fission demo fails on debian unstable from time to time

[dankamongmen]

I'm running notcurses-demo as packaged in 2.3.12+dfsg.0-1 in Debian Unstable, on Kitty 0.22.0. From time to time, I get a failure in the fission demo. It's not a crash or anything, just an error.

[dankamongmen]

Note that with the DFSG build, we're not running all the demos, which might or might not have something to do with why we never seem to see this when doing normal testing.

[dankamongmen]

while notcurses-demo wvlsf -d0 ; do true ; done reproduces the failure reasonably quickly.

[dankamongmen]

hrmm. it's always happening at 0 frames, interesting.

[dankamongmen]

we're erroring out here:

            if(ncplane_putc_yx(n, usey - y, usex - x, &c) < 0){                                                                         
              // allow a fail if we were printing a wide char to the                                                                    
              // last column of our plane                                                                                               
              if(!nccell_double_wide_p(&c) || usex + 1 < x + newx){                                                                     
                nccell_release(n, &c);                                                                                                  
                goto err;                                                                                                               
              }                                                                                                                         
            }       

[dankamongmen]

width is 1 on the above, possibly a space.

[dankamongmen]

width is 1 on the above, possibly a space.

nope it's a '\0'

[dankamongmen]

hrmmm, perhaps not!

doublewide CHECK! 4 0 6 2 [നാം] width: 3 0x01000000
PUTC: 3 cols [നാം]
doublewide bad 4 0 6 2 [] width: 1 0x00000000

[dankamongmen]

and indeed, a 3-wide cannot be put down there. but we ought not be blowing the check afterwards in this case!

[dankamongmen]

ahhh here we go

doublewide CHECK! 4 4 5 6 [ကြေ] width: 3 0x010000ce
PUTC: 3 cols [ကြေ]
doublewide bad 4 4 5 6 [ကြေ] width: 3 0x010000ce

[dankamongmen]

yeah, just need to be checking for nccell_cols(&c) - 1 vs simple 1 in the postcheck. resolved. but now hitting an invalid pointer to free() that i think i've seen before also.

[dankamongmen]

this probably has something to do with it:

==1054287== Command: ./notcurses-demo -p ../data/ wf -d0
==1054287== 
==1054287== Invalid read of size 4
==1054287==    at 0x4A19210: cell_extended_p (egcpool.h:280)
==1054287==    by 0x4A19210: pool_release (internal.h:829)
==1054287==    by 0x4A19210: nccell_release (render.c:77)
==1054287==    by 0x4A0C3EF: nccell_obliterate (notcurses.c:1531)
==1054287==    by 0x4A0C3EF: ncplane_put (notcurses.c:1656)
==1054287==    by 0x4A0C6FA: ncplane_putc_yx (notcurses.c:1669)
==1054287==    by 0x1147F3: fission_demo (fission.c:171)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287==  Address 0xfab7c70 is 0 bytes after a block of size 400 alloc'd
==1054287==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==1054287==    by 0x4A0AB64: ncplane_resize_internal (notcurses.c:725)
==1054287==    by 0x1148CC: ncplane_resize_simple (notcurses.h:1481)
==1054287==    by 0x1148CC: fission_demo (fission.c:155)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287== 
==1054287== Invalid write of size 4
==1054287==    at 0x4A19222: pool_release (internal.h:832)
==1054287==    by 0x4A19222: nccell_release (render.c:77)
==1054287==    by 0x4A0C3EF: nccell_obliterate (notcurses.c:1531)
==1054287==    by 0x4A0C3EF: ncplane_put (notcurses.c:1656)
==1054287==    by 0x4A0C6FA: ncplane_putc_yx (notcurses.c:1669)
==1054287==    by 0x1147F3: fission_demo (fission.c:171)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287==  Address 0xfab7c70 is 0 bytes after a block of size 400 alloc'd
==1054287==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==1054287==    by 0x4A0AB64: ncplane_resize_internal (notcurses.c:725)
==1054287==    by 0x1148CC: ncplane_resize_simple (notcurses.h:1481)
==1054287==    by 0x1148CC: fission_demo (fission.c:155)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287== 
==1054287== Invalid write of size 1
==1054287==    at 0x4A19228: pool_release (internal.h:833)
==1054287==    by 0x4A19228: nccell_release (render.c:77)
==1054287==    by 0x4A0C3EF: nccell_obliterate (notcurses.c:1531)
==1054287==    by 0x4A0C3EF: ncplane_put (notcurses.c:1656)
==1054287==    by 0x4A0C6FA: ncplane_putc_yx (notcurses.c:1669)
==1054287==    by 0x1147F3: fission_demo (fission.c:171)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287==  Address 0xfab7c75 is 5 bytes after a block of size 400 alloc'd
==1054287==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==1054287==    by 0x4A0AB64: ncplane_resize_internal (notcurses.c:725)
==1054287==    by 0x1148CC: ncplane_resize_simple (notcurses.h:1481)
==1054287==    by 0x1148CC: fission_demo (fission.c:155)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287== 
==1054287== Invalid write of size 8
==1054287==    at 0x4A0C3F4: memset (string_fortified.h:71)
==1054287==    by 0x4A0C3F4: nccell_init (notcurses.h:653)
==1054287==    by 0x4A0C3F4: nccell_obliterate (notcurses.c:1532)
==1054287==    by 0x4A0C3F4: ncplane_put (notcurses.c:1656)
==1054287==    by 0x4A0C6FA: ncplane_putc_yx (notcurses.c:1669)
==1054287==    by 0x1147F3: fission_demo (fission.c:171)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287==  Address 0xfab7c70 is 0 bytes after a block of size 400 alloc'd
==1054287==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==1054287==    by 0x4A0AB64: ncplane_resize_internal (notcurses.c:725)
==1054287==    by 0x1148CC: ncplane_resize_simple (notcurses.h:1481)
==1054287==    by 0x1148CC: fission_demo (fission.c:155)
==1054287==    by 0x11044E: ext_demos (demo.c:225)
==1054287==    by 0x11044E: main (demo.c:575)
==1054287== 

[dankamongmen]

let's make a new issue regarding this valgrind output, and close this one