Skip to content

nullptr in abstraction::ValueHolder<object::Object>::getActualType) while using ValueHolder in evalAlgorithm helper as parameter for the second time

We have found that the our webui code crashes with segfault.

I have simplified the code to the following MWE:

There are two functions, test_full which fully follows the ALT core calls made by our code that crashes and test_mwe which makes less algorithm evaluations but crashes in the same manner.

If you uncomment the highlighted line in test_mwe the code does not segfault. Is the function call doing something to the ValueHolder instance?

#include <abstraction/TemporariesHolder.h>
#include <abstraction/ValueHolder.hpp>
#include <ast/command/EvalCommand.h>
#include <common/EvalHelper.h>
#include <ext/exception>
#include <global/GlobalData.h>
#include <iostream>

void test_full()
{
    cli::Environment environment;

    cli::EvalCommand registered("function mojeFunkce ( auto $mojepromenna ) returning auto begin\nreturn $mojepromenna;\nend");
    registered.run(environment);

    auto input = std::make_shared<abstraction::ValueHolder<std::string>>(std::string {"neco"}, true);

    auto compose3 = abstraction::EvalHelper::evalAlgorithm(environment, "string::Compose", {}, {input}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);
    auto compose1 = abstraction::EvalHelper::evalAlgorithm(environment, "string::Compose", {}, {input}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);
    auto mojeFunk = abstraction::EvalHelper::evalAlgorithm(environment, "mojeFunkce", {}, {compose1}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);
    auto compose5 = abstraction::EvalHelper::evalAlgorithm(environment, "string::Compose", {}, {mojeFunk}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);
    auto compose4 = abstraction::EvalHelper::evalAlgorithm(environment, "string::Compose", {}, {mojeFunk}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);
    auto compose2 = abstraction::EvalHelper::evalAlgorithm(environment, "string::Compose", {}, {compose1}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);
}

void test_mwe()
{
    cli::Environment environment;

    std::string foo("function mojeFunkce ( auto $mojepromenna ) returning auto begin\nreturn $mojepromenna;\nend");
    environment.execute(std::make_shared<cli::StringLineInterface>(cli::StringLineInterface(foo)));

    auto input = std::make_shared<abstraction::ValueHolder<std::string>>(std::string {"neco"}, true);

    auto compose1 = abstraction::EvalHelper::evalAlgorithm(environment, "string::Compose", {}, {input}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);

    // commenting next line causes the code NOT to crash
    auto mojeFunk = abstraction::EvalHelper::evalAlgorithm(environment, "mojeFunkce", {}, {compose1}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);

    // This is enough to crash, you don't have to call the following evalAlgorithm
    // auto X = compose1->getActualType();
    auto compose2 = abstraction::EvalHelper::evalAlgorithm(environment, "string::Compose", {}, {compose1}, abstraction::AlgorithmCategories::AlgorithmCategory::NONE);
}

int main()
{
    try {
        /* test_full(); */
        test_mwe();
    } catch (...) {
        return alib::ExceptionHandler::handle(common::Streams::err);
    }
}
$ bear -- g++ -g -fsanitize=address -std=c++20 -I/usr/include/algorithms-library  -lalib2abstraction -lalib2std -lalib2common -lalib2cli -lalib2str test.cpp &&  ./a.out 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1064921==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f899647f051 bp 0x607000010b28 sp 0x7ffe769b79b0 T0)
==1064921==The signal is caused by a READ memory access.
==1064921==Hint: address points to the zero page.
    #0 0x7f899647f051 in object::Object::getId() const (/usr/lib/libalib2abstraction.so.0+0x48051)
    #1 0x7f899647f17c in core::type_util<object::Object>::type(object::Object const&) (/usr/lib/libalib2abstraction.so.0+0x4817c)
    #2 0x7f8996468041 in abstraction::ValueHolder<object::Object>::getActualType() const (/usr/lib/libalib2abstraction.so.0+0x31041)
    #3 0x7f899646ff46 in abstraction::EvalHelper::evalAlgorithm(abstraction::TemporariesHolder&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, ext::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, ext::vector<std::shared_ptr<abstraction::Value>, std::allocator<std::shared_ptr<abstraction::Value> > > const&, abstraction::AlgorithmCategories::AlgorithmCategory) (/usr/lib/libalib2abstraction.so.0+0x38f46)
    #4 0x55c9d1162754 in test_mwe() /home/tomas/tmp/x/test.cpp:42
    #5 0x55c9d1162f10 in main /home/tomas/tmp/x/test.cpp:49
    #6 0x7f8995a2330f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
    #7 0x7f8995a233c0 in __libc_start_main@GLIBC_2.2.5 (/usr/lib/libc.so.6+0x2d3c0)
    #8 0x55c9d115f494 in _start (/home/tomas/tmp/x/a.out+0x8494)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/lib/libalib2abstraction.so.0+0x48051) in object::Object::getId() const
==1064921==ABORTING
Edited by Tomáš Pecka
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information