock at remote 0x7fffd6b20780>, _cache=, _manager_id='e7b86aeb-52e5-45ad-a514-9f0dcf4bb559', _key=<_HashedSequence(hashvalue=-7063547784399903334) at remote 0x7fffd6127fc0>, _ref_counter=<_RefCounter(_counts={<_HashedSequence(hashvalue=443758223283057862) at remote 0x7fffd6c4d400>: 1, <_HashedSequence(hashvalue=8835520193079304715) at remote 0x7fffd7d97bb0>: 1, <_HashedSequence(hashvalue=3675166950999576538) at remote 0x7fffd7a619a0>: 1, <_HashedSequence(hashvalue=-7339155120130062816) at remote 0x7fffd6f747d0>: 1, <_HashedSequence(hashvalue=7609371609376905818) at remote 0x7fffd6d55b30>: 1, <_HashedSequence(hashvalue=-7674168586845967691) at remote 0x7fffd6d56ee0>: 1, <_Has...(truncated)) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/typeobject.c:9830
#35 0x00007ffff7b64581 in finalize_garbage (tstate=0x7ffff7f41860 <_PyRuntime+282976>, collectable=0x7fffffffbe00) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/gc.c:980
#36 gc_collect_main (tstate=0x7ffff7f41860 <_PyRuntime+282976>, generation=2, reason=_Py_GC_REASON_HEAP) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/gc.c:1408
#37 0x00007ffff7c25354 in _Py_HandlePending (tstate=0x7ffff7f41860 <_PyRuntime+282976>) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/ceval_gil.c:1296
#38 0x00007ffff7b619ba in _PyEval_EvalFrameDefault (tstate=, frame=, throwflag=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/generated_cases.c.h:3606
#39 0x00007ffff7baf29d in _PyEval_EvalFrame (tstate=0x7ffff7f41860 <_PyRuntime+282976>, frame=0x7ffff7562760, throwflag=0) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Include/internal/pycore_ceval.h:119
#40 _PyEval_Vector (tstate=0x7ffff7f41860 <_PyRuntime+282976>, func=0x7fffdc93cae0, locals=0x0, args=0x7fffd6305230, argcount=, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/ceval.c:1806
#41 _PyFunction_Vectorcall (func=, stack=0x7fffd6305230, nargsf=, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:413
#42 _PyObject_VectorcallTstate (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, args=0x7fffd6305230, nargsf=, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Include/internal/pycore_call.h:168
#43 method_vectorcall (method=, args=, nargsf=, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/classobject.c:92
#44 0x00007ffff7b5a320 in PyObject_Call (callable=, args=(, , , , , , , , , , , , args=(, , , , , , , , , , , , frame=, throwflag=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/generated_cases.c.h:1355
#47 0x00007ffff7baf3e7 in _PyEval_EvalFrame (tstate=0x7ffff7f41860 <_PyRuntime+282976>, frame=, throwflag=0) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Include/internal/pycore_ceval.h:119
#48 _PyEval_Vector (tstate=0x7ffff7f41860 <_PyRuntime+282976>, func=0x7fffd5f64c20, locals=0x0, args=0x7fffd6e2ff60, argcount=1, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/ceval.c:1806
#49 _PyFunction_Vectorcall (func=, stack=0x7fffd6e2ff60, nargsf=1, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:413
#50 _PyObject_VectorcallTstate (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, args=0x7fffd6e2ff60, nargsf=1, kwnames=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Include/internal/pycore_call.h:168
#51 method_vectorcall (method=method@entry=, args=args@entry=0x7fffd6e2ff68, nargsf=, kwnames=kwnames@entry=('tmp_path_factory', 'bout_xyt_example_files', 'bout_v5', 'metric_3D', 'lengths')) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/classobject.c:62
#52 0x00007ffff7c31c18 in _PyVectorcall_Call (tstate=0x7ffff7f41860 <_PyRuntime+282976>, func=0x7ffff7baf030 , callable=, tuple=, kwargs=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:285
#53 _PyObject_Call (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, args=, kwargs=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:348
