PointCloudLibrary / PointCloudLibrary/pcl

[custom] How can I debug crashes in which deallocation of point clouds uses the wrong point type?

Open
#5,579 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: triage
Dominant language
C++
Stars
11.1k
Forks
4.7k
Avg merge
4d 10h
Merged PRs (30d)
6

Description

I often have this issue – not reproducible minimally – that my PCL client code crashes with some sort of

pointer being freed was not allocated

message, that usually goes away when I #define PCL_NO_PRECOMPILE at the top of my offending source file. With clang's address sanitizer, I get interesting reports that seem to indicate that a point cloud created as one point type gets deallocated as a different one. For instance check out this backtrace:

==47757==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x0001270383f8 at pc 0x000100af7ad8 bp 0x00016f4acd30 sp 0x00016f4acd28
READ of size 8 at 0x0001270383f8 thread T0
    #0 0x100af7ad4 in Eigen::internal::handmade_aligned_free(void*) Memory.h:118
    #1 0x100af7a5c in Eigen::internal::aligned_free(void*) Memory.h:206
    #2 0x100e01ce8 in Eigen::aligned_allocator<pcl::PointXYZRGB>::deallocate(pcl::PointXYZRGB*, unsigned long) Memory.h:897
    #3 0x100e01b18 in std::__1::allocator_traits<Eigen::aligned_allocator<pcl::PointXYZRGB> >::deallocate(Eigen::aligned_allocator<pcl::PointXYZRGB>&, pcl::PointXYZRGB*, unsigned long)
allocator_traits.h:282
    #4 0x100e01804 in std::__1::__vector_base<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::~__vector_base() vector:488
    #5 0x100e015c4 in std::__1::vector<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::~vector() vector:579
    #6 0x100e00f70 in std::__1::vector<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::~vector() vector:574
    #7 0x100e03294 in pcl::PointCloud<pcl::PointXYZRGB>::~PointCloud() point_cloud.h:172
    #8 0x100e03254 in pcl::PointCloud<pcl::PointXYZRGB>::~PointCloud() point_cloud.h:172
    #9 0x103cc6510 in pcl::Filter<pcl::PointXYZRGB>::filter(pcl::PointCloud<pcl::PointXYZRGB>&) filter.h:134
    #10 0x103c6e6a8 in myfunction(mydata*) myfile.cpp:122
…
    #14 0x114051088 in start+0x204 (dyld:arm64e+0x5088)

0x0001270383f8 is located 8 bytes to the left of 52256-byte region [0x000127038400,0x000127045020)
allocated by thread T0 here:
    #0 0x120656ca8 in wrap_malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3eca8)
    #1 0x1169024d4 in std::__1::__split_buffer<pcl::PointXYZL, Eigen::aligned_allocator<pcl::PointXYZL>&>::__split_buffer(unsigned long, unsigned long, Eigen::aligned_allocator<pcl::Poi
ntXYZL>&)+0x30 (libpcl_filters.1.13.0.99.dylib:arm64+0x464d4)
    #2 0x1169037e4 in std::__1::vector<pcl::PointXYZRGB, Eigen::aligned_allocator<pcl::PointXYZRGB> >::__append(unsigned long)+0x68 (libpcl_filters.1.13.0.99.dylib:arm64+0x477e4)
    #3 0x116a89e94 in pcl::VoxelGrid<pcl::PointXYZRGB>::applyFilter(pcl::PointCloud<pcl::PointXYZRGB>&)+0xaf0 (libpcl_filters.1.13.0.99.dylib:arm64+0x1cde94)
    #4 0x103cc63a4 in pcl::Filter<pcl::PointXYZRGB>::filter(pcl::PointCloud<pcl::PointXYZRGB>&) filter.h:129
    #5 0x103c6e6a8 in myfunction(mydata*) myfile.cpp:122

SUMMARY: AddressSanitizer: heap-buffer-overflow Memory.h:118 in Eigen::internal::handmade_aligned_free(void*)
Shadow bytes around the buggy address:
  0x007024e27020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x007024e27030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x007024e27040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x007024e27050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x007024e27060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x007024e27070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x007024e27080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x007024e27090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x007024e270a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x007024e270b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x007024e270c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==47757==ABORTING
Abort trap: 6

So why is the deallocator called on the correct PointXYZRGB points, but the filter class somehow creates data of type PointXYZL?
The presence or absence of -DPCL_ONLY_CORE_POINT_TYPES=ON and -DNO_EXPLICIT_INSTANTIATIONS makes no difference by the way.

What can I do to debug this?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Use the AddressSanitizer backtrace as the entry point, following filter.h and point_cloud.h into Eigen's Memory.h. Compare the PointXYZRGB deallocation path with the PointXYZL allocation shown in the trace, including the effects of PCL_NO_PRECOMPILE and the listed build flags. Done means identifying a reproducible cause or precise debugging guidance for the mismatched point types.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
computer-vision
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.