Ticket #11749 (closed: fixed)

Opened 5 years ago

Last modified 5 years ago

Segfault in ParameterMap::asString

Reported by: Harry Jeffery Owned by: Harry Jeffery
Priority: minor Milestone: Release 3.5
Component: Framework Keywords:
Cc: Blocked By:
Blocking: Tester: Roman Tolchenov

Description

mat_ws = Load(Filename='MAP05935_ei34.nxspe')
LoadInstrument(mat_ws, InstrumentName='MAPS')
SaveNexusProcessed(mat_ws, Filename="this_will_crash.nxs")

This script crashes Mantid, with a sefault in ParameterMap::asString.

Change History

comment:1 Changed 5 years ago by Harry Jeffery

  • Status changed from new to inprogress

comment:2 Changed 5 years ago by Nick Draper

  • Priority changed from critical to minor
  • Milestone changed from Release 3.4 to Release 3.5

This is because the nxspe file creates and in memory instrument, but this will not match the detector numbers etc within the intsrument being loaded.

It is not frequent normal behaviour to do this in a reduction and analysis workflow.

Fixing the crash would be good, but not high priority.

comment:3 Changed 5 years ago by Harry Jeffery

Refs #11749 Fix segfault

Changeset: 139cf95dac52f5217fcb7933960f25748a938760

comment:4 Changed 5 years ago by Harry Jeffery

Refs #11749 Don't risk touching someone elses pmap

Changeset: 54af10ae56ad741df9416452bc6c9a846937c54c

comment:5 Changed 5 years ago by Harry Jeffery

  • Status changed from inprogress to verify
  • Resolution set to fixed

This is being verified as pull request #751.

comment:6 Changed 5 years ago by Harry Jeffery

  • Milestone changed from Release 3.5 to Release 3.4

comment:7 Changed 5 years ago by Harry Jeffery

Refs #11749 Fix segfault in systemtest

Changeset: 99a6efbac324d459e2517bba7f099c87b552f513

comment:8 Changed 5 years ago by Harry Jeffery

The reason the system test was segfaulting was because it fetched const reference to the parameter map and *then* performed setInstrument, which replaces the internal parameter map pointer. The reference is then to freed memory, which is not good™. The easy fix in this case is just to get the reference after, but it's a very easy mistake to make again.

We should have a good think about what we return from instrumentParameters to prevent this happening again, as it's a nasty error that's not immediately obvious. My first reaction is to instead have instrumentParameters return a ParameterMap_const_sptr&, so that the reference stays up to date if the internal parameter map changes.

comment:9 Changed 5 years ago by Harry Jeffery

The windows build failure is unrelated. isis-ndw1185 is playing up.

comment:10 Changed 5 years ago by Owen Arnold

As this is Core and as it's a little tricky to get into the state where this becomes an issue so close to the release. I'm moving this to 3.5.

comment:11 Changed 5 years ago by Harry Jeffery

  • Milestone changed from Release 3.4 to Release 3.5

comment:12 Changed 5 years ago by Harry Jeffery

@mantid-roman [This](https://github.com/mantidproject/mantid/blob/11749_segfault_in_parametermap_asstring/Code/Mantid/Framework/API/src/ExperimentInfo.cpp#L167-L191) is the currently problematic area.

If you set the instrument after fetching this reference you have a reference to freed memory, causing a crash when used.

This originally comes in in 5e030f1

Do you know why this needs to be copy-on-write? See [this comment](https://github.com/mantidproject/mantid/pull/751#issuecomment-102070166) for my suggestion for resolving this. Returning a reference to the shared pointer means that our reference keeps pointing to the right thing if the shared pointer changes.

comment:13 Changed 5 years ago by Roman Tolchenov

  • Status changed from verify to verifying
  • Tester set to Roman Tolchenov

comment:14 Changed 5 years ago by Roman Tolchenov

  • Status changed from verifying to closed

Merge pull request #751 from mantidproject/11749_segfault_in_parametermap_asstring

Fix parameter map segfault

Full changeset: 54d45ad608deb0611cb025f7db4b65236c27f06f

comment:15 Changed 5 years ago by Stuart Campbell

This ticket has been transferred to github issue 12587

Note: See TracTickets for help on using tickets.