hl_plplot17e.f90 and hl_plplot17e_gto.f90: Segmentation fault

[vmagnin]

Describe the bug When launching hl_plplot17e.f90 and hl_plplot17e_gto.f90:

Program received signal SIGSEGV: Segmentation fault - invalid memory reference.

Your system:

• OS version: Fedora Rawhide (34)
• Compiler version: gfortran 11.0.0
• GTK branch: gtk4-vmagnin (GTK 4.0.0)
• Build type: debug and release

Additional context hl_plplot17e_gto.f90 also prints that warning:

?invalid xwid in -geometry 0x0
?invalid ywid in -geometry 0x0

Everything is OK with the gtk3 branch on the same system (same PLplot version, same GLib version).

[vmagnin]

$ coredumpctl gdb
(gdb) bt full
#0  0x0000000000000000 in  ()
#1  0x00007f6b36099617 in _cairo_surface_stroke () at /lib64/libcairo.so.2
#2  0x00007f6b360534ba in _cairo_gstate_stroke.part.0 () at /lib64/libcairo.so.2
#3  0x00007f6b360535ff in _cairo_default_context_stroke () at /lib64/libcairo.so.2
#4  0x00007f6b360a60b9 in cairo_stroke () at /lib64/libcairo.so.2
#5  0x00007f6b242adae1 in plD_line_cairo () at /usr/lib64/plplot5.15.0/drivers/cairo.so
#6  0x00007f6b35bb5893 in grline () at /lib64/libplplot.so.17
#7  0x00007f6b35bcd556 in genlin () at /lib64/libplplot.so.17
#8  0x00007f6b35bcb3f4 in plP_pllclp () at /lib64/libplplot.so.17
#9  0x00007f6b35bcca5a in plP_drawor () at /lib64/libplplot.so.17
#10 0x00007f6b35bdffb0 in c_plstripa () at /lib64/libplplot.so.17
#11 0x0000000000405b41 in plplot_code_ex17::add_point (area=0x1f46170) at /home/osboxes/gtk-fortran/plplot/hl_plplot17e.f90:205
#12 0x00000000004067c9 in cairo_plplot_ex17 () at /home/osboxes/gtk-fortran/plplot/hl_plplot17e.f90:301
        base = 33124688
        drawing = 32875488
        qbut = 33273664
#13 0x000000000040686c in main (argc=1, argv=0x7ffc04e98b1f) at /home/osboxes/gtk-fortran/plplot/hl_plplot17e.f90:263
#14 0x00007f6b35578ba2 in __libc_start_main () at /lib64/libc.so.6
#15 0x000000000040589e in _start ()

and

(gdb) bt full
#0  0x0000000000000000 in  ()
#1  0x00007fc7b82af9ee in _cairo_surface_fill () at /lib64/libcairo.so.2
#2  0x00007fc7b8268cf3 in _cairo_gstate_fill () at /lib64/libcairo.so.2
#3  0x00007fc7b82bc1a9 in cairo_fill_preserve () at /lib64/libcairo.so.2
#4  0x00007fc7ad7a1aff in plD_esc_cairo () at /usr/lib64/plplot5.15.0/drivers/cairo.so
#5  0x00007fc7b7dcb94a in grfill () at /lib64/libplplot.so.17
#6  0x00007fc7b7de7098 in c_plclear () at /lib64/libplplot.so.17
#7  0x00007fc7b7df59d5 in plstrip_gen () at /lib64/libplplot.so.17
#8  0x0000000000405b26 in plplot_code_ex17_gto::add_point (area=<error reading variable: Attempt to dereference a generic pointer.>)
    at /home/osboxes/gtk-fortran/plplot/hl_plplot17e_gto.f90:204
        __result_add_point = 32764
#9  0x00007fc7b7f1d771 in g_timeout_dispatch () at /lib64/libglib-2.0.so.0
#10 0x00007fc7b7f1d0ef in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#11 0x00007fc7b7f6f8c8 in g_main_context_iterate.constprop () at /lib64/libglib-2.0.so.0
#12 0x00007fc7b7f1a4c3 in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#13 0x00007fc7b8131e8d in g_application_run () at /lib64/libgio-2.0.so.0
#14 0x000000000040c079 in gtk_hl_container::hl_gtk_application_new (app_id=..., activate=Python Exception <class 'gdb.MemoryError'> Cannot access memory at address 0x0: 

