Bug 1059418 - [abrt] gnuplot: _xend(): gnuplot-wx killed by SIGSEGV
Summary: [abrt] gnuplot: _xend(): gnuplot-wx killed by SIGSEGV
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: gnuplot
Version: 20
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Frantisek Kluknavsky
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:29a58633766685ca247fc3a572a...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-01-29 20:15 UTC by Ferry Huberts
Modified: 2014-02-14 07:48 UTC (History)
4 users (show)

Fixed In Version: gnuplot-4.6.3-6.fc20
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-02-14 07:48:53 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: backtrace (35.06 KB, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: cgroup (172 bytes, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: core_backtrace (15.69 KB, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: dso_list (10.20 KB, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: environ (3.38 KB, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: exploitable (82 bytes, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: limits (1.29 KB, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: maps (57.94 KB, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: open_fds (105 bytes, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: proc_pid_status (937 bytes, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
File: var_log_messages (326 bytes, text/plain)
2014-01-29 20:15 UTC, Ferry Huberts
no flags Details
strace on my AMD machine (1.07 MB, text/x-log)
2014-01-31 16:43 UTC, Ferry Huberts
no flags Details

Description Ferry Huberts 2014-01-29 20:15:17 UTC
Description of problem:
run 'gnuplot file', with 'file' being

# set terminal pngcairo  transparent enhanced font "arial,10" fontscale 1.0 size 500, 350 
# set output 'surface1.2.png'
set grid nopolar
set grid xtics nomxtics ytics nomytics noztics nomztics \
 nox2tics nomx2tics noy2tics nomy2tics nocbtics nomcbtics
set grid layerdefault   linetype -1 linecolor rgb "gray"  linewidth 0.200,  linetype -1 linecolor rgb "gray"  linewidth 0.200
set samples 21, 21
set isosamples 11, 11
set title "3D gnuplot demo" 
set xlabel "X axis" 
set xlabel  offset character -3, -2, 0 font "" textcolor lt -1 norotate
set xrange [ -10.0000 : 10.0000 ] noreverse nowriteback
set ylabel "Y axis" 
set ylabel  offset character 3, -2, 0 font "" textcolor lt -1 rotate by -270
set yrange [ -10.0000 : 10.0000 ] noreverse nowriteback
set zlabel "Z axis" 
set zlabel  offset character -5, 0, 0 font "" textcolor lt -1 norotate
splot x**2+y**2, x**2-y**2

Version-Release number of selected component:
gnuplot-4.6.3-5.fc20

Additional info:
reporter:       libreport-2.1.11
backtrace_rating: 4
cmdline:        gnuplot surface1.2.gnu
crash_function: _xend
executable:     /usr/bin/gnuplot-wx
kernel:         3.12.8-300.fc20.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (8 frames)
 #0 _xend at ../nptl/sysdeps/unix/sysv/linux/x86/elision-unlock.c:33
 #1 __lll_unlock_elision at ../nptl/sysdeps/unix/sysv/linux/x86/elision-unlock.c:29
 #2 wxMutexInternal::Unlock at src/unix/threadpsx.cpp:297
 #3 wxMutex::Unlock at include/wx/thrimpl.cpp:60
 #4 wxMutexGuiLeave at src/unix/threadpsx.cpp:1737
 #5 wxt_MutexGuiLeave at ../../src/wxterminal/wxt_gui.cpp:3671
 #6 wxtThread::Entry at ../../src/wxterminal/wxt_gui.cpp:222
 #7 wxThreadInternal::PthreadStart at src/unix/threadpsx.cpp:766

Comment 1 Ferry Huberts 2014-01-29 20:15:23 UTC
Created attachment 857231 [details]
File: backtrace

Comment 2 Ferry Huberts 2014-01-29 20:15:25 UTC
Created attachment 857232 [details]
File: cgroup

Comment 3 Ferry Huberts 2014-01-29 20:15:28 UTC
Created attachment 857233 [details]
File: core_backtrace

