Bug 458 - segfault when clicking [Run] second time with Hantek DSO-2090 USB
Summary: segfault when clicking [Run] second time with Hantek DSO-2090 USB
Status: RESOLVED FIXED
Alias: None
Product: PulseView
Classification: Unclassified
Component: Acquisition (show other bugs)
Version: unreleased development snapshot
Hardware: x86 Linux
: Normal normal
Target Milestone: ---
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-22 07:25 CEST by Matthias Wenzel
Modified: 2019-06-09 16:54 CEST (History)
4 users (show)



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Wenzel 2014-10-22 07:25:32 CEST
pulseview crashes on me when I click the Run button the 2nd time. I assume no data is aquired in the 1st run, atleast nothing is visible, but that might also be due to the analog nature of the data output. (I just get real output using sigrok-cli w/ analog output)

This is with stable 0.2.0 but also happend with a git HEAD from like 1 week ago. Context is a current debian wheezy.

user@delle:~$ pulseview 
Config key  30004  was listed, but no options were given 
Failed to get samplerate

Failed to get samplerate

Failed to get samplerate

Segmentation fault
user@delle:~$ 
user@delle:~$ gdb pulseview 
GNU gdb (GDB) 7.4.1-debian
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/local/bin/pulseview...done.
(gdb) run
Starting program: /usr/local/bin/pulseview 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe716b700 (LWP 14409)]
Config key  30004  was listed, but no options were given 
[New Thread 0x7fffe4391700 (LWP 14410)]
Failed to get samplerate

Failed to get samplerate

[Thread 0x7fffe4391700 (LWP 14410) exited]
[New Thread 0x7fffe4391700 (LWP 14411)]
Failed to get samplerate


Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe4391700 (LWP 14411)]
0x00007ffff651e5f3 in g_slist_last () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
(gdb) bt
#0  0x00007ffff651e5f3 in g_slist_last () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#1  0x00007ffff651e68e in g_slist_append () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007ffff67f4572 in configure_channels (sdi=<optimized out>) at hardware/hantek-dso/api.c:231
#3  dev_acquisition_start (sdi=0xc39c90, cb_data=0xc39c90) at hardware/hantek-dso/api.c:924
#4  0x00007ffff67c88d4 in sr_session_start () at session.c:388
#5  0x0000000000463c23 in pv::device::DevInst::start (this=<optimized out>) at /home/user/CODE/sigrok/pulseview-0.2.0/pv/device/devinst.cpp:129
#6  0x0000000000456d77 in pv::SigSession::sample_thread_proc(boost::shared_ptr<pv::device::DevInst>, boost::function<void (QString)>) (this=0x7fffffffe140, dev_inst=..., error_handler=...)
    at /home/user/CODE/sigrok/pulseview-0.2.0/pv/sigsession.cpp:450
#7  0x000000000045e6f3 in boost::_mfi::mf2<void, pv::SigSession, boost::shared_ptr<pv::device::DevInst>, boost::function<void (QString)> >::operator()(pv::SigSession*, boost::shared_ptr<pv::device::DevInst>, boost::function<void (QString)>) const (this=this@entry=0xdc5b48, p=0x7fffffffe140, a1=..., a2=...) at /usr/include/boost/bind/mem_fn_template.hpp:280
#8  0x000000000045e842 in operator()<boost::_mfi::mf2<void, pv::SigSession, boost::shared_ptr<pv::device::DevInst>, boost::function<void(QString)> >, boost::_bi::list0> (f=..., this=0xdc5b58, a=...)
    at /usr/include/boost/bind/bind.hpp:392
#9  operator() (this=0xdc5b48) at /usr/include/boost/bind/bind_template.hpp:20
#10 boost::detail::thread_data<boost::_bi::bind_t<void, boost::_mfi::mf2<void, pv::SigSession, boost::shared_ptr<pv::device::DevInst>, boost::function<void (QString)> >, boost::_bi::list3<boost::_bi::value<pv::SigSession*>, boost::_bi::value<boost::shared_ptr<pv::device::DevInst> >, boost::_bi::value<boost::function<void (QString)> > > > >::run() (this=0xdc59c0) at /usr/include/boost/thread/detail/thread.hpp:62
#11 0x00007ffff7fae629 in ?? () from /usr/lib/libboost_thread.so.1.49.0
#12 0x00007ffff7bc7b50 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#13 0x00007ffff585f7bd in clone () from /lib/x86_64-linux-gnu/libc.so.6
#14 0x0000000000000000 in ?? ()
(gdb)
Comment 1 Uwe Hermann 2016-09-11 18:05:54 CEST
I can confirm that this is still an issue, attached a backtrace with git HEAD as of today.

