Repository navigation
Matplotlib crashes on windows while maximizing plot window when using Multicursor #14225
Description
Bug report
Bug summary
I use matplotlib version 3.0.3 and while testing sample code for multicursor, everything is OK and
window opens and multicursor works fine. But if I maximize plotting window, and move mouse cursor on plot, python crashes and exists with code: -1073741819 (0xC0000005)
Code for reproduction
import numpy as np
import matplotlib.pyplot as plt
from matplotlib.widgets import MultiCursor
t = np.arange(0.0, 2.0, 0.01)
s1 = np.sin(2*np.pi*t)
s2 = np.sin(4*np.pi*t)
fig, (ax1, ax2) = plt.subplots(2, sharex=True)
ax1.plot(t, s1)
ax2.plot(t, s2)
multi = MultiCursor(fig.canvas, (ax1, ax2), color='r', lw=1)
plt.show()Process finished with exit code -1073741819 (0xC0000005)
Matplotlib version
- Operating system: Windows 10 (version: 10.0.17763)
- Matplotlib version: 3.0.3
- Matplotlib backend (TkAgg):
- Python version: 3.7
- IDE: PyCharm 2018.3
Activity
cgohlke commented on Jun 5, 2019
It took me about a minute of interacting with the plot to reproduce the crash with mpl-3.1.
The crash is in Python's tcl86t.dll. Unfortunately there are not debug symbols for that DLL.
Faulthandler:
Stack trace:
cgohlke commented on Jun 5, 2019
Also got this crash in the TK_PHOTO_PUT_BLOCK_NO_COMPOSITE call. The Tk_PhotoImageBlock pixelPtr seems not accessible.
| Name | Value | Type -- | -- | -- | -- ▶ | args | 0x0000027d526e2cc0 {ob_refcnt=1 ob_type=0x00007ffec6897a40 {python38.dll!_typeobject PyTuple_Type} {...} } | _object * ◢ | block | {pixelPtr=0x0000027d5ade7c40 <Error reading characters of string.> width=1200 height=845 ...} | Tk_PhotoImageBlock | ◢ pixelPtr | 0x0000027d5ade7c40 <Error reading characters of string.> | unsigned char * | | <Unable to read memory> | unsigned char | width | 1200 | int | height | 845 | int | pitch | 4800 | int | pixelSize | 4 | int | ▶ offset | 0x000000bd0b3ec8d0 {0, 1, 2, 3} | int[4] ▶ | data_ptr | 0x0000027d5ade8f00 "ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ... | unsigned char * | height | 844 | int | interp | 0x0000027d49d90010 {...} | Tcl_Interp * | o0 | 0 | int | o1 | 1 | int | o2 | 2 | int | o3 | 3 | int | photo | 0x0000027d4a185e10 | void * ▶ | photo_name | 0x0000027d526be6a0 "pyimage366" | const char * ▶ | self | 0x0000027d4c6c4090 {ob_refcnt=8 ob_type=0x00007ffec6895ae0 {python38.dll!_typeobject PyModule_Type} {...} } | _object * | width | 1200 | int | x1 | 0 | int | x2 | 1200 | int | y1 | 0 | int | y2 | 845 | intanntzer commented on Jun 6, 2019
It's strange that data_ptr and pixelPtr differ, as they are initialized as block.pixelPtr = data_ptr + 4 * ((height - y2) * width + x1); and the second term is zero in your case?
cgohlke commented on Jun 6, 2019
Here's a trace of values printed right before the TK_PHOTO_PUT_BLOCK_NO_COMPOSITE call:
The crash occurs when y2 suddenly is one off relative to the height for unknown reason. Also, this is a rare event. It takes several hundreds of resizes of the Window to eventually crash.
This resize crash looks different from the alloc: invalid block: I also reported. I'm not sure yet that any of these two issues are related to the original issue of moving the cursor.
cgohlke commented on Jun 6, 2019
Here's another trace where I also printed canvas.figure.bbox:
The value 426.99999999999994 is rounded up to 427, one larger than the image height.
anntzer commented on Jun 6, 2019
Managed to repro it on Linux as well.
The core of the issue is that the figure bbox is not represented in pixel units but is transformed from inches, so there can be rounding errors when converting them to pixels.
cgohlke commented on Jun 6, 2019
With #14461 the crash in TK_PHOTO_PUT_BLOCK_NO_COMPOSITE is clearly gone. I also no longer seem to get any alloc: invalid block crash, so maybe that was due to a memory corruption when the out of bounds blit did not crash right away.