Double free when built against Mapnik 3.x

[springmeyer]

Happens every 3rd or so time when running make test and built against Mapnik master 3.x.

*** glibc detected *** node: free(): invalid pointer: 0x00007fff9846cf38 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7eb96)[0x2ae7a53c9b96]
/home/ubuntu/projects/mapnik-packaging/osx/out/build-cpp11-libstdcpp-gcc-x86_64-linux-mapnik/usr/local/lib/libmapnik.so(_ZN6mapnik17memory_datasourceD2Ev+0x1bd)[0x2ae7a5f8ef6d]
/home/ubuntu/projects/node-mapnik/lib/binding/mapnik.node(_ZN16MemoryDatasourceD1Ev+0xba)[0x2ae7a57a33fa]
/home/ubuntu/projects/node-mapnik/lib/binding/mapnik.node(_ZN16MemoryDatasourceD0Ev+0x11)[0x2ae7a57a3461]
node(_ZN4node10ObjectWrap12WeakCallbackEN2v810PersistentINS1_5ValueEEEPv+0x5c)[0x811acc]
node(_ZN2v88internal13GlobalHandles31PostGarbageCollectionProcessingENS0_16GarbageCollectorE+0x1de)[0x61722e]
node(_ZN2v88internal4Heap24PerformGarbageCollectionENS0_16GarbageCollectorEPNS0_8GCTracerE+0x205)[0x633345]
node(_ZN2v88internal4Heap14CollectGarbageENS0_15AllocationSpaceENS0_16GarbageCollectorEPKcS5_+0x154)[0x6338f4]
node(_ZN2v88internal4Heap14CollectGarbageENS0_15AllocationSpaceEPKc+0x42)[0x63bd92]
[0x213e40b063da]

[springmeyer]

(gdb) bt
#0  0x00002b146713d696 in MemoryDatasource::featureset(v8::Arguments const&) () from /home/ubuntu/projects/node-mapnik/lib/binding/mapnik.node
#1  0x00000000005c6a57 in v8::internal::Builtin_HandleApiCall(v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>, v8::internal::Isolate*) ()
#2  0x000026ee03406362 in ?? ()
#3  0x000026ee034270d5 in ?? ()

[springmeyer]

Build in debug node (node-mapnik):

(gdb) bt
#0  0x00002b146713d696 in GridView::encodeSync(v8::Arguments const&) () at /usr/include/c++/4.8/bits/basic_string.h:249
Cannot access memory at address 0x148

[springmeyer]

in release mode I can trigger just by doing:

$ ./node_modules/.bin/_mocha test/feature.test.js 

  ․․Segmentation fault (core dumped)

[springmeyer]

hmm, starting to this is may be the same as #216 and if so I'll need to take a look at naturalatlas/node-gdal#15 for ideas to solve.

[springmeyer]

Working to reduce a testcase is proving hard. Appears that I'm just pushing crashes around. Crashes occur in different places depend on whether build in release or debug. Backtraces are all pretty unhelpful. I'm starting to suspect memory corruption is causing various false leads. Current hunch is that the Nan merge may be related so I'm working on created a branch that works against Mapnik 3.x that does not have the nan/node v0.11.x changes.

[springmeyer]

still crashes with branch made from 1.4.7 tag which is pre the Nan merge #256 (https://github.com/mapnik/node-mapnik/tree/pre-nan)

[springmeyer]

okay, got it! Crashes vanish in pre-nan branch and master with this patch:

diff --git a/src/mapnik_memory_datasource.cpp b/src/mapnik_memory_datasource.cpp
index 1d4923d..4d8ba07 100644
--- a/src/mapnik_memory_datasource.cpp
+++ b/src/mapnik_memory_datasource.cpp
@@ -90,6 +90,7 @@ NAN_METHOD(MemoryDatasource::New)
         params[TOSTR(name)] = TOSTR(value);
         i++;
     }
+    params["type"] = "memory";

     //memory_datasource cache;
     MemoryDatasource* d = new MemoryDatasource();

This seems to indicate *params.get<std::string>("type") right here was failing silently and causing corrupted memory?

[springmeyer]

all travis tests are now passing as well: https://travis-ci.org/mapnik/node-mapnik/builds/28453430