Matplotlib crashes on windows while maximizing plot window when using Multicursor #14225

aliaa · 2019-05-15T10:55:50Z

Bug report

Bug summary
I use matplotlib version 3.0.3 and while testing sample code for multicursor, everything is OK and
window opens and multicursor works fine. But if I maximize plotting window, and move mouse cursor on plot, python crashes and exists with code: -1073741819 (0xC0000005)

Code for reproduction

import numpy as np
import matplotlib.pyplot as plt
from matplotlib.widgets import MultiCursor

t = np.arange(0.0, 2.0, 0.01)
s1 = np.sin(2*np.pi*t)
s2 = np.sin(4*np.pi*t)
fig, (ax1, ax2) = plt.subplots(2, sharex=True)
ax1.plot(t, s1)
ax2.plot(t, s2)
multi = MultiCursor(fig.canvas, (ax1, ax2), color='r', lw=1)
plt.show()

Process finished with exit code -1073741819 (0xC0000005)

Matplotlib version

Operating system: Windows 10 (version: 10.0.17763)
Matplotlib version: 3.0.3
Matplotlib backend (TkAgg):
Python version: 3.7
IDE: PyCharm 2018.3

The text was updated successfully, but these errors were encountered:

cgohlke · 2019-06-05T22:21:24Z

It took me about a minute of interacting with the plot to reproduce the crash with mpl-3.1.

The crash is in Python's tcl86t.dll. Unfortunately there are not debug symbols for that DLL.

Faulthandler:

alloc: invalid block: 0000018D61935390: a7 fc
Windows fatal exception: code 0x80000003

Current thread 0x00000bf8 (most recent call first):
  File "X:\Python37\lib\tkinter\__init__.py", line 3507 in __del__
  File "X:\Python37\lib\site-packages\matplotlib\backends\_backend_tk.py", line 252 in resize
  File "X:\Python37\lib\tkinter\__init__.py", line 1705 in __call__
  File "X:\Python37\lib\tkinter\__init__.py", line 1283 in mainloop
  File "X:\Python37\lib\site-packages\matplotlib\backends\_backend_tk.py", line 977 in mainloop
  File "X:\Python37\lib\site-packages\matplotlib\backend_bases.py", line 3302 in show
  File "X:\Python37\lib\site-packages\matplotlib\cbook\deprecation.py", line 413 in wrapper
  File "X:\Python37\lib\site-packages\matplotlib\pyplot.py", line 263 in show
  File "mpl_crash.py", line 14 in <module>

Stack trace:

 	tcl86t.dll!00007ffec5fd735d()	Unknown
 	tcl86t.dll!00007ffec5fd7392()	Unknown
 	tcl86t.dll!00007ffec5ff6032()	Unknown
 	tk86t.dll!00007ffec1d09b67()	Unknown
 	tk86t.dll!00007ffec1cfd2eb()	Unknown
 	tk86t.dll!00007ffec1cfc765()	Unknown
 	tcl86t.dll!00007ffec5f09cac()	Unknown
>	_tkinter.pyd!Tkapp_Call(_object * selfptr=0x0000018d638854b0, _object * args=0x0000018d63a06240) Line 1508	C
 	python37.dll!_PyMethodDef_RawFastCallKeywords(PyMethodDef * method=0x0000000000000000, _object * self=0x0000018d638854b0, _object * const * args=0x0000018d64a771c8, __int64 nargs=3, _object * kwnames) Line 694	C
 	[Inline Frame] python37.dll!_PyMethodDescr_FastCallKeywords(_object *) Line 288	C
 	python37.dll!call_function(_object * * * pp_stack=0x0000007637fec138, __int64 oparg, _object * kwnames=0x0000000000000000) Line 4593	C
 	python37.dll!_PyEval_EvalFrameDefault(_frame * f=0x0000018d64a77048, int throwflag=1769722600) Line 3111	C
<snip>

cgohlke · 2019-06-05T22:58:09Z

Also got this crash in the TK_PHOTO_PUT_BLOCK_NO_COMPOSITE call. The Tk_PhotoImageBlock pixelPtr seems not accessible.

