Experimental Physics and
Industrial Control System

Michael Davidsaver via Core-talk <[email protected]> · Sun, 30 Jun 2019 06:40:55 -0700

On 6/29/19 2:06 PM, Mark Rivers wrote:
> ...
> 
> That did not compile, so I changed it to this, i.e. replace destUnion->put() with destUnion->set() and value->put(value) with valueFld->put(&value[0])

oops.  You're right of course.  I was working from memory.

> I also added some debugging printfs.
> 
>  
> 
>     if(!valueFld) {
> 
>         valueFld = PVDC->createPVScalar<PVString>();
> 
>         destUnion->set(valueFld);

I'd be interested to know when this conditional is taken.

>     }
> 
> printf("Writing attribute %s value=%s\n", src->getName(), &value[0]);

Could you add "fflush(stdout);" here?  (or use stderr)  stdout is buffered,
and there may be additional output in the buffer when the crash occurs.

>     valueFld->put(&value[0]);

Also, have you tried simply commenting this line out?

> printf("Wrote attribute %s OK\n", src->getName());
> 
> }
> 
>  
> 
> I also have a printf in ntNDArrayConverter::fromAttributes the prints the name and datatype of each attribute as it iterates.
> 
>  
...
> 
> Wrote attribute beam_x_units OK
> 
> ntNDArrayConverter::fromAttributes name=ColorMode dataType=4
> 
> ntNDArrayConverter::fromAttributes name=SaveDest dataType=8
> 
> Writing attribute SaveDest value=Continuous
> 
> Segmentation fault (core dumped)

That fact that this doesn't happen on the first or second iteration
makes me wonder if this isn't a side-effect of memory corruption.
Can you repeat this test running with valgrind?

Also, the NTNDArrayConverter::fromAttribute() template needs a similar change.

Though likely unrelated, there is a third unchecked cast in NTNDArrayConverter::getColorMode(),
"int cm = static_pointer_cast<PVInt>(field->get())->get();", which should also be fixed.

