Ardour crashes upon OSC connect

Ardour 8.12.0 (prebuilt from site), Fedora 42.

I tried TouchOSC (1.4.0.230 from hexler.net) to control Ardour.

In Ardour I have configured OSC (ports 3819/8009). In TouchOSC I have configured OSC (localhost:3819, return port 8009, UDP).

As soon as I connect from TouchOSC Ardour crashes with

malloc(): unaligned tcache chunk detected
Got SIGTERM, quitting.
Abort (core dumped)

Did I misconfigure?

FWIW: My own (rpm) built Ardour shows the same problem.

I can’t confirm this issue here…
I’m using the GeekosDaw package of ardour 8.12 on openSUSE Tumbleweed, TouchOSC 1.4.0.230 and the Mixbus TTC-3 TouchOSC layout I got from here (IIRC), with the same port numbers you mention (8319 for send, tried default 8000 or 8009 for feedback but I’m not sure what the effect is, I see the buttons flashing but no other feedback in the touchosc layout).

Whether you did or not, core dump is a programming error. Misconfigure should at most cause an error message, so there is some Ardour problem to investigate.

I’ve downloaded the nightly debug build and it also crashes.

Debugging info attached (I hope I did it ok).

Ardour debug log

Some sort of deep internal memory corruption. LIkely we need to get you an ASAN (Address Sanitizer)-enabled build to debug further. That’s not currently trivial for us to do. Do you happen to know/understand what OSC message TouchOSC would have been sending when the crash happens?

Is this useful?

TouchOSC log

@paul
Apologies if my reading is unhelpful. It’s been a minute since I did any debugging of multi-threaded C++, but the log @sciurius uploaded has only one thread which looks to be involved in the coredump:

Thread 63 (Thread 0x7fff49bfa6c0 (LWP 1401852) "UI:Open Sound C"):
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007ffff32811e3 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#2  0x00007ffff3227afe in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007ffff320f6d0 in __GI_abort () at abort.c:73
#4  0x00007ffff32106f3 in __libc_message_impl (fmt=fmt@entry=0x7ffff33c248c "%s\n") at ../sysdeps/posix/libc_fatal.c:134
#5  0x00007ffff328b275 in malloc_printerr (str=str@entry=0x7ffff33c5b98 "malloc(): unaligned tcache chunk detected") at malloc.c:5829
#6  0x00007ffff329149c in tcache_get_n (tc_idx=<optimized out>, ep=<optimized out>) at malloc.c:3185
#7  tcache_get (tc_idx=<optimized out>) at malloc.c:3201
#8  tcache_try_malloc (bytes=8, memptr=<synthetic pointer>) at malloc.c:3364
#9  __libc_calloc (n=<optimized out>, elem_size=<optimized out>) at malloc.c:3795
#10 0x00007ffff4ac5663 in lo_message_new () from /opt/Ardour-9.0.pre0.1233-dbg/lib/liblo.so.7
#11 0x00007fffe2a21013 in ArdourSurface::OSC::float_message_with_id (this=0x55555b46dbb0, path="/select/send_fader", ssid=8, value=0, in_line=true, addr=0x7fff3c05b1a0) at ../libs/surfaces/osc/osc.cc:6634
#12 0x00007fffe2a94ecb in OSCSelectObserver::send_gain (this=0x7fff3c05afc0, id=8, controllable=std::shared_ptr<PBD::Controllable> (empty) = {...}) at ../libs/surfaces/osc/osc_select_observer.cc:1043
#13 0x00007fffe2a8bf64 in OSCSelectObserver::send_init (this=0x7fff3c05afc0) at ../libs/surfaces/osc/osc_select_observer.cc:400
#14 0x00007fffe2a8baf6 in OSCSelectObserver::renew_sends (this=0x7fff3c05afc0) at ../libs/surfaces/osc/osc_select_observer.cc:370
#15 0x00007fffe2a88c43 in OSCSelectObserver::refresh_strip (this=0x7fff3c05afc0, new_strip=std::shared_ptr<ARDOUR::Stripable> (use count 113, weak count 13) = {...}, s_nsends=0, gm=1, force=true) at ../libs/surfaces/osc/osc_select_observer.cc:264
#16 0x00007fffe2a856a0 in OSCSelectObserver::OSCSelectObserver (this=0x7fff3c05afc0, o=..., s=..., su=0x7fff3c05ad60) at ../libs/surfaces/osc/osc_select_observer.cc:82
#17 0x00007fffe2a136a8 in ArdourSurface::OSC::_strip_select2 (this=0x55555b46dbb0, s=std::shared_ptr<ARDOUR::Stripable> (use count 113, weak count 13) = {...}, sur=0x7fff3c05ad60, addr=0x7fff3c05a7f0) at ../libs/surfaces/osc/osc.cc:4789
#18 0x00007fffe2a03413 in ArdourSurface::OSC::get_surface (this=0x55555b46dbb0, addr=0x7fff3c05a7f0, quiet=true) at ../libs/surfaces/osc/osc.cc:2106
#19 0x00007fffe29fc6ab in ArdourSurface::OSC::catchall (this=0x55555b46dbb0, path=0x7fff3c05a5e0 "/set_surface/feedback", types=0x7fff3c001681 "f", argv=0x7fff3c05a6c0, argc=1, msg=0x7fff3c05a580) at ../libs/surfaces/osc/osc.cc:773
#20 0x00007fffe29fc626 in ArdourSurface::OSC::_catchall (path=0x7fff3c05a5e0 "/set_surface/feedback", types=0x7fff3c001681 "f", argv=0x7fff3c05a6c0, argc=1, msg=0x7fff3c05a580, user_data=0x55555b46dbb0) at ../libs/surfaces/osc/osc.cc:763
#21 0x00007ffff4ac7f39 in ?? () from /opt/Ardour-9.0.pre0.1233-dbg/lib/liblo.so.7
#22 0x00007ffff4ac9b1c in ?? () from /opt/Ardour-9.0.pre0.1233-dbg/lib/liblo.so.7
#23 0x00007ffff4ac9e8e in lo_server_recv () from /opt/Ardour-9.0.pre0.1233-dbg/lib/liblo.so.7
#24 0x00007fffe29fbf29 in ArdourSurface::OSC::osc_input_handler (this=0x55555b46dbb0, ioc=Glib::IO_IN, srv=0x55555bd793b0) at ../libs/surfaces/osc/osc.cc:641
#25 0x00007fffe2a6018d in sigc::bound_mem_functor2<bool, ArdourSurface::OSC, Glib::IOCondition, void*>::operator() (this=0x7fff3c001580, _A_a1=@0x7fff49bf984c: Glib::IO_IN, _A_a2=@0x7fff3c0015a0: 0x55555bd793b0) at ../../gtk/inst/include/sigc++-2.0/sigc++/functors/mem_fun.h:2143
#26 0x00007fffe2a5c3bb in sigc::adaptor_functor<sigc::bound_mem_functor2<bool, ArdourSurface::OSC, Glib::IOCondition, void*> >::operator()<Glib::IOCondition const&, void*&> (this=0x7fff3c001578, _A_arg1=@0x7fff49bf984c: Glib::IO_IN, _A_arg2=@0x7fff3c0015a0: 0x55555bd793b0) at ../../gtk/inst/include/sigc++-2.0/sigc++/adaptors/adaptor_trait.h:108
