[ARROW-2448] Segfault when plasma client goes out of scope before buffer.

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.10.0
• Component/s: C++ - Plasma, Python
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/15701
• Assignee: Philipp Moritz
• Reporter: Robert Nishihara
• Created: 11/Apr/18 21:02
• Updated: 11/Jan/23 07:21
• Resolved: 25/Apr/18 18:41

Description

The following causes a segfault.

 

First start a plasma store with

plasma_store -s /tmp/store -m 10000000000

Then run the following in Python.

import pyarrow.plasma as plasma
import numpy as np

client = plasma.connect('/tmp/store', '', 0)

object_id = client.put(np.zeros(3))

buf = client.get(object_id)

del client

del buf  # This segfaults.

The backtrace is 

(lldb) bt

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffffc)

  * frame #0: 0x00000001056deaee libplasma.0.dylib`plasma::PlasmaClient::Release(plasma::UniqueID const&) + 142

    frame #1: 0x00000001056de9e9 libplasma.0.dylib`plasma::PlasmaBuffer::~PlasmaBuffer() + 41

    frame #2: 0x00000001056dec9f libplasma.0.dylib`arrow::Buffer::~Buffer() + 63

    frame #3: 0x0000000106206661 lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_count::__release_shared(this=0x00000001019b7d20) at memory:3444

    frame #4: 0x0000000106206617 lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr() [inlined] std::__1::__shared_weak_count::__release_shared(this=0x00000001019b7d20) at memory:3486

    frame #5: 0x0000000106206617 lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) at memory:4412

    frame #6: 0x0000000106002b35 lib.cpython-36m-darwin.so`std::__1::shared_ptr<arrow::Buffer>::~shared_ptr(this=0x0000000100791780) at memory:4410

    frame #7: 0x00000001061052c5 lib.cpython-36m-darwin.so`void __Pyx_call_destructor<std::__1::shared_ptr<arrow::Buffer> >(x=std::__1::shared_ptr<arrow::Buffer>::element_type @ 0x00000001019b7d38 strong=0 weak=1) at lib.cxx:486

    frame #8: 0x0000000106104f93 lib.cpython-36m-darwin.so`__pyx_tp_dealloc_7pyarrow_3lib_Buffer(o=0x0000000100791768) at lib.cxx:107704

    frame #9: 0x00000001069fcd54 multiarray.cpython-36m-darwin.so`array_dealloc + 292

    frame #10: 0x00000001000e8daf libpython3.6m.dylib`_PyDict_DelItem_KnownHash + 463

    frame #11: 0x0000000100171899 libpython3.6m.dylib`_PyEval_EvalFrameDefault + 13321

    frame #12: 0x00000001001791ef libpython3.6m.dylib`_PyEval_EvalCodeWithName + 2447

    frame #13: 0x000000010016e3d4 libpython3.6m.dylib`PyEval_EvalCode + 100

    frame #14: 0x00000001001a3bd6 libpython3.6m.dylib`PyRun_InteractiveOneObject + 582

    frame #15: 0x00000001001a350e libpython3.6m.dylib`PyRun_InteractiveLoopFlags + 222

    frame #16: 0x00000001001a33fc libpython3.6m.dylib`PyRun_AnyFileExFlags + 60

    frame #17: 0x00000001001bc835 libpython3.6m.dylib`Py_Main + 3829

    frame #18: 0x0000000100000df8 python`main + 232

    frame #19: 0x00007fff6cd80015 libdyld.dylib`start + 1

    frame #20: 0x00007fff6cd80015 libdyld.dylib`start + 1

Basically, the issue is that when the buffer goes out of scope, it calls Release on the plasma client, but the client has already been deallocated.

Issue Links

• contains: ARROW-2506 [Plasma] Build error on macOS
• links to: GitHub Pull Request #1939