It's possible that this issue only happens on PulseView because sigrok-cli only every does one run and then everything is shut down, and when sigrok-cli runs next everything is freshly set up and initialized etc.

Backtrace:

[...]
sr: [00:06.653055] hantek-dso: receive_transfer(): status LIBUSB_SUCCESS / LIBUSB_TRANSFER_COMPLETED received 512 bytes.
sr: [00:06.653061] hantek-dso: Got 8705-8960/10240 samples in frame.
sr: [00:06.653068] hantek-dso: receive_transfer(): status LIBUSB_SUCCESS / LIBUSB_TRANSFER_COMPLETED received 512 bytes.
sr: [00:06.653073] hantek-dso: Got 8961-9216/10240 samples in frame.
sr: [00:06.653077] hantek-dso: Reached trigger point, 9038 samples buffered.
sr: [00:06.653085] session: bus: Received SR_DF_ANALOG packet (178 samples).

Thread 6 "pulseview" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe08a3700 (LWP 18401)]
0x00007ffff6853bbe in std::__shared_ptr<sigrok::Device, (__gnu_cxx::_Lock_policy)2>::operator= (this=0x10) at /usr/include/c++/6/bits/shared_ptr_base.h:870
870         class __shared_ptr

Thread 6 (Thread 0x7fffe08a3700 (LWP 18401)):
#0  0x00007ffff6853bbe in std::__shared_ptr<sigrok::Device, (__gnu_cxx::_Lock_policy)2>::operator= (this=0x10) at /usr/include/c++/6/bits/shared_ptr_base.h:870
#1  std::shared_ptr<sigrok::Device>::operator= (this=0x10) at /usr/include/c++/6/bits/shared_ptr.h:93
#2  sigrok::ParentOwned<sigrok::Channel, sigrok::Device>::share_owned_by (parent=std::shared_ptr (expired, weak 0) 0x7fffe08a26a0, this=0x0) at ../bindings/cxx/include/libsigrokcxx/libsigrokcxx.hpp:186
#3  sigrok::Device::get_channel (this=<optimized out>, ptr=<optimized out>) at ../bindings/cxx/classes.cpp:628
#4  0x00007ffff6853ea0 in sigrok::Analog::channels (this=0x7fffd0010050) at ../bindings/cxx/classes.cpp:1225
#5  0x000000000048d72b in pv::Session::feed_in_analog (this=this@entry=0xa5f4c0, analog=std::shared_ptr (count 2, weak 1) 0x7fffd0010050)
    at [...]/pulseview/pv/session.cpp:870
#6  0x000000000048e06e in pv::Session::data_feed_in (this=0xa5f4c0, device=std::shared_ptr (count 14, weak 1) 0x8bfaa0, packet=std::shared_ptr (count 3, weak 1) 0x7fffd0014650)
    at [...]/pulseview/pv/session.cpp:962
#7  0x000000000048e52c in pv::Session::<lambda(std::shared_ptr<sigrok::Device>, std::shared_ptr<sigrok::Packet>)>::operator() (packet=..., device=..., __closure=<optimized out>)
    at [...]/pulseview/pv/session.cpp:402
#8  std::_Function_handler<void(std::shared_ptr<sigrok::Device>, std::shared_ptr<sigrok::Packet>), pv::Session::set_device(std::shared_ptr<pv::devices::Device>)::<lambda(std::shared_ptr<sigrok::Device>, std::shared_ptr<sigrok::Packet>)> >::_M_invoke(const std::_Any_data &, <unknown type in /home/uwe/sr/bin/pulseview, CU 0x1accd2, DIE 0x2453f4>, <unknown type in /home/uwe/sr/bin/pulseview, CU 0x1accd2, DIE 0x2457f8>) (__functor=..., 
    __args#0=<optimized out>, __args#1=<optimized out>) at /usr/include/c++/6/functional:1740
#9  0x00007ffff685698d in std::function<void (std::shared_ptr<sigrok::Device>, std::shared_ptr<sigrok::Packet>)>::operator()(std::shared_ptr<sigrok::Device>, std::shared_ptr<sigrok::Packet>) const (
    __args#1=std::shared_ptr (count -527816288, weak 32766) 0x7fffe08a28c0, __args#0=<error reading variable: access outside bounds of object referenced via synthetic pointer>, this=0xaeab20)
    at /usr/include/c++/6/functional:2136
