Crash: malloc_consolidate(): unaligned fastbin chunk detected

[wgoetz]

Is there an existing issue for this?

• I checked and did not find my issue in the already reported ones

Describe the bug

On latest version release-5.3.0-620-g80cbf8a2a0:
switching back to lighttable crashes dt

Steps to reproduce

• startup
• edit an image
• go back to lighttable -> immediate crash

Expected behavior

no crash

Logfile | Screenshot | Screencast

NOK: release-5.3.0-620-g80cbf8a2a0

❯ /opt/darktable/bin/darktable

(darktable:118044): Gtk-WARNING **: 20:29:51.857: Theme directory places/symbolic of theme tuxedo-breeze-dark has no size field

(darktable:118044): GLib-GObject-CRITICAL **: 20:29:54.582: g_object_weak_unref: couldn't find weak ref 0x72a939f50830(0x6056afee7740)
malloc_consolidate(): unaligned fastbin chunk detected
Aborted

darktable on  master [?] via △ v3.31.6 took 4s

Commit

No response

Where did you obtain darktable from?

darktable.org / GitHub release

darktable version

release-5.3.0-620-g80cbf8a2a0

What OS are you using?

Linux

What is the version of your OS?

ID_LIKE="ubuntu debian"

Describe your system

❯ fastfetch -l none
goetz@wgtuxedo

OS: TUXEDO OS x86_64
Host: MS-7D76 (2.0)
Kernel: Linux 6.14.0-112033-tuxedo
Uptime: 2 hours, 26 mins
Packages: 3583 (dpkg), 38 (flatpak), 74 (brew)
Shell: bash 5.2.21
Display (DELL U2711): 2560x1440 in 27", 60 Hz [External]
DE: KDE Plasma 6.4.5
WM: KWin (Wayland)
WM Theme: Breeze
Theme: Breeze (TUXEDOLight) [Qt], Breeze [GTK2/3]
Icons: tuxedo-breeze-dark [Qt], tuxedo-breeze-dark [GTK2/3/4]
Font: Noto Sans (10pt) [Qt], Noto Sans (10pt) [GTK2/3/4]
Cursor: breeze (24px)
Terminal: konsole 25.4.3
CPU: AMD Ryzen 9 7900 (24) @ 5.49 GHz
GPU 1: AMD Radeon RX 7700 XT [Discrete]
GPU 2: AMD Raphael [Integrated]
Memory: 3.33 GiB / 61.91 GiB (5%)
Swap: 0 B / 8.00 GiB (0%)
Disk (/): 77.53 GiB / 907.45 GiB (9%) - ext4
Disk (/home): 397.96 GiB / 915.80 GiB (43%) - ext4
Disk (/home2): 2.72 TiB / 3.58 TiB (76%) - ext4
Local IP (enp14s0): 192.168.178.67/24
Locale: en_US.UTF-8

Are you using OpenCL GPU in darktable?

Yes

If yes, what is the GPU card and driver?

RustiCL

Please provide additional context if applicable. You can attach files too, but might need to rename to .txt or .zip

ok: release-5.3.0-611-g0abbac2484

[TurboGit]

Cannot reproduce. Maybe there is some specific steps to be done on the edit session in darkroom?

[ralfbrown]

The error message tells me that either a bad pointer is being passed to free(), or a memory allocation is being overrun and the admin data for that block or a neighboring one is being corrupted. Unfortunately, since libc is terminating the program before it can generate a backtrace, it's going to be very difficult to track down even the bad pointer alternative (a memory corruption can cause a crash in completely unrelated code....).

@wgoetz If you're comfortable using GDB, you could try running darktable under it with a breakpoint set on the function abort, then generate a backtrace when the breakpoint is reached.

> script -c "gdb darktable"
  ...
(gdb) b abort
(gdb) run
(gdb) bt

If the function freeis in the backtrace of the crashing thread, it's almost certainly a bad pointer. If not, it's probably a memory corruption.
On a modern high core-count CPU, the backtrace can be very long, so I've wrapped the GDB call inside script to log terminal output to the file "typescript".

[dterrahe]

Something seems to be fishy with the release of the event controllers introduced in #19523. In Gtk4 they are owned by the widget (which will destroy them when it is destroyed itself) but the backport to Gtk3 doesn't do that so one is supposed to take care of this via weak references (search gui\gtk.c for g_object_weak_ref). I lifted the relevant code from the gtk3-demo app and it seemed to work well when I initially tested it. Not sure what has changed since, but I now do see this depending on config directory. With a clean config it doesn't happen. So there may be something else that messes with the "weak references list"? (I have no idea).

[gi-man]

FYI - I'm seeing the same error on current master. It was pass midnight and I could not start to troubleshoot. I won't be back at the PC for at least 36hrs. Just doing to preferences to change opencl settings was enough to cause it.