Windows fatal exception: access violation

Current thread 0x000041f0 (most recent call first):
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 79 in blit
  File "X:\Python38\lib\site-packages\matplotlib\backends\backend_tkagg.py", line 14 in blit
  File "X:\Python38\lib\site-packages\matplotlib\widgets.py", line 1456 in _update
  File "X:\Python38\lib\site-packages\matplotlib\widgets.py", line 1444 in onmove
  File "X:\Python38\lib\site-packages\matplotlib\cbook\__init__.py", line 216 in process
  File "X:\Python38\lib\site-packages\matplotlib\backend_bases.py", line 1797 in motion_notify_event
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 352 in motion_notify_event
  File "X:\Python38\lib\tkinter\__init__.py", line 1883 in __call__
  File "X:\Python38\lib\tkinter\__init__.py", line 1420 in mainloop
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 977 in mainloop
  File "X:\Python38\lib\site-packages\matplotlib\backend_bases.py", line 3302 in show
  File "X:\Python38\lib\site-packages\matplotlib\cbook\deprecation.py", line 413 in wrapper
  File "X:\Python38\lib\site-packages\matplotlib\pyplot.py", line 263 in show
  File "mpl_crash.py", line 14 in <module>

 	tk86t.dll!00007ffec1d0aca1()	Unknown
 	tk86t.dll!00007ffec1d0c5b1()	Unknown
>	_tkagg.cp38-win_amd64.pyd!mpl_tk_blit(_object * self, _object * args) Line 247	C++
 	[Inline Frame] python38.dll!cfunction_call_varargs(_object *) Line 776	C
 	python38.dll!PyCFunction_Call(_object * func, _object * args, _object * kwargs) Line 791	C
 	[Inline Frame] python38.dll!_PyObject_MakeTpCall(_object * keywords, _object * const *) Line 159	C
 	[Inline Frame] python38.dll!_PyObject_Vectorcall(_object * nargsf, _object * const *) Line 122	C
<snip>


  | Name | Value | Type
-- | -- | -- | --
▶ | args | 0x0000027d526e2cc0 {ob_refcnt=1 ob_type=0x00007ffec6897a40 {python38.dll!_typeobject PyTuple_Type} {...} } | _object *
◢ | block | {pixelPtr=0x0000027d5ade7c40 <Error reading characters of string.> width=1200 height=845 ...} | Tk_PhotoImageBlock
  | ◢ pixelPtr | 0x0000027d5ade7c40 <Error reading characters of string.> | unsigned char *
  |   | <Unable to read memory> | unsigned char
  | width | 1200 | int
  | height | 845 | int
  | pitch | 4800 | int
  | pixelSize | 4 | int
  | ▶ offset | 0x000000bd0b3ec8d0 {0, 1, 2, 3} | int[4]
▶ | data_ptr | 0x0000027d5ade8f00 "ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ... | unsigned char *
  | height | 844 | int
  | interp | 0x0000027d49d90010 {...} | Tcl_Interp *
  | o0 | 0 | int
  | o1 | 1 | int
  | o2 | 2 | int
  | o3 | 3 | int
  | photo | 0x0000027d4a185e10 | void *
▶ | photo_name | 0x0000027d526be6a0 "pyimage366" | const char *
▶ | self | 0x0000027d4c6c4090 {ob_refcnt=8 ob_type=0x00007ffec6895ae0 {python38.dll!_typeobject PyModule_Type} {...} } | _object *
  | width | 1200 | int
  | x1 | 0 | int
  | x2 | 1200 | int
  | y1 | 0 | int
  | y2 | 845 | int

anntzer · 2019-06-06T00:15:57Z

It's strange that data_ptr and pixelPtr differ, as they are initialized as block.pixelPtr = data_ptr + 4 * ((height - y2) * width + x1); and the second term is zero in your case?