#10 sigrok::DatafeedCallbackData::run (this=0xaeab20, sdi=<optimized out>, pkt=0x7fffe08a2970) at ../bindings/cxx/classes.cpp:885
#11 0x00007ffff656dd0f in sr_session_send (sdi=sdi@entry=0x8c01c0, packet=packet@entry=0x7fffe08a2970) at ../src/session.c:1151
#12 0x00007ffff65ac3df in send_chunk (sdi=sdi@entry=0x8c01c0, 
    buf=0x7fffd00143dc "\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\201\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\201\201\200\201\200\201\200\201\200\201\200\201\200\201\177\201\200\201\200\201\200\201\200\200\200\200\177\201\200\201\200\201\200\201\177\200\200\201\200\201\200\201\200\201\201\201\200\201\200\200\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\177\201\200\201\201\200\200\201\177\201\200\201\200\200\200\200\200\200\177\201\200\200\200\201\200\200\200\200\200\201\200\201\200\201\200\201\200\200\200\201\200\201\200\201\201\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200\201\200"..., num_samples=num_samples@entry=178) at ../src/hardware/hantek-dso/api.c:737
#13 0x00007ffff65ac655 in receive_transfer (transfer=0x7fffd00145e8) at ../src/hardware/hantek-dso/api.c:806
#14 0x00007ffff2dc564a in ?? () from /lib/x86_64-linux-gnu/libusb-1.0.so.0
#15 0x00007ffff2dcb3f8 in ?? () from /lib/x86_64-linux-gnu/libusb-1.0.so.0
#16 0x00007ffff2dc5139 in ?? () from /lib/x86_64-linux-gnu/libusb-1.0.so.0
#17 0x00007ffff2dc6043 in libusb_handle_events_timeout_completed () from /lib/x86_64-linux-gnu/libusb-1.0.so.0
#18 0x00007ffff65abfe3 in handle_event (fd=<error reading variable: value has been optimized out>, revents=<error reading variable: value has been optimized out>, cb_data=0x8c01c0, 
    cb_data@entry=<error reading variable: value has been optimized out>) at ../src/hardware/hantek-dso/api.c:878
#19 0x00007ffff65833af in usb_source_dispatch (source=0x7fffd0001a70, callback=<optimized out>, user_data=<optimized out>) at ../src/usb.c:142
#20 0x00007ffff599beaa in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#21 0x00007ffff599c260 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#22 0x00007ffff599c582 in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#23 0x00007ffff656da51 in sr_session_run (session=0xae7920) at ../src/session.c:893
#24 0x00007ffff684a25d in sigrok::Session::run (this=<optimized out>) at ../bindings/cxx/classes.cpp:974
#25 0x00000000004895d5 in pv::Session::sample_thread_proc(std::function<void (QString)>) (this=0xa5f4c0, error_handler=...) at [...]/pulseview/pv/session.cpp:762
#26 0x00000000004907ff in std::__invoke_impl<void, void (pv::Session::* const&)(std::function<void (QString)>), pv::Session*, std::function<void (QString)> >(std::__invoke_memfun_deref, void (pv::Session::* const&)(std::function<void (QString)>), pv::Session*&&, std::function<void (QString)>&&) (__t=<optimized out>, __f=<optimized out>) at /usr/include/c++/6/functional:235
#27 std::__invoke<void (pv::Session::* const&)(std::function<void (QString)>), pv::Session*, std::function<void (QString)> >(void (pv::Session::* const&)(std::function<void (QString)>), pv::Session*&&, std::function<void (QString)>&&) (__fn=<optimized out>) at /usr/include/c++/6/functional:260
#28 std::_Mem_fn_base<void (pv::Session::*)(std::function<void (QString)>), true>::operator()<pv::Session*, std::function<void (QString)> >(pv::Session*&&, std::function<void (QString)>&&) const (this=<optimized out>)
    at /usr/include/c++/6/functional:613
