Skip to content

Segfault when plasma client goes out of scope before buffer. #15701

Description

@asfimport

The following causes a segfault.

First start a plasma store with

plasma_store -s /tmp/store -m10000000000

Then run the following in Python.

importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
object_id = client.put(np.zeros(3))
buf = client.get(object_id)
delclientdelbuf # Thissegfaults.

The backtrace is 

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
* frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

Reporter: Robert Nishihara / @robertnishihara
Assignee: Philipp Moritz / @pcmoritz

Related issues:

PRs and other links:

Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
     blocks
    (function() {
    function addCopyButtons() {
    document.querySelectorAll('pre code').forEach(function(codeBlock) {
    if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
    codeBlock.parentElement.setAttribute('data-copy-added', 'true');
    var btn = document.createElement('button');
    btn.textContent = 'Copy';
    btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
    btn.onmouseover = function() { this.style.opacity = '1'; };
    btn.onmouseout = function() { this.style.opacity = '0.7'; };
    btn.onclick = function() {
    navigator.clipboard.writeText(codeBlock.textContent).then(function() {
    btn.textContent = 'Copied!';
    setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
    });
    };
    codeBlock.parentElement.style.position = 'relative';
    codeBlock.parentElement.appendChild(btn);
    });
    }
    addCopyButtons();
    // Re-run on dynamic content
    var observer = new MutationObserver(addCopyButtons);
    observer.observe(document.body, { childList: true, subtree: true });
    })();
    }
    } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
    })();
    (function(){
    try {
    var __m = "github.com";
    var __re = new RegExp('^' + "github\\.com" + '
    Segfault when plasma client goes out of scope before buffer. · Issue #15701 · apache/arrow · GitHub
    Skip to content

    Segfault when plasma client goes out of scope before buffer. #15701

    Description

    @asfimport

    The following causes a segfault.

    First start a plasma store with

    plasma_store -s /tmp/store -m10000000000

    Then run the following in Python.

    importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
    object_id = client.put(np.zeros(3))
    buf = client.get(object_id)
    delclientdelbuf # Thissegfaults.

    The backtrace is 

    (lldb) bt
    * thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
    * frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

    Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

    Reporter: Robert Nishihara / @robertnishihara
    Assignee: Philipp Moritz / @pcmoritz

    Related issues:

    PRs and other links:

    Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

    Metadata

    Metadata

    Assignees

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Segfault when plasma client goes out of scope before buffer. · Issue #15701 · apache/arrow · GitHub
      Skip to content

      Segfault when plasma client goes out of scope before buffer. #15701

      Description

      @asfimport

      The following causes a segfault.

      First start a plasma store with

      plasma_store -s /tmp/store -m10000000000

      Then run the following in Python.

      importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
      object_id = client.put(np.zeros(3))
      buf = client.get(object_id)
      delclientdelbuf # Thissegfaults.

      The backtrace is 

      (lldb) bt
      * thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
      * frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

      Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

      Reporter: Robert Nishihara / @robertnishihara
      Assignee: Philipp Moritz / @pcmoritz

      Related issues:

      PRs and other links:

      Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

      Metadata

      Metadata

      Assignees

      Type

      No type

      Projects

      No projects

        Milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions

        , 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Segfault when plasma client goes out of scope before buffer. · Issue #15701 · apache/arrow · GitHub
        Skip to content

        Segfault when plasma client goes out of scope before buffer. #15701

        Description

        @asfimport

        The following causes a segfault.

        First start a plasma store with

        plasma_store -s /tmp/store -m10000000000

        Then run the following in Python.

        importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
        object_id = client.put(np.zeros(3))
        buf = client.get(object_id)
        delclientdelbuf # Thissegfaults.

        The backtrace is 

        (lldb) bt
        * thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
        * frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

        Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

        Reporter: Robert Nishihara / @robertnishihara
        Assignee: Philipp Moritz / @pcmoritz

        Related issues:

        PRs and other links:

        Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

        Metadata

        Metadata

        Assignees

        Type

        No type

        Projects

        No projects

          Milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' Segfault when plasma client goes out of scope before buffer. · Issue #15701 · apache/arrow · GitHub
          Skip to content

          Segfault when plasma client goes out of scope before buffer. #15701

          Description

          @asfimport

          The following causes a segfault.

          First start a plasma store with

          plasma_store -s /tmp/store -m10000000000

          Then run the following in Python.

          importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
          object_id = client.put(np.zeros(3))
          buf = client.get(object_id)
          delclientdelbuf # Thissegfaults.