#54 0x00007ffff7b5a320 in PyObject_Call (callable=, args=(), kwargs={'tmp_path_factory': , tags=('config', 'tmpdir')) at remote 0x7fffd8b2d480>, _retention_count=3, _retention_policy='all', _basetemp=) at remote 0x7fffdaeacad0>, 'bout_xyt_example_files': , 'bout_v5': False, 'metric_3D': False, 'lengths': (6, 2, 4, 7)}) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:373
#55 PyCFunction_Call (callable=, args=(), kwargs={'tmp_path_factory': , tags=('config', 'tmpdir')) at remote 0x7fffd8b2d480>, _retention_count=3, _retention_policy='all', _basetemp=) at remote 0x7fffdaeacad0>, 'bout_xyt_example_files': , 'bout_v5': False, 'metric_3D': False, 'lengths': (6, 2, 4, 7)}) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:381
#56 _PyEval_EvalFrameDefault (tstate=, frame=, throwflag=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/generated_cases.c.h:1355
#57 0x00007ffff7c22c6e in _PyObject_VectorcallDictTstate (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, args=, nargsf=, kwargs=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:146
#58 0x00007ffff7c78da7 in _PyObject_Call_Prepend (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, obj=, args=(), kwargs={'pyfuncitem': , own_markers=[, ], extra_keyword_matches=set(), stash=, _report_sections=[], user_properties=[], originalname='test_combine_along_xy', _instance=, _obj=, _fixtureinfo=, fixturenames=['tmp_path_factory', 'bout_xyt_example_files', 'bout_v5', 'metric_3D', 'lengths', 'request'], funcargs={'tmp_path_factory': , tags=('config...(truncated)) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:504
#59 slot_tp_call (self=, args=(), kwds={'pyfuncitem': , own_markers=[, ], extra_keyword_matches=set(), stash=, _report_sections=[], user_properties=[], originalname='test_combine_along_xy', _instance=, _obj=, _fixtureinfo=, fixturenames=['tmp_path_factory', 'bout_xyt_example_files', 'bout_v5', 'metric_3D', 'lengths', 'request'], funcargs={'tmp_path_factory': , tags=('config...(truncated)) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/typeobject.c:9537
#60 0x00007ffff7b3f62b in _PyObject_MakeTpCall (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, args=, nargs=0, keywords=('pyfuncitem',)) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:242
#61 0x00007ffff7b5f200 in _PyEval_EvalFrameDefault (tstate=, frame=, throwflag=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Python/generated_cases.c.h:1502
#62 0x00007ffff7c22c6e in _PyObject_VectorcallDictTstate (tstate=0x7ffff7f41860 <_PyRuntime+282976>, callable=, args=, nargsf=, kwargs=) at /usr/src/debug/python3.13-3.13.0-1.fc42.x86_64/Objects/call.c:146
```
**Expected behavior**
No segfault, no error.
**Platform (please complete the following information)**
- HDF5 version: hdf5-1.14.5-1.fc42
- OS and version: Fedora rawhide (future 42)
- Compiler and version: gcc-14.2.1-4.fc42.x86_64.rpm
- Build system (e.g. CMake, Autotools) and version: autotools: autoconf-2.72-3.fc41.noarch.rpm
- Any configure options you specified: `../configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --runstatedir=/run --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --disable-silent-rules --enable-fortran --enable-hl --enable-shared --with-szlib --enable-cxx --enable-java --with-default-plugindir=/usr/lib64/hdf5/plugin`
- MPI library and version (parallel HDF5): serial version
**Additional context**
This only happens seemingly randomly, and apparently only after running several tests. I was not able to come up with a MRE beyond
```
git clone https://github.com/boutproject/xBOUT
cd xBOUT
pip install -r requirements.txt
pip install gelidum
pytest xbout
```
Contributor guide
Assessment
This issue has not been assessed yet.