Graphviz's 'patchwork' command crashes when linked against umem.

[nickziv]

Attached is an input file deps.dot (appended txt to file name because github complains). It describes the interdependencies of various JS files in an SDC repo. Also attached is a core file. This was run under a SmartOS zone with image uuid: 96bcddda-beb7-11e5-af20-a3fb54c8ae29 (15.4.0, 2016-01-19).

All of the graphviz commands consume this input and produce output except for the patchwork command (which seems to be a wrapper around the dot command). It was invoked as follows:

patchwork -Tsvg deps.dot > deps.svg

This produces a core dump which has the following stack, disassembly, and registers (notice the presence of %rdi = 0xdeadbeefdeadbeef):

> ::stack
libgvplugin_neato_layout.so.6.0.0`freeTree+0xd()
libgvplugin_neato_layout.so.6.0.0`freeTree+0x2b()
libgvplugin_neato_layout.so.6.0.0`patchwork_layout+0x192()
libgvc.so.6.0.0`gvLayoutJobs+0xe2()
main+0x26f()
_start+0x6c()

> <rip::dis
libgvplugin_neato_layout.so.6.0.0`freeTree:     pushq  %rbp
libgvplugin_neato_layout.so.6.0.0`freeTree+1:   movq   %rsp,%rbp
libgvplugin_neato_layout.so.6.0.0`freeTree+4:   pushq  %r14
libgvplugin_neato_layout.so.6.0.0`freeTree+6:   pushq  %r13
libgvplugin_neato_layout.so.6.0.0`freeTree+8:   pushq  %r12
libgvplugin_neato_layout.so.6.0.0`freeTree+0xa: pushq  %rbx
libgvplugin_neato_layout.so.6.0.0`freeTree+0xb: xorl   %ebx,%ebx
libgvplugin_neato_layout.so.6.0.0`freeTree+0xd: movl   0x4c(%rdi),%r13d
libgvplugin_neato_layout.so.6.0.0`freeTree+0x11:movq   %rdi,%r14
libgvplugin_neato_layout.so.6.0.0`freeTree+0x14:movq   0x30(%rdi),%r12
libgvplugin_neato_layout.so.6.0.0`freeTree+0x18:testl  %r13d,%r13d
libgvplugin_neato_layout.so.6.0.0`freeTree+0x1b:jle    +0x18    <libgvplugin_neato_layout.so.6.0.0`freeTree+0x35>
libgvplugin_neato_layout.so.6.0.0`freeTree+0x1d:nopl   (%rax)
libgvplugin_neato_layout.so.6.0.0`freeTree+0x20:movq   %r12,%rdi
libgvplugin_neato_layout.so.6.0.0`freeTree+0x23:addl   $0x1,%ebx
libgvplugin_neato_layout.so.6.0.0`freeTree+0x26:call   -0x2b    <libgvplugin_neato_layout.so.6.0.0`freeTree>
libgvplugin_neato_layout.so.6.0.0`freeTree+0x2b:cmpl   %r13d,%ebx
libgvplugin_neato_layout.so.6.0.0`freeTree+0x2e:movq   0x38(%r12),%r12

> ::regs
%rax = 0x0000000000000001       %r8  = 0x0000000000000000
%rbx = 0x0000000000000000       %r9  = 0x0000000000000000
%rcx = 0x0000000000000000       %r10 = 0x0000000000000000
%rdx = 0x0000000000000000       %r11 = 0xfffffd7fff138900
%rsi = 0x0000000000000000       %r12 = 0xdeadbeefdeadbeef
%rdi = 0xdeadbeefdeadbeef       %r13 = 0x0000000000000046
                                %r14 = 0x0000000000678090
                                %r15 = 0x0000000000628890

%cs = 0x0053    %fs = 0x0000    %gs = 0x0000
%ds = 0x0000    %es = 0x0000    %ss = 0x004b

%rip = 0xfffffd7ff7f41ded libgvplugin_neato_layout.so.6.0.0`freeTree+0xd
%rbp = 0xfffffd7fffdff990
%rsp = 0xfffffd7fffdff970

%rflags = 0x00010246
  id=0 vip=0 vif=0 ac=0 vm=0 rf=1 nt=0 iopl=0x0
  status=<of,df,IF,tf,sf,ZF,af,PF,cf>

%gsbase = 0x0000000000000000
%fsbase = 0xfffffd7fff092a40
%trapno = 0xd
   %err = 0x0

deps.dot.txt

core.dot.36038.zip

[jperkin]

Thanks. I've tried to reproduce this with exactly the same image so that I can verify that any proposed fix solves the issue, but the command works fine for me. Do you have any other settings which would be influencing the command? Does it fail in exactly the same way each time?

[mamash]

Erroneous auto-close.

[mamash]

Please do re-open if you have more information that can help us reproduce the problem.