#29 std::_Bind_simple<std::_Mem_fn<void (pv::Session::*)(std::function<void (QString)>)> (pv::Session*, std::function<void (QString)>)>::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) (this=<optimized out>)
    at /usr/include/c++/6/functional:1400
#30 std::_Bind_simple<std::_Mem_fn<void (pv::Session::*)(std::function<void (QString)>)> (pv::Session*, std::function<void (QString)>)>::operator()() (this=<optimized out>) at /usr/include/c++/6/functional:1389
#31 std::thread::_State_impl<std::_Bind_simple<std::_Mem_fn<void (pv::Session::*)(std::function<void (QString)>)> (pv::Session*, std::function<void (QString)>)> >::_M_run() (this=<optimized out>)
    at /usr/include/c++/6/thread:196
#32 0x00007ffff459d94f in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#33 0x00007ffff6a74444 in start_thread (arg=0x7fffe08a3700) at pthread_create.c:333
#34 0x00007ffff3d0e20d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 4 (Thread 0x7fffe3219700 (LWP 18386)):
#0  0x00007ffff3d0509d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff599c1f6 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007ffff599c30c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007ffff4b404ff in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#4  0x00007ffff4ae819a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#5  0x00007ffff490de53 in QThread::exec() () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#6  0x00007fffe9e4b525 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5DBus.so.5
#7  0x00007ffff4912d78 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#8  0x00007ffff6a74444 in start_thread (arg=0x7fffe3219700) at pthread_create.c:333
#9  0x00007ffff3d0e20d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 3 (Thread 0x7fffe3fff700 (LWP 18378)):
#0  0x00007ffff3d0509d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff2dcbb3c in ?? () from /lib/x86_64-linux-gnu/libusb-1.0.so.0
#2  0x00007ffff6a74444 in start_thread (arg=0x7fffe3fff700) at pthread_create.c:333
#3  0x00007ffff3d0e20d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 2 (Thread 0x7fffe8de4700 (LWP 18377)):
#0  0x00007ffff3d0509d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff0160340 in ?? () from /usr/lib/x86_64-linux-gnu/libxcb.so.1
#2  0x00007ffff0161f39 in xcb_wait_for_event () from /usr/lib/x86_64-linux-gnu/libxcb.so.1
#3  0x00007ffff7e64a79 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#4  0x00007ffff4912d78 in ?? () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#5  0x00007ffff6a74444 in start_thread (arg=0x7fffe8de4700) at pthread_create.c:333
#6  0x00007ffff3d0e20d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 1 (Thread 0x7ffff7f44780 (LWP 18373)):
#0  0x00007ffff3d0509d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007ffff599c1f6 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007ffff599c30c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007ffff4b404ff in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#4  0x00007ffff4ae819a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#5  0x00007ffff4af099c in QCoreApplication::exec() () from /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#6  0x000000000046f937 in main (argc=<optimized out>, argv=<optimized out>) at [...]/pulseview/main.cpp:184
A debugging session is active.
Comment 2 Daniel O'Connor 2017-04-06 09:26:28 CEST
I get this too with today's head (using a Hantek DSO-2150 on OSX)

