Thread: sysmalloc: Assertion SIGABRT crash

My program crashes throwing a SIGABRT message:

sysmalloc: Assertion `(old_top == initial_top (av) && old_size == 0) || ((unsigned long) (old_size) >= MINSIZE && prev_inuse (old_top) && ((unsigned long) old_end & (pagesize - 1)) == 0)' failed.

I'm really stuck, and I need to know what's causing the bug.
My code can be found at [C] #define _GNU_SOURCE #include <stdarg.h> #include <stdio.h> #include <stdlib - Pastebin.com

From the error message alone, it seems to me like you're manipulating the pointers passed by malloc before passing them to realloc or free.

I don't think you understand what calloc() does. It simply initializes all bytes to zero. I think you've mistaken it with alloca().

Anyway, why so many macros?

If lex is changed to a more simple pattern like "D AO IW D AO D OW", the program won't crash.

Originally Posted by codmach

I used many macros, because the program is complex.

I have no idea if that is true.

But, often the program is complex because it used many macros is true.

Tim S.

Code:

$ gcc -Wall -Wextra main.c
main.c: In function ‘expand’:
main.c:100:31: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
   memcpy(chunk, buffer, sizeof(buffer));
                               ^
main.c:106:35: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
     memcpy(buffer+1, chunk, sizeof(chunk)); 
                                   ^
main.c:121:35: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
       memcpy(buffer, chunk, sizeof(chunk));
                                   ^
main.c: In function ‘delete’:
main.c:141:31: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
   memcpy(chunk, buffer, sizeof(buffer));
                               ^

Take this little snippet for example.

Code:

error_t
expand(node_t *buffer,
       int pos)
{

  int n = (sizeof(buffer)/sizeof(node_t));
  
  if (buffer==NULL || pos<0 || pos>n)
    return ERRSYS;

  node_t *chunk = malloc(sizeof(buffer));

  memcpy(chunk, buffer, sizeof(buffer));

  buffer = realloc(NULL, sizeof(buffer) + sizeof(node_t));

1. sizeof(buffer) is just the size of the pointer, not the size of what it points to (a node).
2. you only succeed in making a copy of a small part of the structure.
3. your local assignment to buffer will NOT update the memory in the caller, say expand(inode->children, i+j);


> I used many macros, because the program is complex.
But if you only use each one once, then it looks like pointless complexity for the sake of it.
You would be better served by breaking up large functions into smaller functions, rather than trying to compress functions by using macros. ffnode() is a train wreck.


Finally, you need to get a clean bill of health from valgrind.

Code:

$ valgrind ./a.out
==3845== Memcheck, a memory error detector
==3845== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==3845== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==3845== Command: ./a.out
==3845== 
before IFVN vnlen calloc
vnlen=14
after IFVN vnlen calloc
==3845== Invalid write of size 1
==3845==    at 0x4C3106F: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x401127: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845==  Address 0x5203165 is 0 bytes after a block of size 5 alloc'd
==3845==    at 0x4C2FB55: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x4018EA: syntax (main.c:476)
==3845==    by 0x401A28: main (main.c:512)
==3845== 
before IFVN vnlen calloc
vnlen=14
after IFVN vnlen calloc
==3845== Invalid read of size 1
==3845==    at 0x4C31FB7: strcmp (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x400FD6: ffnode (main.c:371)
==3845==    by 0x40113A: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845==  Address 0x5203165 is 0 bytes after a block of size 5 alloc'd
==3845==    at 0x4C2FB55: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x4018EA: syntax (main.c:476)
==3845==    by 0x401A28: main (main.c:512)
==3845== 
==3845== Invalid read of size 1
==3845==    at 0x4C31FB7: strcmp (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x400E21: hval (main.c:245)
==3845==    by 0x401001: ffnode (main.c:371)
==3845==    by 0x40113A: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845==  Address 0x5203165 is 0 bytes after a block of size 5 alloc'd
==3845==    at 0x4C2FB55: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x4018EA: syntax (main.c:476)
==3845==    by 0x401A28: main (main.c:512)
==3845== 
==3845== Invalid read of size 1
==3845==    at 0x4C31FB7: strcmp (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x400E21: hval (main.c:245)
==3845==    by 0x401043: ffnode (main.c:371)
==3845==    by 0x40113A: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845==  Address 0x5203165 is 0 bytes after a block of size 5 alloc'd
==3845==    at 0x4C2FB55: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x4018EA: syntax (main.c:476)
==3845==    by 0x401A28: main (main.c:512)
==3845== 
==3845== Invalid write of size 8
==3845==    at 0x400CDF: tokenize (main.c:192)
==3845==    by 0x4010AA: ffnode (main.c:371)
==3845==    by 0x40113A: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845==  Address 0x5204640 is 0 bytes after a block of size 0 alloc'd
==3845==    at 0x4C2FB55: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x40108C: ffnode (main.c:371)
==3845==    by 0x40113A: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845== 
==3845== Invalid read of size 8
==3845==    at 0x400CFA: tokenize (main.c:193)
==3845==    by 0x4010AA: ffnode (main.c:371)
==3845==    by 0x40113A: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845==  Address 0x5204640 is 0 bytes after a block of size 0 alloc'd
==3845==    at 0x4C2FB55: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3845==    by 0x40108C: ffnode (main.c:371)
==3845==    by 0x40113A: ffnode (main.c:371)
==3845==    by 0x401922: syntax (main.c:479)
==3845==    by 0x401A28: main (main.c:512)
==3845== 
<< snipped volumes of more information, largely repeating the above >>

@Salem Okay, I updated my code(see [C] sysmalloc: Assertion SIGABRT crash - Pastebin.com), removing the macros. I also fixed the bug within delete() and expand() as you've suggested.
After running valgrind I get:

