A crash when a TProfile with kCanRebin bit set is copied

ROOT
1

Hello,

compiling and running the following method:

#include “TProfile.h”
#include “TH1.h”
#include

TProfile rebinned_test() {

TProfile prof(“n”,“n”,10,0,10);
prof.SetBit(TH1::kCanRebin);

prof.Fill(1,1);
prof.Fill(2,2);
prof.Fill(3,3);
prof.Fill(12,12);
prof.Fill(13,13);
prof.Fill(14,14);

std::vector vec;

vec.push_back(prof);

return vec[0];

}

I got the following crash:

*** Break *** segmentation violation
(no debugging symbols found)
Using host libthread_db library “/lib64/tls/libthread_db.so.1”.
Attaching to program: /proc/2043/exe, process 2043
(no debugging symbols found)…done.
(no debugging symbols found)…done.
(no debugging symbols found)…done.
(no debugging symbols found)…done.
[Thread debugging using libthread_db enabled]
[New Thread 4149835456 (LWP 2043)]
(no debugging symbols found)…done.
(no debugging symbols found)…done.
(no debugging symbols found)…done.
(no debugging symbols found)…done.

0xffffe410 in __kernel_vsyscall ()
#1 0x00ae9f13 in __waitpid_nocancel () from /lib/tls/libc.so.6
#2 0x00a937b9 in do_system () from /lib/tls/libc.so.6
#3 0x00bd298d in system () from /lib/tls/libpthread.so.0
#4 0xf7b9379f in TUnixSystem::Exec ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#5 0xf7b991ad in TUnixSystem::StackTrace ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#6 0xf7b95e6a in TUnixSystem::DispatchSignals ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#7 0xf7b95ef8 in SigHandler ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#8 0xf7b95145 in sighandler ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#9
#10 0xf724e623 in TProfile::LabelsInflate ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libHist.so
#11 0xf71efe67 in TH1D::SetBinContent ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libHist.so
#12 0xf71da8b8 in TH1::Copy ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libHist.so
#13 0xf71f01aa in TH1D::Copy ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libHist.so
#14 0xf724c918 in TProfile::Copy ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libHist.so
#15 0xf724bfcc in TProfile::TProfile ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libHist.so
#16 0xf75be189 in std::vector<TProfile, std::allocator >::_M_insert_aux () from /afs/cern.ch/user/v/venturia/GlobalRuns/./rebinned_test_C.so
#17 0xf75bdaf4 in rebinned_test ()
from /afs/cern.ch/user/v/venturia/GlobalRuns/./rebinned_test_C.so
#18 0xf75bdba2 in G__fileROwRMM__0_1256 ()
from /afs/cern.ch/user/v/venturia/GlobalRuns/./rebinned_test_C.so
#19 0xf7633a5f in Cint::G__ExceptionWrapper ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#20 0xf76f0327 in G__call_cppfunc ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#21 0xf76d58dd in G__interpret_func ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#22 0xf76c3816 in G__getfunction ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#23 0xf76a7cb8 in G__getitem ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#24 0xf76aa8ff in G__getexpr ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#25 0xf769b238 in G__define_var ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#26 0xf77173cc in G__exec_statement ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#27 0xf7695b08 in G__exec_tempfile_core ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#28 0xf7696e43 in G__exec_tempfile_fp ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#29 0xf77277d4 in G__process_cmd ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCint.so
#30 0xf7b66d0f in TCint::ProcessLine ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#31 0xf7ad4916 in TApplication::ProcessLine ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#32 0xf75dd1a8 in TRint::HandleTermInput ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libRint.so
#33 0xf75db840 in TTermInputHandler::Notify ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libRint.so
#34 0xf75dda56 in TTermInputHandler::ReadNotify ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libRint.so
#35 0xf7b9212a in TUnixSystem::CheckDescriptors ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#36 0xf7b96348 in TUnixSystem::DispatchOneEvent ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#37 0xf7b29e98 in TSystem::InnerLoop ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#38 0xf7b29c5e in TSystem::Run ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#39 0xf7ad4a02 in TApplication::Run ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libCore.so
#40 0xf75dbfb2 in TRint::Run ()
from /afs/cern.ch/sw/lcg/external/root/5.18.00/slc4_ia32_gcc34/root/lib/libRint.so
#41 0x08048d36 in main ()

It looks like the copy constructor called by “push_back” is not working properly.
This is the simple version of a crash we are observing in the CMS software.
Have you any idea about this problem? The version I am using is 5.18.00

                                    cheers

                                   Andrea
2

Hi,

Thanks for reporting this problem. We will investigate it.

As a workaround, avoid using the TProfile copy constructor by using either a vector<TProfile*> or a TObjArray.

Cheers,
Philippe.

3

Hello,

is there any news about this issue? The suggested workarounds are fine but cannot be applied in the CMS software expecially if a definitive fix is foreseen.

                                          Thanks

                                          Andrea
4

Ciao Andrea,

there is a problem in the TH1 copy constructor which calls LabelInflate() via SetBinContent() when copying the content of the overflow bins the rebin bit is set.
This will be certainly fix, but it requires some careful testing. I hope we can have this fix for 5.23.04.
However, CMS will move only to 5.22, I guess we would need to have this in the 5.22 patch branch, right ?

Lorenzo

5

Ciao Lorenzo,

your plan is fine. I am not in the position to give you an official CMS reply but since I am pushing to have the rebinnable histograms used in CMS I need it fixed asap in CMSSW. So if the fix can be included in a patched 5.22 would be perfect.

                                      Andrea
6

[quote=“venturia”] your plan is fine. I am not in the position to give you an official CMS reply but since I am pushing to have the rebinnable histograms used in CMS I need it fixed asap in CMSSW. So if the fix can be included in a patched 5.22 would be perfect.
[/quote]

I believe that CMS builds Root from source with patches applied (some ours, some yours). If you have a patch, the people who do this should be able to use it regardless of whether or not it is part of an official patched 5.22 (so even if it’s too late to make it into your patched 5.22, it’s not too late for ours).

Cheers,
Charles

7

I have fixed this problem in SVN revision 27906

Rene