    0x4063be <handlers_ex17_gto::activate>, flags=#15 0x000000000040667b in cairo_plplot_ex17_gto ()
    at /home/osboxes/gtk-fortran/plplot/hl_plplot17e_gto.f90:289
Python Exception <class 'gdb.MemoryError'> Cannot access memory at address 0xe3ad973e6b187a00: 
        my_app = #16 0x00000000004066bf in main (argc=1, argv=0x7ffcf0372b13) at /home/osboxes/gtk-fortran/plplot/hl_plplot17e_gto.f90:283
#17 0x00007fc7b778eba2 in __libc_start_main () at /lib64/libc.so.6
#18 0x000000000040589e in _start ()

[vmagnin]

http://plplot.sourceforge.net/docbook-manual/plplot-html-5.15.0/plstripa.html http://plplot.sourceforge.net/docbook-manual/plplot-html-5.15.0/plstripc.html

[vmagnin]

Crash occurs generally at the second call add_point(drawing), sometimes at the first one.

If we write:

  do
     call pending_events()
     if (run_status == FALSE) exit
     call g_usleep(100000_c_long) ! So we don't burn CPU cycles
     block
     integer :: i
     do i=1,50
       call add_point(drawing)
     end do
     end block
  end do

those 50 points will appear, and the crash will occur at the 51th point. So the crash occurs only after we try to add points after the call pending_events() treating the first ones. Something concerning Cairo seems to be lost after updating screen the first time...

But sometimes it crashes after only one point (i=1). Another time, it runs but without updating the screen after the first 50 points. And when clicking the "Quit" button:

hl_plplot17e: cairo-surface.c:955: cairo_surface_destroy: Assertion `CAIRO_REFERENCE_COUNT_HAS_REFERENCE (&surface->ref_count)' failed.

Program received signal SIGABRT: Process abort signal.

[vmagnin]

x17f.f90, copied from /usr/share/plplot5.15.0/examples/fortran , is successfully running on the same (virtual) machine: $ gfortran x17f.f90 $(pkg-config --cflags --libs plplot-fortran) with the following graphical drivers:

< 1> xwin       X-Window (Xlib)
< 2> tk         Tcl/TK Window
<22> qtwidget   Qt Widget
<26> xcairo     Cairo X Windows Driver

[vmagnin]

hl_plplot17e_gto.f90 crashes also when the line call gtk_widget_queue_draw(area) in the function add_point() is commented.

[vmagnin]

Still present with GTK 4.4.0 (Fedora Rawhide).

[vmagnin]

In FreeBSD 13.0 the error message is:

Program received signal SIGBUS: Access to an undefined portion of a memory object.

[vmagnin]

More information with GFortran 12.0.1 in latest Fedora Rawhide, here for hl_plplot17e.f90:

...
#11 plP_drawor (x=<optimized out>, y=<optimized out>) at /usr/src/debug/plplot-5.15.0-37.fc36.x86_64/src/plline.c:515
        xt = 0.20000000000000001
        yt = 0.034899496702500969
#12 0x00007fa50292173d in c_plstripa (id=0, p=1, x=<optimized out>, y=<optimized out>) at /usr/src/debug/plplot-5.15.0-37.fc36.x86_64/src/plstripc.c:280
        j = <optimized out>
        yasc = <optimized out>
        istart = <optimized out>
#13 0x0000000000405bce in plplot_code_ex17::add_point (area=0x21cf180) at /home/osboxes/gtk-fortran/plplot/hl_plplot17e.f90:205
#14 0x0000000000406819 in cairo_plplot_ex17 () at /home/osboxes/gtk-fortran/plplot/hl_plplot17e.f90:298
        base = 34962880
        drawing = 35048432
        qbut = 35035632
#15 0x00000000004068bc in main (argc=1, argv=0x7ffdbfb580f0) at /home/osboxes/gtk-fortran/plplot/hl_plplot17e.f90:260
...

