[BUG] Binders causes memory corruption

[ebadi]

Hi, I successfully generated and compiled binding for the esmini simulator by calling binder like this and using the config/headers file in the src directory. The generated bindings for each module are accessible in the separated directories under ./src.

However, I noticed the following issues:

Memory corruption 1

import pyesminilib
pyesminilib.SE_Init( '/home/[...]/esmini-pybind11/esmini/resources/xosc/lane_change.xosc',1,1,0,0)

From the log message I can see SE_Init function is called with the correct arguments but the binding introduces a memory corruption as below:

esmini GIT REV: 06f0360
esmini GIT TAG: 
esmini GIT BRANCH: master
esmini BUILD VERSION: N/A - client build
esminiLib.cpp / 104 / ConvertArguments(): Player arguments:  viewer --osc /home/[...]/esmini-pybind11/esmini/resources/xosc/lane_change.xosc --window 60 60 800 400 --disable_controllers
python3: malloc.c:2379: sysmalloc: Assertion `(old_top == initial_top (av) && old_size == 0) || ((unsigned long) (old_size) >= MINSIZE && prev_inuse (old_top) && ((unsigned long) old_end & (pagesize - 1)) == 0)' failed.
Aborted (core dumped)

Memory corruption 2

ScenarioPlayer class also crashes when it is initialized. With this minimal example I get memory corruption errors when I run this simple test script:

I posed the question in https://github.com/RosettaCommons/binder/issues/151 and it was suggested by @lyskov to remove all other methods and see if it works. (check if commenting out anything but constructor bindings for ScenarioPlayer makes any difference by commenting out bindings for all member functions and data members here)

With an empty constructor the binding starts working so I narrowed down the problematic methods to these two methods but I still cannot see where/what the issue is!

        cl.def("SetParameterValue", (int (ScenarioPlayer::*)(const char *, const void *)) &ScenarioPlayer::SetParameterValue, "C++: ScenarioPlayer::SetParameterValue(const char *, const void *) --> int", pybind11::arg("name"), pybind11::arg("value"));
        cl.def("GetParameterValue", (int (ScenarioPlayer::*)(const char *, void *)) &ScenarioPlayer::GetParameterValue, "C++: ScenarioPlayer::GetParameterValue(const char *, void *) --> int", pybind11::arg("name"), pybind11::arg("value"));

$python3 tests/scenarioplayer.py

malloc(): corrupted top size
Aborted (core dumped)

in gdb :

~/r/esmini-pybind11 (master) [127]> gdb python3 
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Registered pretty printers for UE4 classes
Reading symbols from python3...
(No debugging symbols found in python3)
(gdb) r tests/scenarioplayer.py
Starting program: /usr/bin/python3 tests/scenarioplayer.py
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
malloc(): corrupted top size

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50  ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7dd2859 in __GI_abort () at abort.c:79
#2  0x00007ffff7e3d3ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7f67285 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007ffff7e4547c in malloc_printerr (str=str@entry=0x7ffff7f65556 "malloc(): corrupted top size") at malloc.c:5347
#4  0x00007ffff7e4883a in _int_malloc (av=av@entry=0x7ffff7f98b80 <main_arena>, bytes=bytes@entry=104) at malloc.c:4107
#5  0x00007ffff7e4a2d4 in __GI___libc_malloc (bytes=104) at malloc.c:3058
#6  0x00007ffff512fc29 in operator new(unsigned long) () from /lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x00007ffff6e93694 in ?? () from /home/wave/.local/lib/python3.8/site-packages/pyplayerbase.cpython-38-x86_64-linux-gnu.so
#8  0x00007ffff6ea25ae in ?? () from /home/wave/.local/lib/python3.8/site-packages/pyplayerbase.cpython-38-x86_64-linux-gnu.so
#9  0x00000000005f2fb9 in PyCFunction_Call ()
#10 0x00000000005f3446 in _PyObject_MakeTpCall ()
#11 0x000000000050aa4a in ?? ()
#12 0x00000000005f2b87 in PyObject_Call ()
#13 0x000000000059bc1c in ?? ()
#14 0x00000000005a6867 in ?? ()
#15 0x00007ffff6e9f02d in ?? () from /home/wave/.local/lib/python3.8/site-packages/pyplayerbase.cpython-38-x86_64-linux-gnu.so
#16 0x00000000005f3446 in _PyObject_MakeTpCall ()
#17 0x000000000056f1ca in _PyEval_EvalFrameDefault ()
#18 0x000000000056822a in _PyEval_EvalCodeWithName ()
#19 0x000000000068c1e7 in PyEval_EvalCode ()
#20 0x000000000067d5a1 in ?? ()
#21 0x000000000067d61f in ?? ()
#22 0x000000000067d6db in PyRun_FileExFlags ()
#23 0x000000000067da6e in PyRun_SimpleFileExFlags ()
#24 0x00000000006b6132 in Py_RunMain ()
#25 0x00000000006b64bd in Py_BytesMain ()
#26 0x00007ffff7dd40b3 in __libc_start_main (main=0x4eec80 <main>, argc=2, argv=0x7fffffffdf38, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdf28)
    at ../csu/libc-start.c:308
#27 0x00000000005f927e in _start ()
(gdb) 

BTW, I dockerized the build process here if you are interested to reproduce the crash.

[lufficc]

Same issue.

[ebadi]

@lufficc this is a known issue that i was not successful to fix. I appreciate any hint on why this is happening or contribution :)