Fedora 42 KDE wayland

[AndDiSa]

The same error for me:
darktable 5.3.0+621~g1c502ae15a
...
(darktable:13205): GLib-GObject-CRITICAL **: 12:18:37.589: g_object_weak_unref: couldn't find weak ref 0x7074f0afa830(0x55d452dea6a0)
malloc_consolidate(): unaligned fastbin chunk detected

when leaving darkroom going back and going back to lightroom. No editing is needed, switching between these two modes is sufficient.

Edit: this is the backtrace
`
#0 __GI_abort () at ./stdlib/abort.c:49
#1 0x00007ffff74297b6 in __libc_message_impl (fmt=fmt@entry=0x7ffff75ce8d7 "%s\n") at ../sysdeps/posix/libc_fatal.c:134

#2 0x00007ffff74a8ff5 in malloc_printerr (str=str@entry=0x7ffff75d18a0 "malloc_consolidate(): unaligned fastbin chunk detected") at ./malloc/malloc.c:5772

#3 0x00007ffff74a9d4c in malloc_consolidate (av=0x7ffff7603ac0 <main_arena>) at ./malloc/malloc.c:4846

#4 0x00007ffff74aada5 in _int_free_maybe_consolidate (av=0x7ffff7603ac0 <main_arena>, size=) at ./malloc/malloc.c:4779

#5 0x00007ffff74ab43a in _int_free (av=0x7ffff7603ac0 <main_arena>, p=, have_lock=) at ./malloc/malloc.c:4646

#6 0x00007ffff74addae in __GI___libc_free (mem=0x55555bfaf240) at ./malloc/malloc.c:3398

#7 0x00007ffff7222f23 in g_type_free_instance () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#8 0x00007ffff720d625 in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#9 0x00007ffff6b34045 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#10 0x00007ffff72ffc32 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0

#11 0x00007ffff730264b in g_hash_table_unref () at /lib/x86_64-linux-gnu/libglib-2.0.so.0

#12 0x00007ffff6b34ef9 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#13 0x00007ffff720d3fe in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#14 0x00007ffff6cae0f8 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#15 0x00007ffff720d61d in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#16 0x00007ffff6d6b315 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#17 0x00007ffff720d61d in g_object_unref () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#18 0x00007ffff6b17283 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#19 0x00007ffff71fe25c in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#20 0x00007ffff722df05 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#21 0x00007ffff721e591 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#22 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#23 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#24 0x00007ffff6d66332 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#25 0x00007ffff720d6c4 in g_object_run_dispose () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#26 0x00007ffff6b17283 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#27 0x00007ffff71fe25c in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#28 0x00007ffff722df05 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#29 0x00007ffff721e591 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#30 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#31 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#32 0x00007ffff6d66332 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#33 0x00007ffff720d6c4 in g_object_run_dispose () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#34 0x00007ffff6ac8158 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#35 0x00007ffff6b17283 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#36 0x00007ffff71fe25c in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#37 0x00007ffff722df05 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#38 0x00007ffff721e591 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#39 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#40 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#41 0x00007ffff6d66332 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#42 0x00007ffff720d6c4 in g_object_run_dispose () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#43 0x00007ffff6b17283 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#44 0x00007ffff71fe25c in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#45 0x00007ffff722df05 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#46 0x00007ffff721e591 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#47 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#48 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#49 0x00007ffff6d66332 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#50 0x00007ffff720d6c4 in g_object_run_dispose () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#51 0x00007ffff6bb29ed in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#52 0x00007ffff6b17283 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#53 0x00007ffff71fe25c in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#54 0x00007ffff722df05 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#55 0x00007ffff721e591 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#56 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#57 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#58 0x00007ffff6d66332 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#59 0x00007ffff720d6c4 in g_object_run_dispose () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#60 0x00007ffff6b17283 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#61 0x00007ffff71fe25c in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#62 0x00007ffff722df05 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#63 0x00007ffff721e591 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#64 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#65 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#66 0x00007ffff6d66332 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#67 0x00007ffff720d6c4 in g_object_run_dispose () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#68 0x00007ffff6ac8158 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#69 0x00007ffff6b17283 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#70 0x00007ffff71fe2fa in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#71 0x00007ffff722df05 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#72 0x00007ffff721e591 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#73 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#74 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#75 0x00007ffff6d66332 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#76 0x00007ffff720d6c4 in g_object_run_dispose () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#77 0x00007ffff7a4e1dd in dt_iop_gui_cleanup_module (module=module@entry=0x555558f61120) at /home/ds/git/darktable/src/develop/imageop.c:2219

#78 0x00007fffec62529a in leave (self=) at /home/ds/git/darktable/src/views/darkroom.c:3225

#79 0x00007ffff7b5e527 in dt_view_manager_switch_by_view (vm=0x5555557ce340, nv=nv@entry=0x555555750f80) at /home/ds/git/darktable/src/views/view.c:318

#80 0x00007ffff79de916 in _dt_ctl_switch_mode_to_by_view (user_data=0x555555750f80) at /home/ds/git/darktable/src/control/control.c:526

#81 0x00007ffff7314d3d in g_main_context_invoke_full () at /lib/x86_64-linux-gnu/libglib-2.0.so.0