Comment 4 Ferry Huberts 2014-01-29 20:15:30 UTC
Created attachment 857234 [details]
File: dso_list

Comment 5 Ferry Huberts 2014-01-29 20:15:32 UTC
Created attachment 857235 [details]
File: environ

Comment 6 Ferry Huberts 2014-01-29 20:15:34 UTC
Created attachment 857236 [details]
File: exploitable

Comment 7 Ferry Huberts 2014-01-29 20:15:35 UTC
Created attachment 857237 [details]
File: limits

Comment 8 Ferry Huberts 2014-01-29 20:15:38 UTC
Created attachment 857238 [details]
File: maps

Comment 9 Ferry Huberts 2014-01-29 20:15:40 UTC
Created attachment 857239 [details]
File: open_fds

Comment 10 Ferry Huberts 2014-01-29 20:15:42 UTC
Created attachment 857240 [details]
File: proc_pid_status

Comment 11 Ferry Huberts 2014-01-29 20:15:44 UTC
Created attachment 857241 [details]
File: var_log_messages

Comment 12 Ferry Huberts 2014-01-29 20:16:57 UTC
backtrace:

$ gdb --args gnuplot surface1.2.gnu 
GNU gdb (GDB) Fedora 7.6.50.20130731-19.fc20
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
..
Reading symbols from /usr/bin/gnuplot-wx...Reading symbols from /usr/lib/debug/usr/bin/gnuplot-wx.debug...done.
done.
(gdb) r
Starting program: /usr/bin/gnuplot surface1.2.gnu
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib64/libgobject-2.0.so.0.3800.2-gdb.py", line 9, in <module>
    from gobject import register
  File "/usr/share/glib-2.0/gdb/gobject.py", line 3, in <module>
    import gdb.backtrace
ImportError: No module named backtrace
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffe2e61700 (LWP 4982)]
[New Thread 0x7fffe139b700 (LWP 4983)]
[New Thread 0x7fffe0b9a700 (LWP 4984)]
[New Thread 0x7fffd3fff700 (LWP 4985)]
[New Thread 0x7fffd37fe700 (LWP 4986)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe2e61700 (LWP 4982)]
__lll_unlock_elision (lock=0x8677a0, private=0) at ../nptl/sysdeps/unix/sysv/linux/x86/elision-unlock.c:29
29	    _xend();
Missing separate debuginfos, use: debuginfo-install PackageKit-gtk3-module-0.8.16-1.fc20.x86_64 SDL-1.2.15-12.fc20.x86_64 adwaita-gtk2-theme-3.10.0-1.fc20.x86_64 dbus-libs-1.6.12-8.fc20.x86_64 expat-2.1.0-7.fc20.x86_64 gvfs-1.18.3-2.fc20.x86_64 harfbuzz-0.9.24-1.fc20.x86_64 ibus-gtk2-1.5.5-1.fc20.x86_64 ibus-libs-1.5.5-1.fc20.x86_64 jbigkit-libs-2.0-9.fc20.x86_64 libICE-1.0.8-6.fc20.x86_64 libSM-1.2.1-6.fc20.x86_64 libXau-1.0.8-2.fc20.x86_64 libXcomposite-0.4.4-4.fc20.x86_64 libXcursor-1.1.14-2.fc20.x86_64 libXdamage-1.1.4-4.fc20.x86_64 libXext-1.3.2-2.fc20.x86_64 libXfixes-5.0.1-2.fc20.x86_64 libXi-1.7.2-2.fc20.x86_64 libXinerama-1.1.3-2.fc20.x86_64 libXrandr-1.4.1-2.fc20.x86_64 libXrender-0.9.8-2.fc20.x86_64 libXxf86vm-1.1.3-2.fc20.x86_64 libbluray-0.5.0-2.fc20.x86_64 libcanberra-0.30-4.fc20.x86_64 libcanberra-gtk2-0.30-4.fc20.x86_64 libdrm-2.4.50-1.fc20.x86_64 libffi-3.0.13-5.fc20.x86_64 libogg-1.3.0-6.fc20.x86_64 libselinux-2.2.1-6.fc20.x86_64 libtdb-1.2.12-2.fc20.x86_64 libtool-ltdl-2.4.2-23.fc20.x86_64 libuuid-2.24-2.fc20.x86_64 libvorbis-1.3.4-1.fc20.x86_64 libwayland-client-1.2.0-3.fc20.x86_64 libwayland-server-1.2.0-3.fc20.x86_64 libxcb-1.9.1-3.fc20.x86_64 libxml2-2.9.1-2.fc20.x86_64 mesa-libEGL-9.2.5-1.20131220.fc20.x86_64 mesa-libGL-9.2.5-1.20131220.fc20.x86_64 mesa-libgbm-9.2.5-1.20131220.fc20.x86_64 mesa-libglapi-9.2.5-1.20131220.fc20.x86_64 pcre-8.33-2.fc20.1.x86_64 pixman-0.30.0-3.fc20.x86_64 systemd-libs-208-9.fc20.x86_64 xz-libs-5.1.2-6alpha.fc20.x86_64
(gdb) bt
#0  __lll_unlock_elision (lock=0x8677a0, private=0) at ../nptl/sysdeps/unix/sysv/linux/x86/elision-unlock.c:29
#1  0x00007ffff3b59119 in wxMutexInternal::Unlock (this=<optimized out>) at src/unix/threadpsx.cpp:297
#2  0x00007ffff3b5944d in wxMutex::Unlock (this=<optimized out>) at include/wx/thrimpl.cpp:60
#3  0x00007ffff3b5991c in wxMutexGuiLeave () at src/unix/threadpsx.cpp:1737
#4  0x00000000004fba59 in wxt_MutexGuiLeave () at ../../src/wxterminal/wxt_gui.cpp:3671
#5  wxtThread::Entry (this=<optimized out>) at ../../src/wxterminal/wxt_gui.cpp:222
#6  0x00007ffff3b5a4f3 in wxThreadInternal::PthreadStart (thread=0x8986d0) at src/unix/threadpsx.cpp:766
#7  0x00007ffff1334f33 in start_thread (arg=0x7fffe2e61700) at pthread_create.c:309
#8  0x00007ffff1062ead in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb)