cgohlke · 2019-06-06T07:13:32Z

Here's a trace of values printed right before the TK_PHOTO_PUT_BLOCK_NO_COMPOSITE call:

photo_name data_ptr block.pixelPtr block.width block.height block.pitch width height x1 x2 y1 y2
<snip>
pyimage446 0000016864FC09C0 0000016864FC09C0 1040 985 4160 1040 985 0 1040 0 985
pyimage446 0000016864FC09C0 0000016864FC09C0 1040 985 4160 1040 985 0 1040 0 985
pyimage447 0000016868710F80 0000016868710F80 1100 984 4400 1100 984 0 1100 0 984
pyimage447 0000016868710F80 0000016868710F80 1100 984 4400 1100 984 0 1100 0 984
pyimage448 00000168690B06A0 00000168690B06A0 1137 984 4548 1137 984 0 1137 0 984
pyimage448 00000168690B06A0 00000168690B06A0 1137 984 4548 1137 984 0 1137 0 984
pyimage449 000001686B2970E0 000001686B2970E0 1189 974 4756 1189 974 0 1189 0 974
pyimage449 000001686B2970E0 000001686B2970E0 1189 974 4756 1189 974 0 1189 0 974
pyimage450 000001686851E420 000001686851E420 1230 973 4920 1230 973 0 1230 0 973
pyimage450 000001686851E420 000001686851E420 1230 973 4920 1230 973 0 1230 0 973
pyimage451 0000016868C20CC0 0000016868C20CC0 1276 972 5104 1276 972 0 1276 0 972
pyimage451 0000016868C20CC0 0000016868C20CC0 1276 972 5104 1276 972 0 1276 0 972
pyimage452 000001686458A810 000001686458A810 1284 959 5136 1284 959 0 1284 0 959
pyimage452 000001686458A810 000001686458A810 1284 959 5136 1284 959 0 1284 0 959
pyimage453 00000168690DE020 00000168690DE020 1221 894 4884 1221 894 0 1221 0 894
pyimage453 00000168690DE020 00000168690DE020 1221 894 4884 1221 894 0 1221 0 894
pyimage454 0000016867C202B0 0000016867C202B0 1165 863 4660 1165 863 0 1165 0 863
pyimage454 0000016867C202B0 0000016867C202B0 1165 863 4660 1165 863 0 1165 0 863
pyimage455 000001686B6BE030 000001686B6BE030 1164 863 4656 1164 863 0 1164 0 863
pyimage455 000001686B6BE030 000001686B6BE030 1164 863 4656 1164 863 0 1164 0 863
pyimage455 000001686B6BE030 000001686B6BCE00 1164 864 4656 1164 863 0 1164 0 864
Windows fatal exception: access violation

Current thread 0x000032d4 (most recent call first):
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 79 in blit
  File "X:\Python38\lib\site-packages\matplotlib\backends\backend_tkagg.py", line 14 in blit
  File "X:\Python38\lib\site-packages\matplotlib\widgets.py", line 1456 in _update
  File "X:\Python38\lib\site-packages\matplotlib\widgets.py", line 1444 in onmove
  File "X:\Python38\lib\site-packages\matplotlib\cbook\__init__.py", line 216 in process
  File "X:\Python38\lib\site-packages\matplotlib\backend_bases.py", line 1797 in motion_notify_event
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 352 in motion_notify_event
  File "X:\Python38\lib\tkinter\__init__.py", line 1883 in __call__
  File "X:\Python38\lib\tkinter\__init__.py", line 1420 in mainloop
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 977 in mainloop
  File "X:\Python38\lib\site-packages\matplotlib\backend_bases.py", line 3302 in show
  File "X:\Python38\lib\site-packages\matplotlib\cbook\deprecation.py", line 413 in wrapper
  File "X:\Python38\lib\site-packages\matplotlib\pyplot.py", line 263 in show
  File "mpl_crash.py", line 14 in <module>

The crash occurs when y2 suddenly is one off relative to the height for unknown reason. Also, this is a rare event. It takes several hundreds of resizes of the Window to eventually crash.