#82 0x00007fff1133aa1c in _switch_view (view=) at /home/ds/git/darktable/src/libs/tools/viewswitcher.c:270

#83 _lib_viewswitcher_button_press_callback (w=, ev=, view=) at /home/ds/git/darktable/src/libs/tools/viewswitcher.c:277

#84 0x00007ffff6a9d0a4 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#85 0x00007ffff71fe2fa in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#86 0x00007ffff722d90c in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#87 0x00007ffff721def2 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#88 0x00007ffff721e7c1 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#89 0x00007ffff721e883 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

#90 0x00007ffff6d66bf4 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#91 0x00007ffff6c03390 in ??? () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#92 0x00007ffff6c03f2a in gtk_main_do_event () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#93 0x00007ffff693f407 in ??? () at /lib/x86_64-linux-gnu/libgdk-3.so.0

#94 0x00007ffff6998e2e in ??? () at /lib/x86_64-linux-gnu/libgdk-3.so.0

#95 0x00007ffff73145c5 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0

#96 0x00007ffff7373737 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0

#97 0x00007ffff7314f87 in g_main_loop_run () at /lib/x86_64-linux-gnu/libglib-2.0.so.0

#98 0x00007ffff6bfebc5 in gtk_main () at /lib/x86_64-linux-gnu/libgtk-3.so.0

#99 0x00007ffff7b04380 in dt_gui_gtk_run (gui=) at /home/ds/git/darktable/src/gui/gtk.c:1594

#100 0x000055555555530c in main (argc=, argv=) at /home/ds/git/darktable/src/main.c:158
`

[TurboGit]

when leaving darkroom going back and going back to lightroom. No editing is needed, switching between these two modes is sufficient.

Not really sufficient as I cannot reproduce and I have merged the corresponding PR after quite some testing. That's puzzling!

[dterrahe]

I'm looking into it. Running with asan doesn't seem to help; then it simply doesn't crash anymore (but with --disable-opencl; asan under wsl2 doesn't allow opencl. So it could be that there's an interaction there). I still do get "couldn't find weak ref" so digging further.

[gi-man]

@AndDiSa Can you describe your system? Wayland ? KDE?

[AndDiSa]

Ubuntu 24.04, Xorg, Gnome
AMD Ryzen 9, and Nvidia RTX 3060.

Do you need more information?

Btw.: I just switched to Wayland but it's still the same behaviour.

Edit: I did some further analysis and could identify commit b39d03b as culprit

[dterrahe]

There's some interaction between the g_object_weak_ref in gui\gtk.c and g_set_weak_pointer(&ac->target, widget); in accelerators.c that I don't understand. If I remove either one, I don't get "couldn't find weak ref" or crash. But that would give either a memory leak or possible crashes with shortcuts to multi-instance modules. If anybody with any gobjects knowledge has ideas...

I chased a red-herring where lens.cc event controllers got destroyed prematurely, but turns out the lens parameter controllers get regularly destroyed/recreated there (instead of just being emptied and refilled). Also means they can't have shortcuts so would be nice to fix, but not in any way related to this problem.

Running out of ideas for today. May need to sleep on this. Since asan doesn't flag any memory problems; does anybody know of other tools to chase down double frees etc? (that don't require a lot of setup)

[tomaszg7]

I'm also seeing this crash consistently in the current head. My setup is: Gentoo, Wayland, Sway, amdgpu drivers.

I'll try getting some usable backtrace later, but first I need to get some photos ready ;)

BTW. I also saw darktable hang once today, needing -9. Not sure if this is related.

[vtyrtov]

The issue reproducibly occurs in the following scenario:

1. Open any RAW file where the Sigmoid module was previously enabled.
2. Disable Sigmoid, enable Agx.
3. Expand the Agx module; do not change any settings.
4. Press 'l' to switch to lighttable.

Darktable crashes. Console output:

(darktable:2284947): GLib-GObject-CRITICAL **: 19:25:13.388: g_object_weak_unref: couldn't find weak ref 0x75a49c950830(0x5fa94e02e910)
malloc_consolidate(): unaligned fastbin chunk detected

The issue occurs both with OpenCL (rustiCL) enabled and disabled.

Configuration: Ubuntu 24.04.3 LTS, Wayland, AMD GPU Radeon™ 780M
darktable 5.3.0+633~gb97aac0569-dirty

UPDATE: Moreover, simply opening and closing the settings of any module (Agx, Sigmoid, etc) and pressing 'l' will cause a crash.

[dterrahe]

I think I've narrowed it down to
dt_gui_connect_motion(notebook, _notebook_motion_notify_callback, NULL, NULL, notebook);
in gui\gtk.c.

Could everybody please confirm if putting if(0) in front of that line solves the crash?

Then I can try to figure out the why...

[tomaszg7]

2. Disable Sigmoid, enable Agx.

I confirm that in my case it was related to having default profile with Sigmoid. When I switched to Agx, the crash seems to have gone away.

[vtyrtov]

Moreover, simply opening and closing the settings of any module (Agx, Sigmoid, etc) and pressing 'l' will cause a crash.