> 
>  
> 
> Note that it initially was working OK when there were only 4 attributes (ColorMode, SaveDest, beam_x, and beam_x_units).  Only SaveDest and beam_x_units are string attributes (datatype=8), the others are epicsInt32 (datatype=4) and epicsFloat64 (datatype=7).
> 
>  
> 
> After some time another attribute appears in the list, DataType.  This is also epicsInt32.  Shortly after that is added, but not immediately, there is an access violation writing SaveDest, which is a string attribute.
> 
>  
> 
> This is the stack trace:
> 
> #0  0x00007fd6e95cb2ad in  () at /lib64/libstdc++.so.6
> 
> #1  0x00007fd6e962ee5e in std::string::assign(std::string const&) () at /lib64/libstdc++.so.6
> 
> #2  0x00000000006c128d in epics::pvData::detail::ScalarStorageOps<std::string>::store(std::string const&) (__str="Continuous", this=0x7fd594002030)
> 
>     at /usr/include/c++/4.8.2/bits/basic_string.h:547
> 
> #3  0x00000000006c128d in epics::pvData::detail::ScalarStorageOps<std::string>::store(std::string const&) (this=this@entry=0x7fd594002030, val="Continuous")
> 
>     at /usr/local/epics-devel/base-7.0.2/include/pv/pvData.h:362
> 
> #4  0x00000000006cca5a in NTNDArrayConverter::fromStringAttribute(std::tr1::shared_ptr<epics::pvData::PVStructure>, NDAttribute*) (v="Continuous", this=0x7fd594001fd0)
> 
>     at /corvette/usr/local/epics-devel/base-7.0.2/include/pv/pvData.h:399
> 
> #5  0x00000000006cca5a in NTNDArrayConverter::fromStringAttribute(std::tr1::shared_ptr<epics::pvData::PVStructure>, NDAttribute*) (this=this@entry=0x35481d0, dest=
> 
>     std::tr1::shared_ptr (count 3, weak 1) 0x7fd594001a70, src=src@entry=0x7fd594003390) at ../ntndArrayConverter.cpp:544
> 
> #6  0x00000000006cd06a in NTNDArrayConverter::fromAttributes(NDArray*) (this=this@entry=0x35481d0, src=src@entry=0x7fd5640012b0) at ../ntndArrayConverter.cpp:591
> 
> #7  0x00000000006cf66d in NTNDArrayConverter::fromArray(NDArray*) (this=0x35481d0, src=src@entry=0x7fd5640012b0) at ../ntndArrayConverter.cpp:240
> 
> #8  0x000000000066c6c8 in NTNDArrayRecord::update(NDArray*) (this=0x35459b0, pArray=0x7fd5640012b0) at ../NDPluginPva.cpp:85
> 
> #9  0x000000000066c7fd in NDPluginPva::processCallbacks(NDArray*) (this=0x3504340, pArray=0x7fd5640012b0) at ../NDPluginPva.cpp:124
> 
> #10 0x000000000066f5c6 in NDPluginDriver::processTask() (this=0x3504340) at ../NDPluginDriver.cpp:524
> 
> #11 0x00000000012accc9 in epicsThreadCallEntryPoint(void*) (pPvt=0x3503090) at ../../src/osi/epicsThread.cpp:83
> 
> #12 0x00000000012b273c in start_routine (arg=0x346a4c0) at ../../src/osi/os/posix/osdThread.c:403
> 
> #13 0x00007fd6e9ed0e25 in start_thread () at /lib64/libpthread.so.0
> 
> #14 0x00007fd6e8d89bad in clone () at /lib64/libc.so.6
> 
>  
> 
> Line 544 is this line:
> 
>  
> 
>     valueFld->put(&value[0]);
> 
>  
> 
> So it seems like this has not solved the problem?
> 
>  
> 
> It seems like the previous function in NTNDArrayConverter may also have issues:
> 
>  
> 
> template <typename pvAttrType, typename valueType>
> 
> void NTNDArrayConverter::fromAttribute (PVStructurePtr dest, NDAttribute *src)
> 
> {
> 
>     valueType value;
> 
>     src->getValue(src->getDataType(), (void*)&value);
> 
>  
> 
>     PVUnionPtr destUnion(dest->getSubField<PVUnion>("value"));
> 
>  
> 
>     if(!destUnion->get())
> 
>         destUnion->set(PVDC->createPVScalar<pvAttrType>());
> 
>  
> 
>     static_pointer_cast<pvAttrType>(destUnion->get())->put(value);
> 
> }
> 
>  
> 
> Is this also assuming that the datatype of that attribute has not changed?
> 
>  
> 
> Thanks,
> 
>  
> 
> Mark
> 
>  
> 
>  
> 
> -----Original Message-----
> From: Michael Davidsaver <[email protected]>
> Sent: Saturday, June 29, 2019 10:48 AM
> To: Mark Rivers <[email protected]>; [email protected]
> Subject: Re: Crash in pvData
> 
>  
> 
> On 6/29/19 7:37 AM, Mark Rivers via Core-talk wrote:
> 
>> Folks,
> 
>>
> 
>>  
> 
>>
> 
>> I have an NDArray with a string attribute holding the value “Continuous”.  When the NDArray gets converted to an NTNDArray in NTNDArrayConverter I am getting this crash:
> 
>>
> 
>>  
> 
>>
> 
>> #0  0x00007fad6f64e2ad in  () at /lib64/libstdc++.so.6
> 
>>
> 
>> #1  0x00007fad6f6b1e5e in std::string::assign(std::string const&) ()
> 
>> at /lib64/libstdc++.so.6
> 
>>
> 
>> #2  0x00000000006c113d in
> 
>> epics::pvData::detail::ScalarStorageOps<std::string>::store(std::strin
> 
>> g const&) (__str="Continuous", this=0x7fac14002650)
> 
>>
> 
>>     at /usr/include/c++/4.8.2/bits/basic_string.h:547
> 
>>
> 
>> #3  0x00000000006c113d in
> 
>> epics::pvData::detail::ScalarStorageOps<std::string>::store(std::strin
> 
>> g const&) (this=this@entry=0x7fac14002650, val="Continuous")
> 
>>
> 
>>     at /usr/local/epics-devel/base-7.0.2/include/pv/pvData.h:362
> 
>>
> 
>> #4  0x00000000006cbf41 in
> 
>> NTNDArrayConverter::fromStringAttribute(std::tr1::shared_ptr<epics::pv
> 
>> Data::PVStructure>, NDAttribute*) (v="Continuous",
> 
>> this=0x7fac140025f0)
> 
>>
> 
>>     at
> 
>> /corvette/usr/local/epics-devel/base-7.0.2/include/pv/pvData.h:399
> 
>>
> 
>> #5  0x00000000006cbf41 in
> 
>> NTNDArrayConverter::fromStringAttribute(std::tr1::shared_ptr<epics::pv
> 
>> Data::PVStructure>, NDAttribute*) (this=this@entry=0x2fb0130, dest=
> 
>>
> 
>>     std::tr1::shared_ptr (count 3, weak 1) 0x7fac140020b0,
> 
>> src=src@entry=0x7fabf0001620) at ../ntndArrayConverter.cpp:543
> 
>>
> 
>> #6  0x00000000006ccc62 in NTNDArrayConverter::fromAttributes(NDArray*)
> 
>> (this=this@entry=0x2fb0130, src=src@entry=0x7fac94001270) at
> 
>> ../ntndArrayConverter.cpp:589
> 
>>
> 
>> #7  0x00000000006cf38d in NTNDArrayConverter::fromArray(NDArray*)
> 
>> (this=0x2fb0130, src=src@entry=0x7fac94001270) at
> 
>> ../ntndArrayConverter.cpp:240
> 
>>
> 
>> #8  0x000000000066c578 in NTNDArrayRecord::update(NDArray*)
> 
>> (this=0x2fad910, pArray=0x7fac94001270) at ../NDPluginPva.cpp:85
> 
>>
> 
>> #9  0x000000000066c6ad in NDPluginPva::processCallbacks(NDArray*)
> 
>> (this=0x2f6c2a0, pArray=0x7fac94001270) at ../NDPluginPva.cpp:124
> 
>>
> 
>> #10 0x000000000066f476 in NDPluginDriver::processTask()
> 
>> (this=0x2f6c2a0) at ../NDPluginDriver.cpp:524
> 
>>
> 
>> #11 0x00000000012ac7f9 in epicsThreadCallEntryPoint(void*)
> 
>> (pPvt=0x2f6aff0) at ../../src/osi/epicsThread.cpp:83
> 
>>
> 
>> #12 0x00000000012b226c in start_routine (arg=0x2f6aeb0) at
> 
>> ../../src/osi/os/posix/osdThread.c:403
> 
>>
> 
>> #13 0x00007fad6ff53e25 in start_thread () at /lib64/libpthread.so.0
> 
>>
> 
>> #14 0x00007fad6ee0cbad in clone () at /lib64/libc.so.6
> 
>>
> 
>>  
> 
>>
> 
>> This is base 7.0.2.2 on linux-x86_64.
> 
>>
> 
>>  
> 
>>
> 
>> Any idea why this is crashing?
> 
>  
> 
> I first suspect static cast in NTNDArrayConverter::fromStringAttribute()
> 
>  
> 
> https://github.com/areaDetector/ADCore/blob/44b3a9b62e65f8a8bfb180292f77d08a5e2c4fdd/ADApp/ntndArrayConverterSrc/ntndArrayConverter.cpp#L535-L544
> 
>  
> 
> From the logic, this code will break if the union already contains something which isn't a PVString.
> 
>  
> 
> Assuming that the value should always be stored as a string (as opposed to attempting a conversion).  Maybe change to something like:
> 
>  
> 
>> std::vector<char> value(attrDataSize); // same as malloc(), with
> 
>> auto-free()
> 
>> src->getValue(attrDataType, &value[0], attrDataSize);
> 
>> 
> 
>> PVUnionPtr destUnion(dest->getSubFieldT<PVUnion>("value")); // note
> 
>> the added T PVStringPtr valueFld(destUnion->get<PVString>());
> 
>> if(!valueFld) {
> 
>>    valueFld = PVDC->createPVScalar<PVString>();
> 
>>    destUnion->put(valueFld);
> 
>> }
> 
>> value->put(value);
> 

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System