Comment 13 Frantisek Kluknavsky 2014-01-31 14:46:45 UTC
I can not reproduce this with the same version of gnuplot, wxGtk, glibc and kernel. Works for me.
Does it happen always or only occasionally? Does your system have any nonstandard peculiarities? Could you please provide the exact datafile? (a few extra whitespaces usually do not matter, but since I can not get a crash, something has to be different)
Which processor do you have? Instruction XEND which caused your crash is a very recent feature.

Comment 14 Ferry Huberts 2014-01-31 15:11:01 UTC
I gave you the exact file, see comment 1

The crash went away when I uncommented the first 2 lines.

I'm on a T440s with a haswell CPU, nothing special.

processor	: 3
vendor_id	: GenuineIntel
cpu family	: 6
model		: 69
model name	: Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz
stepping	: 1
microcode	: 0x17
cpu MHz		: 3147.503
cache size	: 4096 KB
physical id	: 0
siblings	: 4
core id		: 1
cpu cores	: 2
apicid		: 3
initial apicid	: 3
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm ida arat epb xsaveopt pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm
bogomips	: 5387.86
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

Comment 15 Frantisek Kluknavsky 2014-01-31 16:03:24 UTC
My cpu is Ivy bridge without rtm and without hle so glibc uses old locks and not xbegin/xend. I will try to borrow a Haswell.

Comment 16 Frantisek Kluknavsky 2014-01-31 16:37:53 UTC
Confirmed with gnuplot-4.6.4-2.fc21, wxGTK-2.8.12-11.fc21, glibc-2.18.90-23.fc21.