Some digging..
Fault is at..
-> 231 				devc->enabled_channels = g_slist_append(devc->enabled_channels, ch);

Of course devc and sdi are invisible to lldb so I went up a few frames and found devc..
(lldb) print *devc
(dev_context) $8 = {
  profile = 0x0000000100849b88
  limit_frames = 1
  num_frames = 0
  enabled_channels = 0x000000010d393080
  fw_updated = 0
  epin_maxpacketsize = 512
  capture_empty_count = 0
  dev_state = 0
  timebase = 3
  ch_enabled = ([0] = 1, [1] = 1)
  voltage = ([0] = 5, [1] = 5)
  coupling = ([0] = 1, [1] = 1)
  voffset_ch1 = 0.5
  voffset_ch2 = 0.5
  voffset_trigger = 0.5
  channel_levels = {
    [0] = {
      [0] = ([0] = 63, [1] = 173)
      [1] = ([0] = 33, [1] = 142)
      [2] = ([0] = 16, [1] = 126)
      [3] = ([0] = 63, [1] = 173)
      [4] = ([0] = 33, [1] = 142)
      [5] = ([0] = 16, [1] = 126)
      [6] = ([0] = 63, [1] = 173)
      [7] = ([0] = 33, [1] = 142)
      [8] = ([0] = 16, [1] = 126)
    }
    [1] = {
      [0] = ([0] = 45, [1] = 154)
      [1] = ([0] = 22, [1] = 131)
      [2] = ([0] = 11, [1] = 120)
      [3] = ([0] = 44, [1] = 153)
      [4] = ([0] = 22, [1] = 131)
      [5] = ([0] = 11, [1] = 120)
      [6] = ([0] = 44, [1] = 153)
      [7] = ([0] = 22, [1] = 131)
      [8] = ([0] = 11, [1] = 120)
    }
  }
  framesize = 10240
  filter = ([0] = 0, [1] = 0)
  triggerslope = 0
  triggersource = 0x000000010c835460 "CH1"
  triggerposition = 0.5
  triggermode = 0
  samp_received = 0
  samp_buffered = 0
  trigger_offset = 0
  framebuf = 0x0000000000000000 <no value available>
}

and enabled_channels..
(lldb) print *devc->enabled_channels
(GSList) $10 = {
  data = 0x0000000000000000
  next = 0x000000010c833b80
}
(lldb) print *devc->enabled_channels->next
(GSList) $11 = {
  data = 0x000000010c833af0
  next = 0x0000271100000000
}

It looks like 0x0000271100000000 is the problem, and the very bottom of the stack..
frame #0: 0x000000010099c4ae libglib-2.0.0.dylib`g_slist_append + 45
libglib-2.0.0.dylib`g_slist_append:
->  0x10099c4ae <+45>: movq   0x8(%rcx), %rdx
    0x10099c4b2 <+49>: testq  %rdx, %rdx
    0x10099c4b5 <+52>: jne    0x10099c4ab               ; <+42>
    0x10099c4b7 <+54>: movq   %rax, 0x8(%rcx)
(lldb) register read                                                                                                                                                                                                                                            General Purpose Registers:
       rax = 0x000000010d393090
       rbx = 0x000000010d393080
       rcx = 0x0000271100000000
       rdx = 0x0000271100000000
       rdi = 0x0000000000000103
       rsi = 0x000000010c830720
       rbp = 0x0000700002690980
       rsp = 0x0000700002690970
        r8 = 0x0000000000000008
        r9 = 0x0000000000000000
       r10 = 0x0000000000000004
       r11 = 0x0000000100a20fbc  libglib-2.0.0.dylib`g_mem_gc_friendly
       r12 = 0x00000000ffffffff
       r13 = 0x000000010c835380
       r14 = 0x000000010c830720
       r15 = 0x000000010c8306a0
       rip = 0x000000010099c4ae  libglib-2.0.0.dylib`g_slist_append + 45
    rflags = 0x0000000000000206
        cs = 0x000000000000002b
        fs = 0x0000000000000000
        gs = 0x0000000000000000

i.e. de-referencing a trash pointer.
Comment 3 Uwe Hermann 2018-01-11 02:23:43 CET
This should be fixed in be10b96d40baddbf8b1bf341c2da115a34e716a5, thanks!

I could reproduce the issue without the fix and confirm that it doesn't happen with the fix, but some more testing would be appreciated.
Comment 4 Egil Kvaleberg 2019-06-09 15:50:13 CEST
I can confirm that something certainly has been fixed, testing with a Hantek DSO-2090.

When running pulseview from the Ubuntu distro (version 0.4.0, from memory) there was a segfault the second time I pressed Run. In gdb it was a bit different from anything logged here, but a segfault non the less.

With the latest version from git (0.5.0-git-5322d2d) I have had no segfault so far.
Comment 5 Uwe Hermann 2019-06-09 16:54:25 CEST
Great, thanks for double-checking!