2021-10-24 17:22 CEST

View Issue Details Jump to Notes ]
IDProjectCategoryView StatusLast Update
0001023OTB-libGeneralpublic2015-05-19 11:00
Reportergpasero 
Assigned Togpasero 
PriorityhighSeveritycrashReproducibilityrandom
StatusclosedResolutionfixed 
PlatformLeodOSMacOSXOS Version10.10
Summary0001023: malloc error in otb::SVMModel destructor
DescriptionThere is a random crash, seen with the TrainImageClassifier application. For instance :
http://dash.orfeo-toolbox.org/testDetails.php?test=29444173&build=178028

The issue seems related to the libSVM classifier.

Message :
otbApplicationLauncherCommandLine(66834,0x7fff7360a300) malloc: *** error for object 0x7fd393c06020: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
otbTestMain 'Execute': ITK Exception thrown:

On this platform there is a custom libsvm install (not from macports).
Steps To ReproduceRun the application several times until crash, in my case :

bin/otbApplicationLauncherCommandLine TrainImagesClassifier lib/otb/applications -io.il /Users/otbval/Data/OTB-Data/Input/Classification/QB_1_ortho.tif -io.vd /Users/otbval/Data/OTB-Data/Input/Classification/VectorData_QB1.shp -io.imstat /Users/otbval/Data/OTB-Data/Baseline/OTB-Applications/Files/clImageStatisticsQB1.xml -classifier dt -io.out Testing/Temporary/clDT_ModelQB1.dt -rand 121212 -testenv
Additional InformationHere is some traces with lldb :

(lldb) run
Process 36271 launched: '/Users/otbval/Dashboard/nightly/OTB-Release/build/bin/otbApplicationLauncherCommandLine' (x86_64)

2015 Apr 08 14:40:05 : Application.logger (DEBUG) Entering DoExecute
2015 Apr 08 14:40:05 : Application.logger (INFO) Elevation management: setting default height above ellipsoid to 0 meters
2015 Apr 08 14:40:05 : Application.logger (INFO) Number of training samples: 190
2015 Apr 08 14:40:05 : Application.logger (INFO) Size of training set: 190
2015 Apr 08 14:40:05 : Application.logger (INFO) Size of validation set: 157
2015 Apr 08 14:40:05 : Application.logger (INFO) Size of labeled training set: 190
2015 Apr 08 14:40:05 : Application.logger (INFO) Size of labeled validation set: 157
otbApplicationLauncherCommandLine(36271,0x7fff7360a300) malloc: *** error for object 0x6e6920656e694c14: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Process 36271 stopped
* thread #1: tid = 0x1154aecd, 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10
libsystem_kernel.dylib`__pthread_kill + 10:
-> 0x7fff8e9cc286: jae 0x7fff8e9cc290 ; __pthread_kill + 20
   0x7fff8e9cc288: movq %rax, %rdi
   0x7fff8e9cc28b: jmp 0x7fff8e9c7c53 ; cerror_nocancel
   0x7fff8e9cc290: retq
(lldb) bt
* thread #1: tid = 0x1154aecd, 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fff8a7ba42f libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fff8dfceb53 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fff834c8937 libsystem_malloc.dylib`free + 428
    frame #4: 0x0000000108fced04 liblibsvm.dylib`svm_free_model_content + 244
    frame 0000005: 0x0000000108fcd73b liblibsvm.dylib`svm_free_and_destroy_model + 27
    frame #6: 0x00000001108a2bfa otbapp_TrainImagesClassifier.dylib`otb::SVMModel<float, int>::~SVMModel() + 42
    frame #7: 0x00000001108a2abf otbapp_TrainImagesClassifier.dylib`otb::SVMModel<float, int>::~SVMModel() + 15
    frame #8: 0x000000010312e3af libITKCommon-4.8.1.dylib`itk::LightObject::UnRegister() const + 47
    frame #9: 0x0000000103105bd5 libITKCommon-4.8.1.dylib`itk::Object::UnRegister() const + 117
    frame 0000010: 0x000000010310c65c libITKCommon-4.8.1.dylib`itk::ProcessObject::~ProcessObject() + 108
    frame 0000011: 0x000000011089c69a otbapp_TrainImagesClassifier.dylib`otb::SVMSampleListModelEstimator<itk::Statistics::ListSample<itk::VariableLengthVector<float> >, itk::Statistics::ListSample<itk::FixedArray<int, 1u> >, otb::Functor::VariableLengthVectorToMeasurementVectorFunctor<itk::VariableLengthVector<float> > >::~SVMSampleListModelEstimator() + 90
    frame 0000012: 0x000000010312e3af libITKCommon-4.8.1.dylib`itk::LightObject::UnRegister() const + 47
    frame 0000013: 0x0000000103105bd5 libITKCommon-4.8.1.dylib`itk::Object::UnRegister() const + 117
    frame 0000014: 0x000000011089aaea otbapp_TrainImagesClassifier.dylib`otb::LibSVMMachineLearningModel<float, int>::~LibSVMMachineLearningModel() + 42
    frame 0000015: 0x000000010312e3af libITKCommon-4.8.1.dylib`itk::LightObject::UnRegister() const + 47
    frame 0000016: 0x0000000103105bd5 libITKCommon-4.8.1.dylib`itk::Object::UnRegister() const + 117
    frame 0000017: 0x00000001108ae723 otbapp_TrainImagesClassifier.dylib`otb::MachineLearningModelFactory<float, int>::CreateMachineLearningModel(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, otb::MachineLearningModelFactory<float, int>::FileModeType) + 675
    frame 0000018: 0x00000001108a610c otbapp_TrainImagesClassifier.dylib`otb::Wrapper::TrainImagesClassifier::Classify(itk::SmartPointer<itk::Statistics::ListSample<itk::VariableLengthVector<float> > >, itk::SmartPointer<itk::Statistics::ListSample<itk::FixedArray<int, 1u> > >) + 92
    frame #19: 0x00000001108a91b1 otbapp_TrainImagesClassifier.dylib`otb::Wrapper::TrainImagesClassifier::DoExecute() + 9969
    frame 0000020: 0x00000001005d27b1 libOTBApplicationEngine-4.5.1.dylib`otb::Wrapper::Application::Execute() + 1169
    frame 0000021: 0x00000001005d28cc libOTBApplicationEngine-4.5.1.dylib`otb::Wrapper::Application::ExecuteAndWriteOutput() + 28
    frame 0000022: 0x0000000100031e4c libOTBCommandLine-4.5.1.dylib`otb::Wrapper::CommandLineLauncher::ExecuteAndWriteOutput() + 44
    frame 0000023: 0x0000000100014e79 otbApplicationLauncherCommandLine`main + 681
    frame 0000024: 0x00007fff8f3055c9 libdyld.dylib`start + 1
    frame 0000025: 0x00007fff8f3055c9 libdyld.dylib`start + 1
TagsNo tags attached.
Attached Files

-Relationships
+Relationships

-Notes

~0002614

gpasero (administrator)

It doesn't, I get the same debug trace :
otbApplicationLauncherCommandLine(49912,0x7fff7360a300) malloc: *** error for object 0x3f8000003f800000: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Process 49912 stopped
* thread #1: tid = 0x12436f5c, 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10
libsystem_kernel.dylib`__pthread_kill + 10:
-> 0x7fff8e9cc286: jae 0x7fff8e9cc290 ; __pthread_kill + 20
   0x7fff8e9cc288: movq %rax, %rdi
   0x7fff8e9cc28b: jmp 0x7fff8e9c7c53 ; cerror_nocancel
   0x7fff8e9cc290: retq
(lldb) bt
* thread #1: tid = 0x12436f5c, 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff8e9cc286 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fff8a7ba42f libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fff8dfceb53 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fff834c8937 libsystem_malloc.dylib`free + 428
    frame #4: 0x0000000108fb9d04 libsvm.dylib`svm_free_model_content + 244
    frame 0000005: 0x0000000108fb873b libsvm.dylib`svm_free_and_destroy_model + 27
    frame #6: 0x0000000110ae8bf5 otbapp_TrainImagesClassifier.dylib`otb::SVMModel<float, int>::~SVMModel() + 53
    frame #7: 0x0000000110ae8aaf otbapp_TrainImagesClassifier.dylib`otb::SVMModel<float, int>::~SVMModel() + 15
...

Do we really need to call svm_free_and_destroy_model ?

~0002615

julien (administrator)

Well, do we really need to call "delete" after "new" ? ;)

~0002620

gpasero (administrator)

Obviously yes :)
In fact, my question was about "how to delete this structure". It is instanciated in OTB code (see otbSVMModel.txx, line 67) but we delete it using an external function.

~0002621

gpasero (administrator)

In otbSVMModel.txx, there are 2 methods that should be reviewed : SetSupportVectors and SetAlpha.
-> as we have changed libsvm version, the way to modify its structures may have changed.
-> I don't like those "// TODO: Check memory allocation"

~0002829

gpasero (administrator)

Another try : http://hg.orfeo-toolbox.org/OTB/rev/89139e8d6141

This patch shows some improvements :
http://dash.orfeo-toolbox.org/buildSummary.php?buildid=179696

There was obviously a memory leak : the member m_Model was always initialized in otb::SVMModel<>::Initialize() with a 'new' (although it is an empty model). When calling Train(), the pointer to the allocated struct is lost.
The commented code in Initialize() wasn't properly using the API, causing libsvm to fail when trying to clean the structure.

The methods SetSupportedVectors() and SetAlpha() from otb::SVMModel should also be reviewed, they use m_Model assuming it has already been instanciated.

~0002889

gpasero (administrator)

Memory check added here :
http://hg.orfeo-toolbox.org/OTB/rev/8ec67de9b622
+Notes

-Issue History
Date Modified Username Field Change
2015-04-08 14:50 gpasero New Issue
2015-04-09 17:08 gpasero Note Added: 0002614
2015-04-09 17:38 julien Note Added: 0002615
2015-04-13 15:33 gpasero Note Added: 0002620
2015-04-13 19:06 gpasero Note Added: 0002621
2015-04-17 10:46 julien Assigned To => julien
2015-04-17 10:46 julien Status new => acknowledged
2015-04-21 14:54 gpasero Note Added: 0002829
2015-04-23 10:42 mickael Assigned To julien => gpasero
2015-04-23 10:42 mickael Status acknowledged => confirmed
2015-04-23 10:43 mickael Priority normal => high
2015-05-18 10:41 gpasero Status confirmed => assigned
2015-05-18 10:45 gpasero Note Added: 0002889
2015-05-18 10:45 gpasero Status assigned => resolved
2015-05-18 10:45 gpasero Resolution open => fixed
2015-05-19 11:00 julien Status resolved => closed
+Issue History