[lxml-dev] *** glibc detected *** free(): invalid pointer: 0x086449e7 ***

[Stefan Behnel]

Doug Winter wrote:
> Stefan Behnel wrote:
>> Ah, ok. Any chance you could switch to either 1.2 or 1.3beta? There
>> were a
>> number of bug fixes since 1.1.1 that might be related here.
> 
> I thought I'd tried this before (I've been hunting this bug a while),
> and I had, but now this is narrowed down a bit it's more interesting.
> 1.3beta still abends:
> 
> *** glibc detected *** free(): invalid pointer: 0x085a8a8d ***
> 
> But the backtrace is different:
> 
> (gdb) bt
> #0  0xb7fce410 in ?? ()
> #1  0xb4a97c0c in ?? ()
> #2  0x00000006 in ?? ()
> #3  0x000044c7 in ?? ()
> #4  0xb7e7d811 in raise () from /lib/tls/i686/cmov/libc.so.6
> #5  0xb7e7efb9 in abort () from /lib/tls/i686/cmov/libc.so.6
> #6  0xb7eb2d3a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6
> #7  0xb7eba5cf in mallopt () from /lib/tls/i686/cmov/libc.so.6
> #8  0xb7eba672 in free () from /lib/tls/i686/cmov/libc.so.6
> #9  0xb728d55d in xmlFreeNodeList () from /usr/lib/libxml2.so.2
> #10 0xb728d6a2 in xmlFreeProp () from /usr/lib/libxml2.so.2
> #11 0xb728d91b in xmlFreePropList () from /usr/lib/libxml2.so.2
> #12 0xb728d4fa in xmlFreeNodeList () from /usr/lib/libxml2.so.2
> #13 0xb728d4d6 in xmlFreeNodeList () from /usr/lib/libxml2.so.2
> #14 0xb728d4d6 in xmlFreeNodeList () from /usr/lib/libxml2.so.2
> #15 0xb728d4d6 in xmlFreeNodeList () from /usr/lib/libxml2.so.2
> #16 0xb728d2fe in xmlFreeDoc () from /usr/lib/libxml2.so.2
> #17 0xb73ed006 in __pyx_tp_dealloc_5etree__Document (o=0xb6e2848c)
>     at src/lxml/etree.c:10807
> #18 0xb73f01e1 in __pyx_tp_dealloc_5etree__Element (o=0xb6e32acc)
>     at src/lxml/etree.c:38083
> #19 0xb73b75ec in __pyx_tp_dealloc_5etree__ElementTree (o=0xb6e32a54)
>     at src/lxml/etree.c:38892
> #20 0xb73bc626 in __pyx_tp_dealloc_5etree__XSLTResultTree (o=0xb6e32a54)
>     at src/lxml/etree.c:47656

Hmm... I also heavily suspect the node-set function, but that would still not
make it a clear problem in libxml2, as lxml is at least a bit involved in the
function call (although not much).

Could you check if the problem goes away if you replace the respective copy-of
that creates the result set fragment in 'stuff' by something like for-each (or
whatever)?

Personally, I would report it to the libxml2 people. It may be easier for them
to track this down.

http://bugzilla.gnome.org/buglist.cgi?product=libxml2

Stefan