Bug 650149 - Valgrind causes C++ programs to crash
Summary: Valgrind causes C++ programs to crash
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: valgrind
Version: 14
Hardware: i686
OS: Linux
low
high
Target Milestone: ---
Assignee: Jakub Jelinek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-11-05 12:30 UTC by Andris Pavenis
Modified: 2011-05-16 12:11 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-11-12 10:38:18 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Andris Pavenis 2010-11-05 12:30:45 UTC
Description of problem:

Valgrind causes C++ programs (at least those which uses iostreams library) to crash on startup both with the default GCC-4.5.1 and old GCC-3.4.6 (g++34) is being used.

Version-Release number of selected component (if applicable):

Fedora 14,
gcc version 4.5.1 20100924 (Red Hat 4.5.1-4) (GCC)
valgrind-3.5.0-18.fc14.i686

How reproducible:

Always

Steps to Reproduce:
1. Compile simple HelloWorld style program:

#include <iostream>

int main()
{
    std::cout << "Hello!\n";
    return 0;
}

g++ -O2 hello.cpp -o hello

2. Run it under valgrind:

valgrind ./hello
  
Actual results:

==5533== Memcheck, a memory error detector
==5533== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==5533== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info
==5533== Command: ./hello
==5533==
==5533== Conditional jump or move depends on uninitialised value(s)
==5533==    at 0x4005025: operator delete[](void*, std::nothrow_t const&) (vg_replace_malloc.c:380)
==5533==    by 0xBC3CE7: ??? (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB337C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==5533==    by 0xB33FAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB3401C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB340A8: std::locale::locale() (strstream.cc:369)
==5533==    by 0xB30F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==5533==    by 0x80485F1: global constructors keyed to main (in /home/apavenis/Test/hello/hello)
==5533==    by 0x804869C: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048473: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048628: __libc_csu_init (in /home/apavenis/Test/hello/hello)
==5533==    by 0x48DDB3: (below main) (libc-start.c:185)
==5533==
==5533== Invalid free() / delete / delete[]
==5533==    at 0x4005065: operator delete[](void*, std::nothrow_t const&) (vg_replace_malloc.c:380)
==5533==    by 0xBC3CE7: ??? (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB337C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==5533==    by 0xB33FAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB3401C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB340A8: std::locale::locale() (strstream.cc:369)
==5533==    by 0xB30F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==5533==    by 0x80485F1: global constructors keyed to main (in /home/apavenis/Test/hello/hello)
==5533==    by 0x804869C: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048473: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048628: __libc_csu_init (in /home/apavenis/Test/hello/hello)
==5533==    by 0x48DDB3: (below main) (libc-start.c:185)
==5533==  Address 0xaefb24 is not stack'd, malloc'd or (recently) free'd
==5533==
==5533== Use of uninitialised value of size 4
==5533==    at 0x4005074: operator delete[](void*, std::nothrow_t const&) (vg_replace_malloc.c:380)
==5533==    by 0xB337C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==5533==    by 0xB33FAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB3401C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB340A8: std::locale::locale() (strstream.cc:369)
==5533==    by 0xB30F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==5533==    by 0x80485F1: global constructors keyed to main (in /home/apavenis/Test/hello/hello)
==5533==    by 0x804869C: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048473: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048628: __libc_csu_init (in /home/apavenis/Test/hello/hello)
==5533==    by 0x48DDB3: (below main) (libc-start.c:185)
==5533==
vex x86->IR: unhandled instruction bytes: 0xCA 0x15 0xB2 0x0
==5533== Invalid read of size 1
==5533==    at 0xBC3CE8: ??? (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB337C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==5533==    by 0xB33FAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB3401C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB340A8: std::locale::locale() (strstream.cc:369)
==5533==    by 0xB30F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==5533==    by 0x80485F1: global constructors keyed to main (in /home/apavenis/Test/hello/hello)
==5533==    by 0x804869C: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048473: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048628: __libc_csu_init (in /home/apavenis/Test/hello/hello)
==5533==    by 0x48DDB3: (below main) (libc-start.c:185)
==5533==  Address 0x6a00b876 is not stack'd, malloc'd or (recently) free'd
==5533==
==5533==
==5533== Process terminating with default action of signal 11 (SIGSEGV)
==5533==  Access not within mapped region at address 0x6A00B876
==5533==    at 0xBC3CE8: ??? (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB337C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==5533==    by 0xB33FAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB3401C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==5533==    by 0xB340A8: std::locale::locale() (strstream.cc:369)
==5533==    by 0xB30F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==5533==    by 0x80485F1: global constructors keyed to main (in /home/apavenis/Test/hello/hello)
==5533==    by 0x804869C: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048473: ??? (in /home/apavenis/Test/hello/hello)
==5533==    by 0x8048628: __libc_csu_init (in /home/apavenis/Test/hello/hello)
==5533==    by 0x48DDB3: (below main) (libc-start.c:185)
==5533==  If you believe this happened as a result of a stack
==5533==  overflow in your program's main thread (unlikely but
==5533==  possible), you can try to increase the size of the
==5533==  main thread stack using the --main-stacksize= flag.
==5533==  The main thread stack size used in this run was 8388608.
==5533==
==5533== HEAP SUMMARY:
==5533==     in use at exit: 0 bytes in 0 blocks
==5533==   total heap usage: 0 allocs, 1 frees, 0 bytes allocated
==5533==
==5533== All heap blocks were freed -- no leaks are possible
==5533==
==5533== For counts of detected and suppressed errors, rerun with: -v
==5533== Use --track-origins=yes to see where uninitialised values come from
==5533== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 15 from 8)


