PointCloudLibrary / PointCloudLibrary/pcl
[custom] How can I debug crashes in which deallocation of point clouds uses the wrong point type?
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 11.1k
- Forks
- 4.7k
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 6
Description
I often have this issue – not reproducible minimally – that my PCL client code crashes with some sort of
pointer being freed was not allocated
message, that usually goes away when I #define PCL_NO_PRECOMPILE at the top of my offending source file. With clang's address sanitizer, I get interesting reports that seem to indicate that a point cloud created as one point type gets deallocated as a different one. For instance check out this backtrace:
==47757==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x0001270383f8 at pc 0x000100af7ad8 bp 0x00016f4acd30 sp 0x00016f4acd28
READ of size 8 at 0x0001270383f8 thread T0
#0 0x100af7ad4 in Eigen::internal::handmade_aligned_free(void*) Memory.h:118
#1 0x100af7a5c in Eigen::internal::aligned_free(void*) Memory.h:206
#2 0x100e01ce8 in Eigen::aligned_allocator<pcl::PointXYZRGB>::deallocate(pcl::PointXYZRGB*, unsigned long) Memory.h:897
#3 0x100e01b18 in std::__1::allocator_traits<Eigen::aligned_allocator<pcl::PointXYZRGB> >::deallocate(Eigen::aligned_allocator<pcl::PointXYZRGB>&, pcl::PointXYZRGB*, unsigned long)
allocator_traits.h:282
#4 0x100e01804 in std::__1::__vector_base<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::~__vector_base() vector:488
#5 0x100e015c4 in std::__1::vector<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::~vector() vector:579
#6 0x100e00f70 in std::__1::vector<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::~vector() vector:574
#7 0x100e03294 in pcl::PointCloud<pcl::PointXYZRGB>::~PointCloud() point_cloud.h:172
#8 0x100e03254 in pcl::PointCloud<pcl::PointXYZRGB>::~PointCloud() point_cloud.h:172
#9 0x103cc6510 in pcl::Filter<pcl::PointXYZRGB>::filter(pcl::PointCloud<pcl::PointXYZRGB>&) filter.h:134
#10 0x103c6e6a8 in myfunction(mydata*) myfile.cpp:122
…
#14 0x114051088 in start+0x204 (dyld:arm64e+0x5088)
0x0001270383f8 is located 8 bytes to the left of 52256-byte region [0x000127038400,0x000127045020)
allocated by thread T0 here:
#0 0x120656ca8 in wrap_malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3eca8)
#1 0x1169024d4 in std::__1::__split_buffer<pcl::PointXYZL, Eigen::aligned_allocator<pcl::PointXYZL>&>::__split_buffer(unsigned long, unsigned long, Eigen::aligned_allocator<pcl::Poi
ntXYZL>&)+0x30 (libpcl_filters.1.13.0.99.dylib:arm64+0x464d4)
#2 0x1169037e4 in std::__1::vector<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::__append(unsigned long)+0x68 (libpcl_filters.1.13.0.99.dylib:arm64+0x477e4)
#3 0x116a89e94 in pcl::VoxelGrid<pcl::PointXYZRGB>::applyFilter(pcl::PointCloud<pcl::PointXYZRGB>&)+0xaf0 (libpcl_filters.1.13.0.99.dylib:arm64+0x1cde94)
#4 0x103cc63a4 in pcl::Filter<pcl::PointXYZRGB>::filter(pcl::PointCloud<pcl::PointXYZRGB>&) filter.h:129
#5 0x103c6e6a8 in myfunction(mydata*) myfile.cpp:122
SUMMARY: AddressSanitizer: heap-buffer-overflow Memory.h:118 in Eigen::internal::handmade_aligned_free(void*)
Shadow bytes around the buggy address:
0x007024e27020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007024e27030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007024e27040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007024e27050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x007024e27060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x007024e27070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
0x007024e27080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x007024e27090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x007024e270a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x007024e270b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x007024e270c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==47757==ABORTING
Abort trap: 6
So why is the deallocator called on the correct PointXYZRGB points, but the filter class somehow creates data of type PointXYZL?
The presence or absence of -DPCL_ONLY_CORE_POINT_TYPES=ON and -DNO_EXPLICIT_INSTANTIATIONS makes no difference by the way.
What can I do to debug this?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Use the AddressSanitizer backtrace as the entry point, following filter.h and point_cloud.h into Eigen's Memory.h. Compare the PointXYZRGB deallocation path with the PointXYZL allocation shown in the trace, including the effects of PCL_NO_PRECOMPILE and the listed build flags. Done means identifying a reproducible cause or precise debugging guidance for the mismatched point types.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- computer-vision
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100