==19410== Invalid write of size 1
==19410== at 0x4C2F2B3: strcpy (vg_replace_strmem.c:458)
==19410== by 0x1095BF: ffnode (test.c:306)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51d6165 is 0 bytes after a block of size 5 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x109E06: syntax (test.c:440)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid read of size 1
==19410== at 0x4C301EB: strcmp (vg_replace_strmem.c:755)
==19410== by 0x10945B: ffnode (test.c:276)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51d6165 is 0 bytes after a block of size 5 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x109E06: syntax (test.c:440)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid read of size 1
==19410== at 0x4C301EB: strcmp (vg_replace_strmem.c:755)
==19410== by 0x1092BC: hval (test.c:243)
==19410== by 0x10948C: ffnode (test.c:279)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51d6165 is 0 bytes after a block of size 5 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x109E06: syntax (test.c:440)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid read of size 1
==19410== at 0x4C301EB: strcmp (vg_replace_strmem.c:755)
==19410== by 0x1092BC: hval (test.c:243)
==19410== by 0x1094D1: ffnode (test.c:282)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51d6165 is 0 bytes after a block of size 5 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x109E06: syntax (test.c:440)
==19410== by 0x109EDC: main (test.c:465)
==19410== Invalid write of size 8
==19410== at 0x109186: tokenize (test.c:190)
==19410== by 0x10953C: ffnode (test.c:293)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51d7200 is 0 bytes after a block of size 0 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x10951C: ffnode (test.c:292)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid read of size 8
==19410== at 0x1091A1: tokenize (test.c:191)
==19410== by 0x10953C: ffnode (test.c:293)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51d7200 is 0 bytes after a block of size 0 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x10951C: ffnode (test.c:292)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid write of size 8
==19410== at 0x108F5A: delete (test.c:139)
==19410== by 0x109B46: ffnode (test.c:368)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51d95a0 is 0 bytes after a block of size 0 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x108F4A: delete (test.c:137)
==19410== by 0x109B46: ffnode (test.c:368)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Argument 'size' of function malloc has a fishy (possibly negative) value: -40
==19410== at 0x4C2BC20: malloc (vg_replace_malloc.c:296)
==19410== by 0x4C2DFCF: realloc (vg_replace_malloc.c:692)
==19410== by 0x108F80: delete (test.c:141)
==19410== by 0x109B46: ffnode (test.c:368)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid write of size 8
==19410== at 0x109186: tokenize (test.c:190)
==19410== by 0x10953C: ffnode (test.c:293)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51da6a0 is 0 bytes after a block of size 0 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x10951C: ffnode (test.c:292)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid read of size 8
==19410== at 0x1091A1: tokenize (test.c:191)
==19410== by 0x10953C: ffnode (test.c:293)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51da6a0 is 0 bytes after a block of size 0 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x10951C: ffnode (test.c:292)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51dd390 is 0 bytes after a block of size 0 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x1096C7: ffnode (test.c:325)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid read of size 8
==19410== at 0x1091A1: tokenize (test.c:191)
==19410== by 0x1096E7: ffnode (test.c:326)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51dd390 is 0 bytes after a block of size 0 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x1096C7: ffnode (test.c:325)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid write of size 1
==19410== at 0x4C2F2A0: strcpy (vg_replace_strmem.c:458)
==19410== by 0x109D1D: ffnode (test.c:410)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)

==19410== Address 0x51de08a is 18 bytes after a block of size 8 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x109D03: ffnode (test.c:409)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid read of size 1
==19410== at 0x4C2F2A4: strcpy (vg_replace_strmem.c:458)
==19410== by 0x109D4A: ffnode (test.c:411)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51de078 is 0 bytes after a block of size 8 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x109D03: ffnode (test.c:409)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid write of size 4
==19410== at 0x1099C7: ffnode (test.c:352)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)

==19410== Address 0x51dd4a8 is 16 bytes after a block of size 40 alloc'd
==19410== at 0x4C2DD10: calloc (vg_replace_malloc.c:623)
==19410== by 0x109728: ffnode (test.c:330)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410==
==19410== Invalid write of size 8
==19410== at 0x109A05: ffnode (test.c:353)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109AD9: ffnode (test.c:359)
==19410== by 0x1095D8: ffnode (test.c:307)
==19410== by 0x109E3E: syntax (test.c:443)
==19410== by 0x109EDC: main (test.c:465)
==19410== Address 0x51dd4b8 is 24 bytes after a block of size 48 in arena "client"
==19410==
valgrind: m_mallocfree.c:304 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 112, hi = 85844160.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away. Please try that before reporting this as a bug.

Code:

main.c: In function ‘expand’:
main.c:100:31: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
   memcpy(chunk, buffer, sizeof(buffer));
                               ^
main.c:106:35: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
     memcpy(buffer+1, chunk, sizeof(chunk)); 
                                   ^
main.c:121:35: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
       memcpy(buffer, chunk, sizeof(chunk));
                                   ^
main.c: In function ‘delete’:
main.c:139:31: warning: argument to ‘sizeof’ in ‘memcpy’ call is the same pointer type ‘node_t * {aka struct node_t *}’ as the destination; expected ‘node_t {aka struct node_t}’ or an explicit length [-Wsizeof-pointer-memaccess]
   memcpy(chunk, buffer, sizeof(buffer));
                               ^
main.c: In function ‘cross’:
main.c:458:10: warning: format ‘%s’ expects argument of type ‘char *’, but argument 2 has type ‘void *’ [-Wformat=]
   printf("[inode=%s, symdex=%i]: {", inode->value, inode->symdex);
          ^
$

Until you fix these warnings, you're wasting your time running the code and staring at the wreckage.