[vmagnin]

Could it be a bug in https://github.com/vmagnin/gtk-fortran/blob/gtk4/src/gtk-draw-hl.f90 ?

[vmagnin]

In Fedora 38 with GTK 4.10.1 and GLib 2.76.1, GFortran 13.0.1, the error message is now:

(base) [osboxes@localhost plplot]$ ./hl_plplot17e
hl_plplot17e: ../src/cairo-surface.c:935: cairo_surface_reference: Assertion `CAIRO_REFERENCE_COUNT_HAS_REFERENCE (&surface->ref_count)' failed.

Program received signal SIGABRT: Process abort signal.
...

Maybe related to https://github.com/gnuradio/gnuradio/pull/6352

[vmagnin]

In a Debian 12 - 32 bits, hl_plplot17e does not crash but does not plot the points. The CAIRO_REFERENCE_COUNT_HAS_REFERENCE error appear only when we quit the app.

The hl_plplot17e_gto example does not plot the points but prints a lot of these messages (several per second): (hl_plplot17e_gto:22775): Gtk-CRITICAL **: 16:05:00.844: gtk_widget_queue_draw: assertion 'GTK_IS_WIDGET (widget)' failed

[vmagnin]

In FreeBSD 14.0-RELEASE-p4:

$ ./hl_plplot17e
Assertion failed: (CAIRO_REFERENCE_COUNT_HAS_REFERENCE (&surface->ref_count)), function cairo_surface_reference, file cairo-surface.c, line 930.

Program received signal SIGABRT: Process abort signal.

Backtrace for this error:
#0  0x82e220379 in ???
#1  0x82e21f4a5 in ???
#2  0x82cd3f53e in handle_signal
	at /usr/src/lib/libthr/thread/thr_sig.c:301
#3  0x82cd3eafa in thr_sighandler
	at /usr/src/lib/libthr/thread/thr_sig.c:244
#4  0x8212462d2 in ???
#5  0x82d13886a in ???
	at /usr/obj/usr/src/amd64.amd64/lib/libc/thr_kill.S:4
#6  0x82d0b0f53 in __raise
	at /usr/src/lib/libc/gen/raise.c:50
#7  0x82d161fc8 in abort
	at /usr/src/lib/libc/stdlib/abort.c:65
#8  0x82d0942e0 in __assert
	at /usr/src/lib/libc/gen/assert.c:49
#9  0x82558bdbf in ???
#10  0x8255413f2 in ???
#11  0x82559b725 in ???
#12  0x88f7578b2 in ???
#13  0x88f757784 in ???
#14  0x88f75b857 in ???
#15  0x82b4b1179 in ???
#16  0x82b4b10ca in ???
#17  0x82b4d8617 in ???
#18  0x82b4dd20a in ???
#19  0x82b4dda70 in ???
#20  0x8296be257 in ???
#21  0x405ae7 in __plplot_code_ex17_MOD_add_point
	at /home/vmagnin/gtk-fortran/plplot/hl_plplot17e.f90:188
#22  0x4066f0 in cairo_plplot_ex17
	at /home/vmagnin/gtk-fortran/plplot/hl_plplot17e.f90:287
#23  0x406793 in main
	at /home/vmagnin/gtk-fortran/plplot/hl_plplot17e.f90:247
Abort trap (core dumped)

See: https://github.com/ImageMagick/cairo/blob/main/src/cairo-surface.c

The surface is not NULL, but that line fails:

assert (CAIRO_REFERENCE_COUNT_HAS_REFERENCE (&surface->ref_count));