Comment 17 Ferry Huberts 2014-01-31 16:42:01 UTC
It also crashes on my AMD machine.
I can't produce a stacktrace with gdb:

(gdb) r
Starting program: /usr/bin/gnuplot bug.gnuplot
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffee9c1700 (LWP 4856)]
[New Thread 0x7fffedd85700 (LWP 4857)]
[New Thread 0x7fffed584700 (LWP 4858)]
[New Thread 0x7fffecd83700 (LWP 4859)]
[New Thread 0x7fffdffff700 (LWP 4860)]
[Thread 0x7fffee9c1700 (LWP 4856) exited]
[Thread 0x7fffdffff700 (LWP 4860) exited]
[Thread 0x7fffecd83700 (LWP 4859) exited]
[Thread 0x7fffedd85700 (LWP 4857) exited]
[Thread 0x7ffff5df0a40 (LWP 4852) exited]
[Inferior 1 (process 4852) exited normally]
(gdb) bt
No stack.


processor	: 7
vendor_id	: AuthenticAMD
cpu family	: 21
model		: 2
model name	: AMD FX(tm)-8350 Eight-Core Processor           
stepping	: 0
microcode	: 0x6000822
cpu MHz		: 4000.000
cache size	: 2048 KB
physical id	: 0
siblings	: 8
core id		: 7
cpu cores	: 4
apicid		: 23
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 popcnt aes xsave avx f16c lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb arat cpb hw_pstate npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold bmi1
bogomips	: 7983.62
TLB size	: 1536 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 48 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate cpb eff_freq_ro

Comment 18 Ferry Huberts 2014-01-31 16:43:32 UTC
Created attachment 857914 [details]
strace on my AMD machine

Comment 19 Frantisek Kluknavsky 2014-02-03 14:47:55 UTC
wxwidgets documentation (http://docs.wxwidgets.org/stable/group__group__funcmacro__thread.html#ga6671c1599fd4ccf6a7c7bb90b2304709) says:
void wxMutexGuiEnter
Note
    Under GTK, no creation of top-level windows is allowed in any thread but the main one. [1]


Gnuplot source (gnuplot-4.6.3/src/wxterminal/wxt_gui.cpp:222) says:
/* Workaround for a deadlock when the main thread will Wait() for this one.
 * This issue comes from the fact that our gui main loop is not in the
 * main thread as wxWidgets was written for. */
wxt_MutexGuiLeave();


A clear conflict here, Gnuplot in Fedora uses wxGtk.

Comment 20 Fedora Update System 2014-02-04 13:09:53 UTC
gnuplot-4.6.3-6.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/gnuplot-4.6.3-6.fc20

Comment 21 Fedora Update System 2014-02-05 03:43:32 UTC
Package gnuplot-4.6.3-6.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing gnuplot-4.6.3-6.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-2031/gnuplot-4.6.3-6.fc20
then log in and leave karma (feedback).

Comment 22 Ferry Huberts 2014-02-06 14:02:32 UTC
(In reply to Fedora Update System from comment #21)
> Package gnuplot-4.6.3-6.fc20:
> * should fix your issue,
> * was pushed to the Fedora 20 testing repository,
> * should be available at your local mirror within two days.
> Update it with:
> # su -c 'yum update --enablerepo=updates-testing gnuplot-4.6.3-6.fc20'
> as soon as you are able to.
> Please go to the following url:
> https://admin.fedoraproject.org/updates/FEDORA-2014-2031/gnuplot-4.6.3-6.fc20
> then log in and leave karma (feedback).

with this update it doesn't crash anymore.
thanks

Comment 23 Frantisek Kluknavsky 2014-02-06 15:32:18 UTC
The workaround was rather invasive - disabling all threads. Please test extensively with multiple simultaneous graphs.

Comment 24 Fedora Update System 2014-02-14 07:48:53 UTC
gnuplot-4.6.3-6.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.