          The backtrace is 

          (lldb) bt
          * thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
          * frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

          Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

          Reporter: Robert Nishihara / @robertnishihara
          Assignee: Philipp Moritz / @pcmoritz

          Related issues:

          PRs and other links:

          Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

          Metadata

          Metadata

          Assignees

          Type

          No type

          Projects

          No projects

            Milestone

            Relationships

            None yet

            Development

            No branches or pull requests

            Issue actions

            , 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Segfault when plasma client goes out of scope before buffer. · Issue #15701 · apache/arrow · GitHub
            Skip to content

            Segfault when plasma client goes out of scope before buffer. #15701

            Description

            @asfimport

            The following causes a segfault.

            First start a plasma store with

            plasma_store -s /tmp/store -m10000000000

            Then run the following in Python.

            importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
            object_id = client.put(np.zeros(3))
            buf = client.get(object_id)
            delclientdelbuf # Thissegfaults.

            The backtrace is 

            (lldb) bt
            * thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
            * frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

            Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

            Reporter: Robert Nishihara / @robertnishihara
            Assignee: Philipp Moritz / @pcmoritz

            Related issues:

            PRs and other links:

            Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

            Metadata

            Metadata

            Assignees

            Type

            No type

            Projects

            No projects

              Milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Segfault when plasma client goes out of scope before buffer. · Issue #15701 · apache/arrow · GitHub
              Skip to content

              Segfault when plasma client goes out of scope before buffer. #15701

              Description

              @asfimport

              The following causes a segfault.

              First start a plasma store with

              plasma_store -s /tmp/store -m10000000000

              Then run the following in Python.

              importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
              object_id = client.put(np.zeros(3))
              buf = client.get(object_id)
              delclientdelbuf # Thissegfaults.

              The backtrace is 

              (lldb) bt
              * thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
              * frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

              Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

              Reporter: Robert Nishihara / @robertnishihara
              Assignee: Philipp Moritz / @pcmoritz

              Related issues:

              PRs and other links:

              Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

              Metadata

              Metadata

              Assignees

              Type

              No type

              Projects

              No projects

                Milestone

                Relationships

                None yet

                Development

                No branches or pull requests

                Issue actions

                , 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); Segfault when plasma client goes out of scope before buffer. · Issue #15701 · apache/arrow · GitHub
                Skip to content

                Segfault when plasma client goes out of scope before buffer. #15701

                Description

                @asfimport

                The following causes a segfault.

                First start a plasma store with

                plasma_store -s /tmp/store -m10000000000

                Then run the following in Python.

                importpyarrow.plasmaasplasmaimportnumpyasnpclient = plasma.connect('/tmp/store', '', 0)
                object_id = client.put(np.zeros(3))
                buf = client.get(object_id)
                delclientdelbuf # Thissegfaults.

                The backtrace is 

                (lldb) bt
                * thread #1, queue = 'com.apple.main-thread', stopreason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)
                * frame #0: 0x00000001056deaeelibplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueIDconst&) + 142frame #1: 0x00000001056de9e9libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41frame #2: 0x00000001056dec9flibplasma.0.dylib`arrow::Buffer::~Buffer() + 63frame #3: 0x0000000106206661lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) atmemory:3444frame #4: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) atmemory:3486frame #5: 0x0000000106206617lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4412frame #6: 0x0000000106002b35lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) atmemory:4410frame #7: 0x00000001061052c5lib.cpython-36m-darwin.so`void__Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type@0x00000001019b7d38strong=0weak=1) atlib.cxx:486frame #8: 0x0000000106104f93lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) atlib.cxx:107704frame #9: 0x00000001069fcd54multiarray.cpython-36m-darwin.so`array_dealloc + 292frame #10: 0x00000001000e8daflibpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463frame #11: 0x0000000100171899libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321frame #12: 0x00000001001791eflibpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447frame #13: 0x000000010016e3d4libpython3.6m.dylib`PyEval_EvalCode + 100frame #14: 0x00000001001a3bd6libpython3.6m.dylib`PyRun_InteractiveOneObject + 582frame #15: 0x00000001001a350elibpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222frame #16: 0x00000001001a33fclibpython3.6m.dylib`PyRun_AnyFileExFlags + 60frame #17: 0x00000001001bc835libpython3.6m.dylib`Py_Main + 3829frame #18: 0x0000000100000df8python`main + 232frame #19: 0x00007fff6cd80015libdyld.dylib`start + 1frame #20: 0x00007fff6cd80015libdyld.dylib`start + 1

                Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

                Reporter: Robert Nishihara / @robertnishihara
                Assignee: Philipp Moritz / @pcmoritz

                Related issues:

                PRs and other links:

                Note: This issue was originally created as ARROW-2448. Please see the migration documentation for further details.

                Metadata

                Metadata

                Assignees

                Type

                No type

                Projects

                No projects

                  Milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions