Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rviz crashes on malformed TRIANGLE_LIST marker (ros-pkg ticket #5048) #411

Closed
hershwg opened this issue Sep 19, 2012 · 3 comments
Closed
Labels

Comments

@hershwg
Copy link
Member

hershwg commented Sep 19, 2012

rviz crashes reproducibly when it receives a TRIANGLE_LIST marker twice with action ''ADD'' and empty ''points'' and ''colors'' vectors.

Attached is a backtrace, the used rviz configuration and the marker-of-death in a bag file.

I was using the Debian packages for diamondback.

The crash happened on an AMD Turion(tm) 64 notebook with an nVidia G72M (!GeForce Go 7300) and Ubuntu 11.04. I also tested it on my Desktop, an Intel i7 with an nVidia !GeForce GT240 AMP and Ubuntu 10.10. It crashed as well.

The backtrace:
{{{
#0 0x0000000000000000 in ?? ()
#1 0x00007fffd4305ca1 in rviz::TriangleListMarker::~TriangleListMarker (

this=<value optimized out>, __in_chrg=<value optimized out>)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/default_plugin/markers/triangle_list_marker.cpp:65

#2 0x00007fffd4305f09 in rviz::TriangleListMarker::~TriangleListMarker (

this=0xb23d00, __in_chrg=<value optimized out>)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/default_plugin/markers/triangle_list_marker.cpp:81

#3 0x00007fffd42f6889 in release (this=,

__in_chrg=<value optimized out>)
at /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_x86.hpp:145

#4 boost::detail::shared_count::~shared_count (this=,

__in_chrg=<value optimized out>)
at /usr/include/boost/smart_ptr/detail/shared_count.hpp:217

#5 0x00007fffd4315244 in ~shared_ptr (this=0xd39180,

__x=<value optimized out>)
at /usr/include/boost/smart_ptr/shared_ptr.hpp:169

#6 ~pair (this=0xd39180, __x=)

at /usr/include/c++/4.5/bits/stl_pair.h:72

#7 destroy (this=0xd39180, __x=)

at /usr/include/c++/4.5/ext/new_allocator.h:115

#8 _M_destroy_node (this=0xd39180, __x=)

at /usr/include/c++/4.5/bits/stl_tree.h:383

#9 std::_Rb_tree<std::pair<std::basic_string<char, std::char_traits, std::allocator >, int>, std::pair<std::pair<std::basic_string<char, std::char_traits, std::allocator >, int> const, boost::shared_ptrrviz::MarkerBase >, std::_Select1st<std::pair<std::pair<std::basic_string<char, std::char_traits, std::allocator >, int> const, boost::shared_ptrrviz::MarkerBase > >, std::less<std::pair<std::basic_string<char, std::char_traits, std::allocator >, int> >, std::allocator<std::pair<std::pair<std::basic_string<char, std::char_traits, std::allocator >, int> const, boost::shared_ptrrviz::MarkerBase > > >::_M_erase (this=0xd39180,

__x=<value optimized out>) at /usr/include/c++/4.5/bits/stl_tree.h:990

#10 0x00007fffd430ce89 in clear (this=)

at /usr/include/c++/4.5/bits/stl_tree.h:744

#11 clear (this=)

at /usr/include/c++/4.5/bits/stl_map.h:664

---Type to continue, or q to quit---
#12 rviz::MarkerDisplay::clearMarkers (this=)

at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/default_plugin/marker_display.cpp:97

#13 0x00007fffd430d425 in rviz::MarkerDisplay::onDisable (this=0xd38f80)

at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/default_plugin/marker_display.cpp:127

#14 0x00007ffff1dd8d82 in rviz::Display::disable (this=0xd38f80,

force=<value optimized out>)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/display.cpp:94

#15 0x00007ffff1dd9da5 in rviz::DisplayWrapper::destroyDisplay (this=0xd374d0)

at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/display_wrapper.cpp:246

#16 0x00007ffff1dd9dee in rviz::DisplayWrapper::~DisplayWrapper (

this=0xd374d0, __in_chrg=<value optimized out>)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/display_wrapper.cpp:66

#17 0x00007ffff1db6f29 in rviz::VisualizationManager::removeDisplay (

this=0xc29810, display=0xd374d0)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/visualization_manager.cpp:548

#18 0x00007ffff1db70cc in rviz::VisualizationManager::removeAllDisplays (

this=0xc29810)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/visualization_manager.cpp:559

#19 0x00007ffff1dcb446 in rviz::VisualizationFrame::~VisualizationFrame (

this=0x8fa400, __in_chrg=<value optimized out>)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/visualization_frame.cpp:111

#20 0x00007ffff1dcb6e9 in rviz::VisualizationFrame::~VisualizationFrame (

this=0x8fa400, __in_chrg=<value optimized out>)
at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-vi---Type <return> to continue, or q <return> to quit---

sualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/visualization_frame.cpp:118
#21 0x00007ffff098b503 in wxAppBase::CleanUp() ()

from /usr/lib/libwx_gtk2u_core-2.8.so.0
#22 0x00007ffff00472ef in wxEntryCleanup() ()

from /usr/lib/libwx_baseu-2.8.so.0
#23 0x00007ffff004749c in wxUninitialize() ()

from /usr/lib/libwx_baseu-2.8.so.0
#24 0x00007ffff0047502 in wxEntry(int&, wchar_t**) ()

from /usr/lib/libwx_baseu-2.8.so.0
#25 0x00000000004141f2 in main (argc=1, argv=)

at /tmp/buildd/ros-diamondback-visualization-1.4.1/debian/ros-diamondback-visualization/opt/ros/diamondback/stacks/visualization/rviz/src/rviz/visualizer_app.cpp:321

}}}

trac data:

@hershwg
Copy link
Member Author

hershwg commented Sep 19, 2012

[hersh] Thanks for the report. The stack trace confuses me a bit since near the bottom is the VisualizationFrame destructor, meaning the stack trace happened when rviz was in the process of shutting down.

@hershwg
Copy link
Member Author

hershwg commented Sep 19, 2012

[kresse] Thanks for the quick reply. These destructors confused me as well (~!VisualizationFrame, ~!DisplayWrapper, but also destroyDisplay, onDisable or removeAllDisplays). I can assure you, however, that I did nothing in that moment other than sending the marker. This smells like some panic-so-lets-quit code to me, that got triggered by the second message.

I just hope that this is reproducible on your machine...

@hershwg
Copy link
Member Author

hershwg commented Sep 19, 2012

[hersh] Fixed in r38891.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant