Drawing 2D histogram from tree crashes root

Hi,
I have an issue whereby root crashes everytime I try and draw a 2D histogram from a TTree, but only if I do not redirect the output into a new histogram. So

T->Draw("A:B")

causes root to crash whereas

T->Draw("A:B>>()")

does not. The error message printed is

  *******************************************
  *                                         *
  *        W E L C O M E  to  R O O T       *
  *                                         *
  *   Version   5.33/03      6 March 2012   *
  *                                         *
  *  You are welcome to visit our Web site  *
  *          http://root.cern.ch            *
  *                                         *
  *******************************************

ROOT 5.33/03 (trunk@43320, Mar 10 2012, 20:48:24 on linuxx8664gcc)

CINT/ROOT C/C++ Interpreter version 5.18.00, July 2, 2010
Type ? for help. Commands must be C++ statements.
Enclose multiple statements between { }.
root [0] .X CrashTest.C
Info in <TCanvas::MakeDefCanvas>:  created default TCanvas with name c1
*** glibc detected *** /usr/local/bin/root.exe: double free or corruption (fasttop): 0x00000000018c8f20 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7a6e6)[0x7f2d0034e6e6]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f2d003529cc]
/usr/lib/x86_64-linux-gnu/libX11.so.6(+0x27ca2)[0x7f2cfb8bfca2]
/usr/local/lib/root/libGX11.so(+0x17a62)[0x7f2cfc00ba62]
/usr/local/lib/root/libGX11.so(_Z21XRotDrawAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPci+0x2f)[0x7f2cfc00c5df]
/usr/local/lib/root/libGX11.so(_ZN5TGX118DrawTextEiiffPKcN9TVirtualX9ETextModeE+0x88)[0x7f2cfc00efb8]
/usr/local/lib/root/libGpad.so(_ZN4TPad9PaintTextEddPKc+0x99)[0x7f2cfc29e299]
/usr/local/lib/root/libGraf.so(_ZN6TLatex7AnalyseEdd10TextSpec_tPKci+0x7fc4)[0x7f2cfc858194]
/usr/local/lib/root/libGraf.so(_ZN6TLatex10PaintLatexEddddPKc+0x843)[0x7f2cfc85bab3]
/usr/local/lib/root/libGraf.so(_ZN6TGaxis9PaintAxisEddddRdS0_RiPKcdb+0x4a99)[0x7f2cfc8453b9]
/usr/local/lib/root/libHistPainter.so(_ZN12THistPainter9PaintAxisEb+0x555)[0x7f2cf6b8f8b5]
/usr/local/lib/root/libHistPainter.so(_ZN12THistPainter10PaintTableEPKc+0x14a)[0x7f2cf6b7ed0a]
/usr/local/lib/root/libHistPainter.so(_ZN12THistPainter5PaintEPKc+0x2df)[0x7f2cf6b8e9af]
/usr/local/lib/root/libGpad.so(_ZN4TPad13PaintModifiedEv+0x252)[0x7f2cfc2af072]
/usr/local/lib/root/libGpad.so(_ZN7TCanvas6UpdateEv+0xd4)[0x7f2cfc28b894]
/usr/local/lib/root/libTreePlayer.so(_ZN13TSelectorDraw12TakeEstimateEv+0x105e)[0x7f2cf8e9d44e]
/usr/local/lib/root/libTreePlayer.so(_ZN13TSelectorDraw10TakeActionEv+0xc8f)[0x7f2cf8e9898f]
/usr/local/lib/root/libTreePlayer.so(_ZN13TSelectorDraw9TerminateEv+0x49)[0x7f2cf8e97039]
/usr/local/lib/root/libTreePlayer.so(_ZN11TTreePlayer7ProcessEP9TSelectorPKcxx+0x2c4)[0x7f2cf8eb8b54]
/usr/local/lib/root/libTreePlayer.so(_ZN11TTreePlayer10DrawSelectEPKcS1_S1_xx+0x2b3)[0x7f2cf8ebac73]
/usr/local/lib/root/libCore.so(+0x3f0d2a)[0x7f2d013d4d2a]
/usr/local/lib/root/libCint.so(_ZN4Cint19G__ExceptionWrapperEPFiP8G__valuePKcP8G__paramiES1_PcS5_i+0x36)[0x7f2cff54d9a6]
/usr/local/lib/root/libCint.so(G__execute_call+0x61)[0x7f2cff5f2631]
/usr/local/lib/root/libCint.so(G__call_cppfunc+0x26e)[0x7f2cff5f29ee]
/usr/local/lib/root/libCint.so(G__interpret_func+0x46ff)[0x7f2cff5d367f]
/usr/local/lib/root/libCint.so(G__getfunction+0x1d9e)[0x7f2cff5bfcbe]
/usr/local/lib/root/libCint.so(_Z15G__getstructmemiR18G__FastAllocStringPciS1_PiP12G__var_arrayi+0x6eb)[0x7f2cff6a79ab]
/usr/local/lib/root/libCint.so(G__getvariable+0x222c)[0x7f2cff69f36c]
/usr/local/lib/root/libCint.so(G__getitem+0xe2)[0x7f2cff599592]
/usr/local/lib/root/libCint.so(G__getitem+0x9ea)[0x7f2cff599e9a]
/usr/local/lib/root/libCint.so(G__getexpr+0x4e36)[0x7f2cff59fc66]
/usr/local/lib/root/libCint.so(G__exec_statement+0x5938)[0x7f2cff6227a8]
/usr/local/lib/root/libCint.so(+0x87d22)[0x7f2cff585d22]
/usr/local/lib/root/libCint.so(G__exec_tempfile+0xb)[0x7f2cff5874db]
/usr/local/lib/root/libCint.so(G__process_cmd+0x5bf1)[0x7f2cff633bc1]
/usr/local/lib/root/libCore.so(_ZN5TCint11ProcessLineEPKcPN12TInterpreter10EErrorCodeE+0x4ea)[0x7f2d011f999a]
/usr/local/lib/root/libCore.so(_ZN5TCint16ProcessLineSynchEPKcPN12TInterpreter10EErrorCodeE+0xb3)[0x7f2d011f0393]
/usr/local/lib/root/libCore.so(_ZN12TApplication11ExecuteFileEPKcPib+0x824)[0x7f2d011615c4]
/usr/local/lib/root/libCore.so(_ZN12TApplication11ProcessLineEPKcbPi+0x75f)[0x7f2d011602ff]
/usr/local/lib/root/libRint.so(_ZN5TRint15HandleTermInputEv+0x219)[0x7f2d00dc0b09]
/usr/local/lib/root/libCore.so(_ZN11TUnixSystem16CheckDescriptorsEv+0x15c)[0x7f2d01230dac]
/usr/local/lib/root/libCore.so(_ZN11TUnixSystem16DispatchOneEventEb+0xd6)[0x7f2d01232566]
/usr/local/lib/root/libCore.so(_ZN7TSystem9InnerLoopEv+0x16)[0x7f2d011b6576]
/usr/local/lib/root/libCore.so(_ZN7TSystem3RunEv+0x74)[0x7f2d011b8244]
/usr/local/lib/root/libCore.so(_ZN12TApplication3RunEb+0x1f)[0x7f2d0115e21f]
/usr/local/lib/root/libRint.so(_ZN5TRint3RunEb+0x252)[0x7f2d00dc1512]
/usr/local/bin/root.exe(main+0x4c)[0x400f6c]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7f2d002f530d]
/usr/local/bin/root.exe[0x400fdd]
======= Memory map: ========
00400000-00402000 r-xp 00000000 08:03 801496                             /usr/local/bin/root.exe
00601000-00602000 r--p 00001000 08:03 801496                             /usr/local/bin/root.exe
00602000-00603000 rw-p 00002000 08:03 801496                             /usr/local/bin/root.exe
00a2d000-018e3000 rw-p 00000000 00:00 0                                  [heap]
7f2cf0000000-7f2cf0021000 rw-p 00000000 00:00 0 
7f2cf0021000-7f2cf4000000 ---p 00000000 00:00 0 
7f2cf6b48000-7f2cf6bdc000 r-xp 00000000 08:03 938832                     /usr/local/lib/root/libHistPainter.so
7f2cf6bdc000-7f2cf6ddb000 ---p 00094000 08:03 938832                     /usr/local/lib/root/libHistPainter.so
7f2cf6ddb000-7f2cf6ddd000 r--p 00093000 08:03 938832                     /usr/local/lib/root/libHistPainter.so
7f2cf6ddd000-7f2cf6ddf000 rw-p 00095000 08:03 938832                     /usr/local/lib/root/libHistPainter.so
7f2cf6ddf000-7f2cf84c7000 rw-p 00000000 00:00 0 
7f2cf84c7000-7f2cf84ed000 r-xp 00000000 08:03 1442997                    /lib/x86_64-linux-gnu/libpng12.so.0.46.0
7f2cf84ed000-7f2cf86ed000 ---p 00026000 08:03 1442997                    /lib/x86_64-linux-gnu/libpng12.so.0.46.0
7f2cf86ed000-7f2cf86ee000 r--p 00026000 08:03 1442997                    /lib/x86_64-linux-gnu/libpng12.so.0.46.0
7f2cf86ee000-7f2cf86ef000 rw-p 00027000 08:03 1442997                    /lib/x86_64-linux-gnu/libpng12.so.0.46.0
7f2cf86ef000-7f2cf8750000 r-xp 00000000 08:03 663915                     /usr/lib/x86_64-linux-gnu/libtiff.so.4.3.4
7f2cf8750000-7f2cf894f000 ---p 00061000 08:03 663915                     /usr/lib/x86_64-linux-gnu/libtiff.so.4.3.4
7f2cf894f000-7f2cf8951000 r--p 00060000 08:03 663915                     /usr/lib/x86_64-linux-gnu/libtiff.so.4.3.4
7f2cf8951000-7f2cf8952000 rw-p 00062000 08:03 663915                     /usr/lib/x86_64-linux-gnu/libtiff.so.4.3.4
7f2cf8952000-7f2cf8976000 r-xp 00000000 08:03 663794                     /usr/lib/x86_64-linux-gnu/libjpeg.so.62.0.0
7f2cf8976000-7f2cf8b75000 ---p 00024000 08:03 663794                     /usr/lib/x86_64-linux-gnu/libjpeg.so.62.0.0
7f2cf8b75000-7f2cf8b76000 r--p 00023000 08:03 663794                     /usr/lib/x86_64-linux-gnu/libjpeg.so.62.0.0
7f2cf8b76000-7f2cf8b77000 rw-p 00024000 08:03 663794                     /usr/lib/x86_64-linux-gnu/libjpeg.so.62.0.0
7f2cf8b77000-7f2cf8c21000 r-xp 00000000 08:03 938772                     /usr/local/lib/root/libASImage.so
7f2cf8c21000-7f2cf8e20000 ---p 000aa000 08:03 938772                     /usr/local/lib/root/libASImage.so
7f2cf8e20000-7f2cf8e23000 r--p 000a9000 08:03 938772                     /usr/local/lib/root/libASImage.so
7f2cf8e23000-7f2cf8e26000 rw-p 000ac000 08:03 938772                     /usr/local/lib/root/libASImage.so
7f2cf8e26000-7f2cf8e34000 rw-p 00000000 00:00 0 
7f2cf8e34000-7f2cf8fd2000 r-xp 00000000 08:03 938909                     /usr/local/lib/root/libTreePlayer.so
7f2cf8fd2000-7f2cf91d2000 ---p 0019e000 08:03 938909                     /usr/local/lib/root/libTreePlayer.so
7f2cf91d2000-7f2cf91db000 r--p 0019e000 08:03 938909                     /usr/local/lib/root/libTreePlayer.so
7f2cf91db000-7f2cf91de000 rw-p 001a7000 08:03 938909                     /usr/local/lib/root/libTreePlayer.so
7f2cf91de000-7f2cf91e4000 rw-p 00000000 00:00 0 
7f2cf91e4000-7f2cf92fa000 r-xp 00000000 08:03 938816                     /usr/local/lib/root/libGraf3d.so
7f2cf92fa000-7f2cf94f9000 ---p 00116000 08:03 938816                     /usr/local/lib/root/libGraf3d.so
7f2cf94f9000-7f2cf9503000 r--p 00115000 08:03 938816                     /usr/local/lib/root/libGraf3d.so
7f2cf9503000-7f2cf9506000 rw-p 0011f000 08:03 938816                     /usr/local/lib/root/libGraf3d.so
7f2cf9506000-7f2cf950a000 rw-p 00000000 00:00 0 
7f2cf950a000-7f2cf9725000 r-xp 00000000 08:03 938907                     /usr/local/lib/root/libTree.so
7f2cf9725000-7f2cf9925000 ---p 0021b000 08:03 938907                     /usr/local/lib/root/libTree.so
7f2cf9925000-7f2cf9934000 r--p 0021b000 08:03 938907                     /usr/local/lib/root/libTree.so
7f2cf9934000-7f2cf9939000 rw-p 0022a000 08:03 938907                     /usr/local/lib/root/libTree.so
7f2cf9939000-7f2cf993d000 rw-p 00000000 00:00 0 
7f2cf993d000-7f2cf9987000 r-xp 00000000 08:03 1457937                    /lib/x86_64-linux-gnu/libssl.so.1.0.0
7f2cf9987000-7f2cf9b86000 ---p 0004a000 08:03 1457937                    /lib/x86_64-linux-gnu/libssl.so.1.0.0
7f2cf9b86000-7f2cf9b89000 r--p 00049000 08:03 1457937                    /lib/x86_64-linux-gnu/libssl.so.1.0.0
7f2cf9b89000-7f2cf9b8e000 rw-p 0004c000 08:03 1457937                    /lib/x86_64-linux-gnu/libssl.so.1.0.0
7f2cf9b8e000-7f2cf9d16000 r-xp 00000000 08:03 1457933                    /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7f2cf9d16000-7f2cf9f16000 ---p 00188000 08:03 1457933                    /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7f2cf9f16000-7f2cf9f2f000 r--p 00188000 08:03 1457933                    /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7f2cf9f2f000-7f2cf9f39000 rw-p 001a1000 08:03 1457933                    /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7f2cf9f39000-7f2cf9f3d000 rw-p 00000000 00:00 0 
7f2cf9f3d000-7f2cfa0a6000 r-xp 00000000 08:03 938850                     /usr/local/lib/root/libNet.so
7f2cfa0a6000-7f2cfa2a5000 ---p 00169000 08:03 938850                     /usr/local/lib/root/libNet.so
7f2cfa2a5000-7f2cfa2b2000 r--p 00168000 08:03 938850                     /usr/local/lib/root/libNet.so
7f2cfa2b2000-7f2cfa2b6000 rw-p 00175000 08:03 938850                     /usr/local/lib/root/libNet.so
7f2cfa2b6000-7f2cfa2bd000 rw-p 00000000 00:00 0 
7f2cfa2bd000-7f2cfa2c2000 r-xp 00000000 08:03 663653                     /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0
7f2cfa2c2000-7f2cfa4c1000 ---p 00005000 08:03 663653                     /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0
7f2cfa4c1000-7f2cfa4c2000 r--p 00004000 08:03 663653                     /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0
7f2cfa4c2000-7f2cfa4c3000 rw-p 00005000 08:03 663653                     /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0
7f2cfa4c3000-7f2cfa4cc000 r-xp 00000000 08:03 663663                     /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0
7f2cfa4cc000-7f2cfa6cc000 ---p 00009000 08:03 663663                     /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0
7f2cfa6cc000-7f2cfa6cd000 r--p 00009000 08:03 663663                     /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0
7f2cfa6cd000-7f2cfa6ce000 rw-p 0000a000 08:03 663663                     /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0
7f2cfa6ce000-7f2cfa6d7000 r-xp 00000000 08:03 663645                     /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2
7f2cfa6d7000-7f2cfa8d6000 ---p 00009000 08:03 663645                     /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2
7f2cfa8d6000-7f2cfa8d7000 r--p 00008000 08:03 663645                     /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2
7f2cfa8d7000-7f2cfa8d8000 rw-p 00009000 08:03 663645                     /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2
7f2cfa8d8000-7f2cfb005000 r-xp 00000000 08:03 938818                     /usr/local/lib/root/libGui.so
7f2cfb005000-7f2cfb205000 ---p 0072d000 08:03 938818                     /usr/local/lib/root/libGui.so
7f2cfb205000-7f2cfb254000 r--p 0072d000 08:03 938818                     /usr/local/lib/root/libGui.so
7f2cfb254000-7f2cfb262000 rw-p 0077c000 08:03 938818                     /usr/local/lib/root/libGui.so
7f2cfb262000-7f2cfb273000 rw-p 00000000 00:00 0 
7f2cfb273000-7f2cfb278000 r-xp 00000000 08:03 663649                     /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0
7f2cfb278000-7f2cfb477000 ---p 00005000 08:03 663649                     /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0
7f2cfb477000-7f2cfb478000 r--p 00004000 08:03 663649                     /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0
7f2cfb478000-7f2cfb479000 rw-p 00005000 08:03 663649                     /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0
7f2cfb479000-7f2cfb47b000 r-xp 00000000 08:03 663641                     /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0
7f2cfb47b000-7f2cfb67a000 ---p 00002000 08:03 663641                     /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0
7f2cfb67a000-7f2cfb67b000 r--p 00001000 08:03 663641                     /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0
7f2cfb67b000-7f2cfb67c000 rw-p 00002000 08:03 663641                     /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0
7f2cfb67c000-7f2cfb697000 r-xp 00000000 08:03 663937                     /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0
7f2cfb697000-7f2cfb896000 ---p 0001b000 08:03 663937                     /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0
7f2cfb896000-7f2cfb897000 r--p 0001a000 08:03 663937                     /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0
7f2cfb897000-7f2cfb898000 rw-p 0001b000 08:03 663937                     /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0
7f2cfb898000-7f2cfb9cb000 r-xp 00000000 08:03 663639                     /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0
7f2cfb9cb000-7f2cfbbcb000 ---p 00133000 08:03 663639                     /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0
7f2cfbbcb000-7f2cfbbcc000 r--p 00133000 08:03 663639                     /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0
7f2cfbbcc000-7f2cfbbd0000 rw-p 00134000 08:03 663639                     /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0
7f2cfbbd0000-7f2cfbbe2000 r-xp 00000000 08:03 663651                     /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0
7f2cfbbe2000-7f2cfbde1000 ---p 00012000 08:03 663651                     /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0
7f2cfbde1000-7f2cfbde2000 r--p 00011000 08:03 663651                     /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0
7f2cfbde2000-7f2cfbde3000 rw-p 00012000 08:03 663651                     /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0
7f2cfbde3000-7f2cfbdf3000 r-xp 00000000 08:03 656872                     /usr/lib/libXpm.so.4.11.0
7f2cfbdf3000-7f2cfbff2000 ---p 00010000 08:03 656872                     /usr/lib/libXpm.so.4.11.0
7f2cfbff2000-7f2cfbff3000 r--p 0000f000 08:03 656872                     /usr/lib/libXpm.so.4.11.0
7f2cfbff3000-7f2cfbff4000 rw-p 00010000 08:03 656872                     /usr/lib/libXpm.so.4.11.0
7f2cfbff4000-7f2cfc02c000 r-xp 00000000 08:03 938796                     /usr/local/lib/root/libGX11.so
7f2cfc02c000-7f2cfc22b000 ---p 00038000 08:03 938796                     /usr/local/lib/root/libGX11.so
7f2cfc22b000-7f2cfc22d000 r--p 00037000 08:03 938796                     /usr/local/lib/root/libGX11.so
7f2cfc22d000-7f2cfc22f000 rw-p 00039000 08:03 938796                     /usr/local/lib/root/libGX11.so
7f2cfc22f000-7f2cfc244000 rw-p 00000000 00:00 0 
7f2cfc244000-7f2cfc327000 r-xp 00000000 08:03 938812                     /usr/local/lib/root/libGpad.so
7f2cfc327000-7f2cfc526000 ---p 000e3000 08:03 938812                     /usr/local/lib/root/libGpad.so
7f2cfc526000-7f2cfc52f000 r--p 000e2000 08:03 938812                     /usr/local/lib/root/libGpad.so
7f2cfc52f000-7f2cfc531000 rw-p 000eb000 08:03 938812                     /usr/local/lib/root/libGpad.so
7f2cfc531000-7f2cfc534000 rw-p 00000000 00:00 0 
7f2cfc534000-7f2cfc5c6000 r-xp 00000000 08:03 670948                     /usr/lib/x86_64-linux-gnu/libfreetype.so.6.6.2
7f2cfc5c6000-7f2cfc7c5000 ---p 00092000 08:03 670948                     /usr/lib/x86_64-linux-gnu/libfreetype.so.6.6.2
7f2cfc7c5000-7f2cfc7cb000 r--p 00091000 08:03 670948                     /usr/lib/x86_64-linux-gnu/libfreetype.so.6.6.2
7f2cfc7cb000-7f2cfc7cc000 rw-p 00097000 08:03 670948                     /usr/lib/x86_64-linux-gnu/libfreetype.so.6.6.2
7f2cfc7cc000-7f2cfc963000 r-xp 00000000 08:03 938814                     /usr/local/lib/root/libGraf.so
7f2cfc963000-7f2cfcb63000 ---p 00197000 08:03 938814                     /usr/local/lib/root/libGraf.so
7f2cfcb63000-7f2cfcb6f000 r--p 00197000 08:03 938814                     /usr/local/lib/root/libGraf.so
7f2cfcb6f000-7f2cfcb73000 rw-p 001a3000 08:03 938814                     /usr/local/lib/root/libGraf.so
7f2cfcb73000-7f2cfcb81000 rw-p 00000000 00:00 0 
7f2cfcb81000-7f2cfcd7c000 r-xp 00000000 08:03 938875                     /usr/local/lib/root/libRIO.so
7f2cfcd7c000-7f2cfcf7c000 ---p 001fb000 08:03 938875                     /usr/local/lib/root/libRIO.so
7f2cfcf7c000-7f2cfcf84000 r--p 001fb000 08:03 938875                     /usr/local/lib/root/libRIO.so
7f2cfcf84000-7f2cfcf88000 rw-p 00203000 08:03 938875                     /usr/local/lib/root/libRIO.so
7f2cfcf88000-7f2cfcf8b000 rw-p 00000000 00:00 0 
7f2cfcf8b000-7f2cfcfd8000 r-xp 00000000 08:03 938905                     /usr/local/lib/root/libThread.so
7f2cfcfd8000-7f2cfd1d7000 ---p 0004d000 08:03 938905                     /usr/local/lib/root/libThread.so
7f2cfd1d7000-7f2cfd1db000 r--p 0004c000 08:03 938905                     /usr/local/lib/root/libThread.so
7f2cfd1db000-7f2cfd1dd000 rw-p 00050000 08:03 938905                     /usr/local/lib/root/libThread.so
7f2cfd1dd000-7f2cfd1de000 rw-p 00000000 00:00 0 
7f2cfd1de000-7f2cfd274000 r-xp 00000000 08:03 938898                     /usr/local/lib/root/libSpectrum.so
7f2cfd274000-7f2cfd474000 ---p 00096000 08:03 938898                     /usr/local/lib/root/libSpectrum.so
7f2cfd474000-7f2cfd476000 r--p 00096000 08:03 938898                     /usr/local/lib/root/libSpectrum.so
7f2cfd476000-7f2cfd477000 rw-p 00098000 08:03 938898                     /usr/local/lib/root/libSpectrum.so
7f2cfd477000-7f2cfd478000 rw-p 00000000 00:00 0 
7f2cfd478000-7f2cfd960000 r-xp 00000000 08:03 938830                     /usr/local/lib/root/libHist.so

My root version information is at the top of the posted output. Any suggestions regarding this would be greatly appreciated.

Thanks

Alan Howard
R123.root (285 KB)
CrashTest.C (178 Bytes)

How about this? \:D/ { TFile *ff = new TFile("R123.root"); TTree *tt; ff->GetObject("RawData", tt); tt->Draw("xf:xr"); } Or perhaps this? <img src="/uploads/default/original/2X/8/84c2fe9464a4066c00e1bd5978e913e7869cbb07.gif" width=“22” height=“16” alt=":-"" title=“Whistle”/> { TFile *ff = new TFile("R123.root"); TTree *RawData; ff->GetObject("RawData", RawData); RawData->Draw("xf:xr"); } And maybe see this! :-({|= [url]A strange annoying interpreter problem

Hi Pepe,

Both of those variations lead to the same crash I’m afraid. Again, adding >>() in the draw command seems to circumvent the problem.

Thanks

Alan

Hi Alan,

This is quite strange. T->Draw("A:B>>()") because it is missing the histogram name leads to a crash (fixed today in revision 43348). However T->Draw(“A:B”) should not (and is pretty well tested as this is the general case. Can you run valgrind root.exe -l -q CrashTest.C and report the result? (Even better if you can run it with root.exe from the head of the trunk).

Thanks,
Philippe.

Hi Philippe,

Below is the output from valgrind using revision 43357. Due to the slowdown introduced by the debugger I can actually see the canvas being drawn and populated before the crash occurs now. As before, using the alternate draw command with >>() does not lead to a crash. I should also mention that I only began seeing this behaviour after moving to revision 43320. I don’t know which revision I was on previously, but it was at least several months older.

valgrind root.exe -l -q CrashTest.C
==3583== Memcheck, a memory error detector
==3583== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==3583== Using Valgrind-3.6.1-Debian and LibVEX; rerun with -h for copyright info
==3583== Command: root.exe -l -q CrashTest.C
==3583== 

Processing CrashTest.C...
==3583== Conditional jump or move depends on uninitialised value(s)
==3583==    at 0x64EA510: inflateReset2 (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3583==    by 0x64EA605: inflateInit2_ (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3583==    by 0x5084C1A: R__unzip (in /usr/local/lib/root/libCore.so)
==3583==    by 0xACC27B9: TKey::ReadObjWithBuffer(char*) (in /usr/local/lib/root/libRIO.so)
==3583==    by 0xACA2C5B: TFile::GetStreamerInfoList() (in /usr/local/lib/root/libRIO.so)
==3583==    by 0xACA1819: TFile::ReadStreamerInfo() (in /usr/local/lib/root/libRIO.so)
==3583==    by 0xACA4933: TFile::Init(bool) (in /usr/local/lib/root/libRIO.so)
==3583==    by 0xACA5732: TFile::TFile(char const*, char const*, char const*, int) (in /usr/local/lib/root/libRIO.so)
==3583==    by 0xAD79E99: G__G__IO_123_0_24(G__value*, char const*, G__param*, int) (in /usr/local/lib/root/libRIO.so)
==3583==    by 0x69839A5: Cint::G__ExceptionWrapper(int (*)(G__value*, char const*, G__param*, int), G__value*, char*, G__param*, int) (in /usr/local/lib/root/libCint.so)
==3583==    by 0x6A28630: G__execute_call (in /usr/local/lib/root/libCint.so)
==3583==    by 0x6A289ED: G__call_cppfunc (in /usr/local/lib/root/libCint.so)
==3583== 
==3583== Conditional jump or move depends on uninitialised value(s)
==3583==    at 0x64EA510: inflateReset2 (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3583==    by 0x64EA605: inflateInit2_ (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3583==    by 0x5084C1A: R__unzip (in /usr/local/lib/root/libCore.so)
==3583==    by 0xACC2C59: TKey::ReadObj() (in /usr/local/lib/root/libRIO.so)
==3583==    by 0xAC98053: TDirectoryFile::Get(char const*) (in /usr/local/lib/root/libRIO.so)
==3583==    by 0x50C9878: G__G__Base1_8_0_33(G__value*, char const*, G__param*, int) (in /usr/local/lib/root/libCore.so)
==3583==    by 0x69839A5: Cint::G__ExceptionWrapper(int (*)(G__value*, char const*, G__param*, int), G__value*, char*, G__param*, int) (in /usr/local/lib/root/libCint.so)
==3583==    by 0x6A28630: G__execute_call (in /usr/local/lib/root/libCint.so)
==3583==    by 0x6A289ED: G__call_cppfunc (in /usr/local/lib/root/libCint.so)
==3583==    by 0x6A0967E: G__interpret_func (in /usr/local/lib/root/libCint.so)
==3583==    by 0x69F5CBD: G__getfunction (in /usr/local/lib/root/libCint.so)
==3583==    by 0x6ADD9AA: G__getstructmem(int, G__FastAllocString&, char*, int, char*, int*, G__var_array*, int) (in /usr/local/lib/root/libCint.so)
==3583== 
Info in <TCanvas::MakeDefCanvas>:  created default TCanvas with name c1
==3583== Conditional jump or move depends on uninitialised value(s)
==3583==    at 0x64EA510: inflateReset2 (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3583==    by 0x64EA605: inflateInit2_ (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3583==    by 0x5084C1A: R__unzip (in /usr/local/lib/root/libCore.so)
==3583==    by 0xF303283: TBasket::ReadBasketBuffers(long long, int, TFile*) (in /usr/local/lib/root/libTree.so)
==3583==    by 0xF30BAAA: TBranch::GetBasket(int) (in /usr/local/lib/root/libTree.so)
==3583==    by 0xF30F0DB: TBranch::GetEntry(long long, int) (in /usr/local/lib/root/libTree.so)
==3583==    by 0x1024843B: _ZN12TTreeFormula12EvalInstanceEiPPKc.part.51 (in /usr/local/lib/root/libTreePlayer.so)
==3583==    by 0x1023356B: TSelectorDraw::ProcessFill(long long) (in /usr/local/lib/root/libTreePlayer.so)
==3583==    by 0x10254D0E: TTreePlayer::Process(TSelector*, char const*, long long, long long) (in /usr/local/lib/root/libTreePlayer.so)
==3583==    by 0x10256C72: TTreePlayer::DrawSelect(char const*, char const*, char const*, long long, long long) (in /usr/local/lib/root/libTreePlayer.so)
==3583==    by 0x521FD49: G__G__Base2_10_0_15(G__value*, char const*, G__param*, int) (in /usr/local/lib/root/libCore.so)
==3583==    by 0x69839A5: Cint::G__ExceptionWrapper(int (*)(G__value*, char const*, G__param*, int), G__value*, char*, G__param*, int) (in /usr/local/lib/root/libCint.so)
==3583== 
==3583== Invalid read of size 1
==3583==    at 0xC40D0EA: ??? (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xC40D477: _XSetImage (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xC40897B: XGetSubImage (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xBD8743F: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==  Address 0x12a1d5e0 is 0 bytes inside a block of size 20 free'd
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD873E6: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583== 
==3583== Invalid read of size 1
==3583==    at 0xC40D0C1: ??? (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xC40D477: _XSetImage (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xC40897B: XGetSubImage (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xBD8743F: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==  Address 0x12a1d5e3 is 3 bytes inside a block of size 20 free'd
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD873E6: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583== 
==3583== Invalid read of size 1
==3583==    at 0xBD87924: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0xB6EB071: TPad::PaintModified() (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB6C7893: TCanvas::Update() (in /usr/local/lib/root/libGpad.so)
==3583==  Address 0x12a1d5e0 is 0 bytes inside a block of size 20 free'd
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD873E6: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583== 
==3583== Invalid read of size 1
==3583==    at 0xBD8795F: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0xB6EB071: TPad::PaintModified() (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB6C7893: TCanvas::Update() (in /usr/local/lib/root/libGpad.so)
==3583==  Address 0x12a2205c is 28 bytes inside a block of size 30 free'd
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8759A: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583== 
==3583== Invalid free() / delete / delete[]
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xC40BCA1: ??? (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xBD879C7: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==  Address 0x12a1d5e0 is 0 bytes inside a block of size 20 free'd
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD873E6: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583== 
==3583== Invalid read of size 1
==3583==    at 0xC417610: ??? (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xC418273: ??? (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xC418BD1: XPutImage (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xBD87A57: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==  Address 0x12a22040 is 0 bytes inside a block of size 30 free'd
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8759A: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583== 
==3583== Invalid free() / delete / delete[]
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xC40BCA1: ??? (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
==3583==    by 0xBD87A61: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==  Address 0x12a22040 is 0 bytes inside a block of size 30 free'd
==3583==    at 0x4C282E0: free (vg_replace_malloc.c:366)
==3583==    by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8759A: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so)
==3583==    by 0xB6DA298: TPad::PaintText(double, double, char const*) (in /usr/local/lib/root/libGpad.so)
==3583==    by 0xB0BF193: TLatex::Analyse(double, double, TextSpec_t, char const*, int) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0C2AB2: TLatex::PaintLatex(double, double, double, double, char const*) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0xB0AC3B8: TGaxis::PaintAxis(double, double, double, double, double&, double&, int&, char const*, double, bool) (in /usr/local/lib/root/libGraf.so)
==3583==    by 0x12E1A8D4: THistPainter::PaintAxis(bool) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E09D29: THistPainter::PaintTable(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583==    by 0x12E199CE: THistPainter::Paint(char const*) (in /usr/local/lib/root/libHistPainter.so)
==3583== 
==3583== 
==3583== HEAP SUMMARY:
==3583==     in use at exit: 10,858,409 bytes in 104,685 blocks
==3583==   total heap usage: 366,701 allocs, 262,018 frees, 59,925,532 bytes allocated
==3583== 
==3583== LEAK SUMMARY:
==3583==    definitely lost: 462 bytes in 6 blocks
==3583==    indirectly lost: 432 bytes in 15 blocks
==3583==      possibly lost: 40,526 bytes in 459 blocks
==3583==    still reachable: 10,816,989 bytes in 104,205 blocks
==3583==         suppressed: 0 bytes in 0 blocks
==3583== Rerun with --leak-check=full to see details of leaked memory
==3583== 
==3583== For counts of detected and suppressed errors, rerun with: -v
==3583== Use --track-origins=yes to see where uninitialised values come from
==3583== ERROR SUMMARY: 517 errors from 10 contexts (suppressed: 8 from 7)

In case it is of any value, the valgrind output with the first draw command in CrashTest.C commented out is below.

valgrind root.exe -l -q CrashTest.C
==3813== Memcheck, a memory error detector
==3813== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==3813== Using Valgrind-3.6.1-Debian and LibVEX; rerun with -h for copyright info
==3813== Command: root.exe -l -q CrashTest.C
==3813== 

Processing CrashTest.C...
==3813== Conditional jump or move depends on uninitialised value(s)
==3813==    at 0x64EA510: inflateReset2 (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3813==    by 0x64EA605: inflateInit2_ (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3813==    by 0x5084C1A: R__unzip (in /usr/local/lib/root/libCore.so)
==3813==    by 0xACC27B9: TKey::ReadObjWithBuffer(char*) (in /usr/local/lib/root/libRIO.so)
==3813==    by 0xACA2C5B: TFile::GetStreamerInfoList() (in /usr/local/lib/root/libRIO.so)
==3813==    by 0xACA1819: TFile::ReadStreamerInfo() (in /usr/local/lib/root/libRIO.so)
==3813==    by 0xACA4933: TFile::Init(bool) (in /usr/local/lib/root/libRIO.so)
==3813==    by 0xACA5732: TFile::TFile(char const*, char const*, char const*, int) (in /usr/local/lib/root/libRIO.so)
==3813==    by 0xAD79E99: G__G__IO_123_0_24(G__value*, char const*, G__param*, int) (in /usr/local/lib/root/libRIO.so)
==3813==    by 0x69839A5: Cint::G__ExceptionWrapper(int (*)(G__value*, char const*, G__param*, int), G__value*, char*, G__param*, int) (in /usr/local/lib/root/libCint.so)
==3813==    by 0x6A28630: G__execute_call (in /usr/local/lib/root/libCint.so)
==3813==    by 0x6A289ED: G__call_cppfunc (in /usr/local/lib/root/libCint.so)
==3813== 
==3813== Conditional jump or move depends on uninitialised value(s)
==3813==    at 0x64EA510: inflateReset2 (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3813==    by 0x64EA605: inflateInit2_ (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3813==    by 0x5084C1A: R__unzip (in /usr/local/lib/root/libCore.so)
==3813==    by 0xACC2C59: TKey::ReadObj() (in /usr/local/lib/root/libRIO.so)
==3813==    by 0xAC98053: TDirectoryFile::Get(char const*) (in /usr/local/lib/root/libRIO.so)
==3813==    by 0x50C9878: G__G__Base1_8_0_33(G__value*, char const*, G__param*, int) (in /usr/local/lib/root/libCore.so)
==3813==    by 0x69839A5: Cint::G__ExceptionWrapper(int (*)(G__value*, char const*, G__param*, int), G__value*, char*, G__param*, int) (in /usr/local/lib/root/libCint.so)
==3813==    by 0x6A28630: G__execute_call (in /usr/local/lib/root/libCint.so)
==3813==    by 0x6A289ED: G__call_cppfunc (in /usr/local/lib/root/libCint.so)
==3813==    by 0x6A0967E: G__interpret_func (in /usr/local/lib/root/libCint.so)
==3813==    by 0x69F5CBD: G__getfunction (in /usr/local/lib/root/libCint.so)
==3813==    by 0x6ADD9AA: G__getstructmem(int, G__FastAllocString&, char*, int, char*, int*, G__var_array*, int) (in /usr/local/lib/root/libCint.so)
==3813== 
Info in <TCanvas::MakeDefCanvas>:  created default TCanvas with name c1
==3813== Conditional jump or move depends on uninitialised value(s)
==3813==    at 0x64EA510: inflateReset2 (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3813==    by 0x64EA605: inflateInit2_ (in /lib/x86_64-linux-gnu/libz.so.1.2.3.4)
==3813==    by 0x5084C1A: R__unzip (in /usr/local/lib/root/libCore.so)
==3813==    by 0xF303283: TBasket::ReadBasketBuffers(long long, int, TFile*) (in /usr/local/lib/root/libTree.so)
==3813==    by 0xF30BAAA: TBranch::GetBasket(int) (in /usr/local/lib/root/libTree.so)
==3813==    by 0xF30F0DB: TBranch::GetEntry(long long, int) (in /usr/local/lib/root/libTree.so)
==3813==    by 0x1024843B: _ZN12TTreeFormula12EvalInstanceEiPPKc.part.51 (in /usr/local/lib/root/libTreePlayer.so)
==3813==    by 0x1023356B: TSelectorDraw::ProcessFill(long long) (in /usr/local/lib/root/libTreePlayer.so)
==3813==    by 0x10254D0E: TTreePlayer::Process(TSelector*, char const*, long long, long long) (in /usr/local/lib/root/libTreePlayer.so)
==3813==    by 0x10256C72: TTreePlayer::DrawSelect(char const*, char const*, char const*, long long, long long) (in /usr/local/lib/root/libTreePlayer.so)
==3813==    by 0x521FD49: G__G__Base2_10_0_15(G__value*, char const*, G__param*, int) (in /usr/local/lib/root/libCore.so)
==3813==    by 0x69839A5: Cint::G__ExceptionWrapper(int (*)(G__value*, char const*, G__param*, int), G__value*, char*, G__param*, int) (in /usr/local/lib/root/libCint.so)
==3813== 
==3813== 
==3813== HEAP SUMMARY:
==3813==     in use at exit: 10,855,880 bytes in 104,670 blocks
==3813==   total heap usage: 366,194 allocs, 261,524 frees, 57,653,740 bytes allocated
==3813== 
==3813== LEAK SUMMARY:
==3813==    definitely lost: 456 bytes in 5 blocks
==3813==    indirectly lost: 432 bytes in 15 blocks
==3813==      possibly lost: 40,526 bytes in 459 blocks
==3813==    still reachable: 10,814,466 bytes in 104,191 blocks
==3813==         suppressed: 0 bytes in 0 blocks
==3813== Rerun with --leak-check=full to see details of leaked memory
==3813== 
==3813== For counts of detected and suppressed errors, rerun with: -v
==3813== Use --track-origins=yes to see where uninitialised values come from
==3813== ERROR SUMMARY: 4 errors from 3 contexts (suppressed: 8 from 7)

Many thanks

Alan

Hi Alan,

So the crux of the problem is:==3583== Invalid read of size 1 ==3583== at 0xC40D0EA: ??? (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0) ==3583== by 0xC40D477: _XSetImage (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0) ==3583== by 0xC40897B: XGetSubImage (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0) ==3583== by 0xBD8743F: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so) ==3583== by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so) ==3583== by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so) .... ==3583== Address 0x12a1d5e0 is 0 bytes inside a block of size 20 free'd ==3583== at 0x4C282E0: free (vg_replace_malloc.c:366) ==3583== by 0xBD861A2: MakeXImage(_XDisplay*, int, int) (in /usr/local/lib/root/libGX11.so) ==3583== by 0xBD873E6: _ZL22XRotPaintAlignedStringP9_XDisplayP11XFontStructfmP4_XGCiiPcii.part.0 (in /usr/local/lib/root/libGX11.so) ==3583== by 0xBD885DE: XRotDrawAlignedString(_XDisplay*, XFontStruct*, float, unsigned long, _XGC*, int, int, char*, int) (in /usr/local/lib/root/libGX11.so) ==3583== by 0xBD8AFB7: TGX11::DrawText(int, int, float, float, char const*, TVirtualX::ETextMode) (in /usr/local/lib/root/libGX11.so) which I do not see in my runs. So my best guess is either an issue with X11 and/or a mismatch between the X11 header and library.

Cheers,
Philippe.