#27 0x00007fffe2a560bb in sigc::bind_functor<-1, sigc::bound_mem_functor2<bool, ArdourSurface::OSC, Glib::IOCondition, void*>, void*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>::operator()<Glib::IOCondition const&> (this=0x7fff3c001570, _A_arg1=@0x7fff49bf984c: Glib::IO_IN) at ../../gtk/inst/include/sigc++-2.0/sigc++/adaptors/bind.h:1136
#28 0x00007fffe2a4e6e2 in sigc::internal::slot_call1<sigc::bind_functor<-1, sigc::bound_mem_functor2<bool, ArdourSurface::OSC, Glib::IOCondition, void*>, void*, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil, sigc::nil>, bool, Glib::IOCondition>::call_it (rep=0x7fff3c001540, a_1=@0x7fff49bf984c: Glib::IO_IN) at ../../gtk/inst/include/sigc++-2.0/sigc++/functors/slot.h:170
#29 0x00007ffff454f4ac in Glib::IOSource::dispatch(sigc::slot_base*) () from /opt/Ardour-9.0.pre0.1233-dbg/lib/libglibmm-2.4.so.1
#30 0x00007ffff454f63f in Glib::Source::dispatch_vfunc(_GSource*, int (*)(void*), void*) () from /opt/Ardour-9.0.pre0.1233-dbg/lib/libglibmm-2.4.so.1
#31 0x00007ffff3efd94f in g_main_context_dispatch () from /opt/Ardour-9.0.pre0.1233-dbg/lib/libglib-2.0.so.0
#32 0x00007ffff3efdcf8 in ?? () from /opt/Ardour-9.0.pre0.1233-dbg/lib/libglib-2.0.so.0
#33 0x00007ffff3efe023 in g_main_loop_run () from /opt/Ardour-9.0.pre0.1233-dbg/lib/libglib-2.0.so.0
#34 0x00007ffff4d89b33 in BaseUI::main_thread (this=0x55555b46dda8) at ../libs/pbd/base_ui.cc:101
#35 0x00007ffff4d8e4d3 in std::__invoke_impl<void, void (BaseUI::*&)(), BaseUI*&> (__f=@0x55555a75b930: (void (BaseUI::*)(BaseUI * const)) 0x7ffff4d8992a <BaseUI::main_thread()>, __t=@0x55555a75b940: 0x55555b46dda8) at /usr/include/c++/10/bits/invoke.h:73
#36 0x00007ffff4d8e2f7 in std::__invoke<void (BaseUI::*&)(), BaseUI*&> (__fn=@0x55555a75b930: (void (BaseUI::*)(BaseUI * const)) 0x7ffff4d8992a <BaseUI::main_thread()>) at /usr/include/c++/10/bits/invoke.h:95
#37 0x00007ffff4d8e15c in std::_Bind<void (BaseUI::*(BaseUI*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) (this=0x55555a75b930, __args=...) at /usr/include/c++/10/functional:416
#38 0x00007ffff4d8de3c in std::_Bind<void (BaseUI::*(BaseUI*))()>::operator()<, void>() (this=0x55555a75b930) at /usr/include/c++/10/functional:499
#39 0x00007ffff4d8d8b4 in std::__invoke_impl<void, std::_Bind<void (BaseUI::*(BaseUI*))()>&>(std::__invoke_other, std::_Bind<void (BaseUI::*(BaseUI*))()>&) (__f=...) at /usr/include/c++/10/bits/invoke.h:60
#40 0x00007ffff4d8d044 in std::__invoke_r<void, std::_Bind<void (BaseUI::*(BaseUI*))()>&>(std::_Bind<void (BaseUI::*(BaseUI*))()>&) (__fn=...) at /usr/include/c++/10/bits/invoke.h:110
#41 0x00007ffff4d8c649 in std::_Function_handler<void (), std::_Bind<void (BaseUI::*(BaseUI*))()> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/10/bits/std_function.h:291
#42 0x0000555555d3cd96 in std::function<void()>::operator() (this=0x55555b420fe8) at /usr/include/c++/10/bits/std_function.h:622
#43 0x00007ffff4dc9ee1 in PBD::Thread::_run (arg=0x55555b420fc0) at ../libs/pbd/pthread_utils.cc:586
#44 0x00007ffff327f1d4 in start_thread (arg=<optimized out>) at pthread_create.c:448
#45 0x00007ffff3301cec in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

The bit in the OSC code which seems to trigger it is this stack frame:

#11 0x00007fffe2a21013 in ArdourSurface::OSC::float_message_with_id (this=0x55555b46dbb0, path="/select/send_fader", ssid=8, value=0, in_line=true, addr=0x7fff3c05b1a0) at ../libs/surfaces/osc/osc.cc:6634

Everything above that is low-level malloc stuff plus the abort.

Given the error reported (malloc(): unaligned tcache chunk detected), this smells like the downstream damage of a double free somewhere, or else a pointer into an element of a subsequently-realloced buffer.

Yeah, i read it all already. It really needs an ASAN-enabled build, but we don’t distribute those.

Probably not relevant but does this change anything?:-

1 Like