This resize crash looks different from the alloc: invalid block: I also reported. I'm not sure yet that any of these two issues are related to the original issue of moving the cursor.

cgohlke · 2019-06-06T07:40:35Z

Here's another trace where I also printed canvas.figure.bbox:

0.0, 0.0 685.0 594.0
pyimage99 000002A7D81DDA50 000002A7D81DDA50 685 594 2740 685 594 0 685 0 594
0.0, 0.0 685.0, 594.0
pyimage99 000002A7D81DDA50 000002A7D81DDA50 685 594 2740 685 594 0 685 0 594
pyimage100 000002A7DF814500 000002A7DF814500 685 593 2740 685 593 0 685 0 593
pyimage100 000002A7DF814500 000002A7DF814500 685 593 2740 685 593 0 685 0 593
pyimage101 000002A7DA29E9C0 000002A7DA29E9C0 424 426 1696 424 426 0 424 0 426
pyimage101 000002A7DA29E9C0 000002A7DA29E9C0 424 426 1696 424 426 0 424 0 426
0.0, 0.0 424.0 426.99999999999994
> pyimage101 000002A7DA29E9C0 000002A7DA29E320 424 427 1696 424 426 0 424 0 427
Windows fatal exception: access violation

Current thread 0x00003d2c (most recent call first):
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 80 in blit
  File "X:\Python38\lib\site-packages\matplotlib\backends\backend_tkagg.py", line 14 in blit
  File "X:\Python38\lib\site-packages\matplotlib\widgets.py", line 1456 in _update
  File "X:\Python38\lib\site-packages\matplotlib\widgets.py", line 1444 in onmove
  File "X:\Python38\lib\site-packages\matplotlib\cbook\__init__.py", line 216 in process
  File "X:\Python38\lib\site-packages\matplotlib\backend_bases.py", line 1797 in motion_notify_event
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 353 in motion_notify_event
  File "X:\Python38\lib\tkinter\__init__.py", line 1883 in __call__
  File "X:\Python38\lib\tkinter\__init__.py", line 1420 in mainloop
  File "X:\Python38\lib\site-packages\matplotlib\backends\_backend_tk.py", line 978 in mainloop
  File "X:\Python38\lib\site-packages\matplotlib\backend_bases.py", line 3302 in show
  File "X:\Python38\lib\site-packages\matplotlib\cbook\deprecation.py", line 413 in wrapper
  File "X:\Python38\lib\site-packages\matplotlib\pyplot.py", line 263 in show
  File "mpl_crash.py", line 14 in <module>

The value 426.99999999999994 is rounded up to 427, one larger than the image height.

anntzer · 2019-06-06T09:22:22Z

Managed to repro it on Linux as well.

The core of the issue is that the figure bbox is not represented in pixel units but is transformed from inches, so there can be rounding errors when converting them to pixels.

cgohlke · 2019-06-06T17:30:51Z

With #14461 the crash in TK_PHOTO_PUT_BLOCK_NO_COMPOSITE is clearly gone. I also no longer seem to get any alloc: invalid block crash, so maybe that was due to a memory corruption when the out of bounds blit did not crash right away.

tacaswell added this to the v3.1.1 milestone May 15, 2019

tacaswell added GUI: tk topic: widgets/UI OS: Microsoft labels May 15, 2019

anntzer removed the OS: Microsoft label Jun 6, 2019

anntzer added the Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions. label Jun 6, 2019

This was referenced Jun 6, 2019

canvas.blit() already defaults to blitting the full figure canvas. #14460

Merged

Fix out of bounds read in backend_tk. #14461

Merged

tacaswell closed this as completed in #14461 Jun 7, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Matplotlib crashes on windows while maximizing plot window when using Multicursor #14225

Matplotlib crashes on windows while maximizing plot window when using Multicursor #14225

aliaa commented May 15, 2019

cgohlke commented Jun 5, 2019

cgohlke commented Jun 5, 2019

anntzer commented Jun 6, 2019

cgohlke commented Jun 6, 2019

cgohlke commented Jun 6, 2019

anntzer commented Jun 6, 2019

cgohlke commented Jun 6, 2019

Matplotlib crashes on windows while maximizing plot window when using Multicursor #14225

Matplotlib crashes on windows while maximizing plot window when using Multicursor #14225

Comments

aliaa commented May 15, 2019

Bug report

cgohlke commented Jun 5, 2019

cgohlke commented Jun 5, 2019

anntzer commented Jun 6, 2019

cgohlke commented Jun 6, 2019

cgohlke commented Jun 6, 2019

anntzer commented Jun 6, 2019

cgohlke commented Jun 6, 2019