Expected results:

valgrind report no errors

Comment 1 Andris Pavenis 2010-11-05 15:38:21 UTC
Some additional comments:

1) failed to reproduce on Fedora 14 x86_64 with valgrind-3.5.0-18.fc14.x86_64 (so the problem seems to appear for ix86 but not on x86_64)

2) downloaded valgrind-3.6.0 from http://www.valgrind.org, built it (without any modifications) and got the same problem as above for ix86

Comment 2 Jakub Jelinek 2010-11-12 10:38:18 UTC
Sorry, can't reproduce, with:
glibc-2.12.90-17.i686
gcc-c++-4.5.1-4.fc14.i686
libstdc++-4.5.1-4.fc14.i686
valgrind-3.5.0-18.fc14.i686

Comment 3 Andris Pavenis 2010-11-12 14:21:47 UTC
I had libc-2.12.90-18.i686, so I

1) downgraded to libc-2.12.90-17.i686: problem remained.

2) Reinstalled packages:
yum reinstall libstdc++ libstdc++-devel gcc-c++ gcc
ldconfig

problem disappeared (valgrind began to work)

ldconfig

3) Upgraded back to latest versions from f14 updates (libc-2.12.90-18.i686 and took also some other packages): still all is OK.

Posibly not related but anyway:

I can only guess that this has something to do with how I upgraded earlier F13 to F14 (with preupgrade) and had to manually pick up some F14 packages using yum downgrade' as F13 updates had newer build numbers. There also seemed to be some other problems with preupgrade (broken grub after it). So may be something went wrong with F13->F14 upgrade, but it's not easy to find what any more.

Comment 4 Dan Winship 2010-11-12 16:19:01 UTC
ugh. exactly the same for me. I have a machine that I upgraded from F13 to F14, I got the same valgrind error, with the same package versions, and then a "yum reinstall" fixed it...

Comment 5 Daniel C. 2011-03-01 15:06:57 UTC
I also did an upgrade and had this same problem. Reinstalling the packages as noted resolves the problem, but the problem keeps reoccurring. I use valgrind about once a week and the issue happens every time I've tried to use it.

Comment 6 vdm 2011-03-20 14:49:13 UTC
I have the same problem using valgrind on my projects (rather complex). Now I tried to reproduce this bug with a test simple program as described above, and - wow, it has crashed!

So, problem is 100% reproducible with:

glibc-2.13-1.i686
gcc-c++-4.5.1-4.fc14.i686
libstdc++-4.5.1-4.fc14.i686
valgrind-3.5.0-20.fc14.i686

[vdm@f14 valtest]$ ./a.out 
qqq
[vdm@f14 valtest]$ valgrind a.out 
==18398== Memcheck, a memory error detector
==18398== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==18398== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info
==18398== Command: a.out
==18398== 
==18398== Conditional jump or move depends on uninitialised value(s)
==18398==    at 0x4005339: operator delete[](void*, std::nothrow_t const&) (vg_replace_malloc.c:380)
==18398==    by 0xC3CCE7: ??? (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAC7C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==18398==    by 0xBACFAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD01C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD0A8: std::locale::locale() (strstream.cc:369)
==18398==    by 0xBA9F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==18398==    by 0x8048668: __static_initialization_and_destruction_0(int, int) (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486A1: global constructors keyed to main (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x804873C: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80484C3: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486C8: __libc_csu_init (in /home/vdm/forge/valtest/a.out)
==18398== 
==18398== Invalid free() / delete / delete[]
==18398==    at 0x4005379: operator delete[](void*, std::nothrow_t const&) (vg_replace_malloc.c:380)
==18398==    by 0xC3CCE7: ??? (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAC7C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==18398==    by 0xBACFAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD01C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD0A8: std::locale::locale() (strstream.cc:369)
==18398==    by 0xBA9F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==18398==    by 0x8048668: __static_initialization_and_destruction_0(int, int) (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486A1: global constructors keyed to main (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x804873C: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80484C3: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486C8: __libc_csu_init (in /home/vdm/forge/valtest/a.out)
==18398==  Address 0xb68b24 is not stack'd, malloc'd or (recently) free'd
==18398== 
==18398== Use of uninitialised value of size 4
==18398==    at 0x4005388: operator delete[](void*, std::nothrow_t const&) (vg_replace_malloc.c:380)
==18398==    by 0xBAC7C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==18398==    by 0xBACFAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD01C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD0A8: std::locale::locale() (strstream.cc:369)
==18398==    by 0xBA9F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==18398==    by 0x8048668: __static_initialization_and_destruction_0(int, int) (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486A1: global constructors keyed to main (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x804873C: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80484C3: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486C8: __libc_csu_init (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x4C5DD3: (below main) (libc-start.c:185)
==18398== 
==18398== Invalid read of size 1
==18398==    at 0xC3CCE8: ??? (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAC7C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==18398==    by 0xBACFAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD01C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD0A8: std::locale::locale() (strstream.cc:369)
==18398==    by 0xBA9F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==18398==    by 0x8048668: __static_initialization_and_destruction_0(int, int) (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486A1: global constructors keyed to main (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x804873C: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80484C3: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486C8: __libc_csu_init (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x4C5DD3: (below main) (libc-start.c:185)
==18398==  Address 0x6a00c006 is not stack'd, malloc'd or (recently) free'd
==18398== 
==18398== 
==18398== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==18398==  Access not within mapped region at address 0x6A00C006
==18398==    at 0xC3CCE8: ??? (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAC7C8: std::underflow_error::underflow_error(std::string const&) (stdexcept.cc:72)
==18398==    by 0xBACFAD: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD01C: virtual thunk to std::strstream::~strstream() (in /usr/lib/libstdc++.so.6.0.14)
==18398==    by 0xBAD0A8: std::locale::locale() (strstream.cc:369)
==18398==    by 0xBA9F97: std::ios_base::Init::Init() (locale_facets.h:1930)
==18398==    by 0x8048668: __static_initialization_and_destruction_0(int, int) (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486A1: global constructors keyed to main (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x804873C: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80484C3: ??? (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x80486C8: __libc_csu_init (in /home/vdm/forge/valtest/a.out)
==18398==    by 0x4C5DD3: (below main) (libc-start.c:185)
==18398==  If you believe this happened as a result of a stack
==18398==  overflow in your program's main thread (unlikely but
==18398==  possible), you can try to increase the size of the
==18398==  main thread stack using the --main-stacksize= flag.
==18398==  The main thread stack size used in this run was 8388608.
==18398== 
==18398== HEAP SUMMARY:
==18398==     in use at exit: 0 bytes in 0 blocks
==18398==   total heap usage: 0 allocs, 1 frees, 0 bytes allocated
==18398== 
==18398== All heap blocks were freed -- no leaks are possible
==18398== 
==18398== For counts of detected and suppressed errors, rerun with: -v
==18398== Use --track-origins=yes to see where uninitialised values come from
==18398== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 16 from 8)
Segmentation fault (core dumped)

I'll try to reinstall packages, but, even if it help, is's very inconvinient to do this on each fresh installation.

Comment 7 vdm 2011-03-20 14:58:04 UTC
yes, yum reinstall libstdc++ libstdc++-devel gcc-c++ gcc ldconfig
fixes this problem.

Comment 8 Jacob Oursland 2011-03-27 01:05:42 UTC
Add me to the list of persons who has encountered this issue.  As with the others, it was resolved with reinstallation of the packages.

I do not know exactly when this issue started, but I think it may have been when after I installed some debuginfos.

Comment 9 Jacob Oursland 2011-04-20 18:37:52 UTC
I have investigated the problem a little more and it is related to prelinking.  At least on Fedora systems automated prelinking can be turned off by editing the file /etc/sysconfig/prelink and setting PRELINKING=no.

Comment 10 Samuel Rats 2011-05-16 12:11:50 UTC
Just a little precision : this happens when you update your kernel.


Note You need to log in before you can comment on or make changes to this bug.