Global variable in static library - double free or corruption error

["Alexey Skidanov" <Alexey dot Skidanov at orbotech dot com>]

Hello,
We use the gcc 4.1.1 in our project. After some code refactoring
(creating new shared library) the application crashes at exit with
following error:

*** glibc detected *** : double free or corruption (fasttop) ***

In order to simulate our application, I created the test one, with two
shared libraries and one static library. The code is below:

static.h

#ifndef STATIC
#define STATIC

using namespace std;

void set(int index, int value);

#endif /* STATIC */

static.cpp:

#include "static.h"
#include <stdio.h>

class TestClass {
public:
    TestClass() {
            printf("TestClass ctor %p %p\n", this, m_p);
            m_p = new int[10];
            printf("TestClass ctor %p\n", m_p);
    }
    ~TestClass() {
            printf("TestClass dtor %p %p\n", this, m_p);
            delete [] m_p;
            // m_p = NULL;

    }

    void set(int index, int value) {
            m_p[index] = value;
    }
    

private:
    int* m_p;

};



TestClass test_var;


void set(int index, int value) {
    test_var.set(index, value);
}

dynamic1.h

#ifndef DYNAMIC_1
#define DYNAMIC_1

void set1(int index, int value);

#endif /* DYNAMIC_1 */

dynamic1.cpp

#include "static.h"
#include "dynamic1.h"

void set1(int index, int value) {
    set(index, value);
}

dynamic2.h

#ifndef DYNAMIC_2
#define DYNAMIC_2

void set2(int index, int value);

#endif /* DYNAMIC_2 */

dynamic.cpp
#include "static.h"
#include "dynamic2.h"

void set2(int index, int value) {
    set(index, value);
}

main.cpp
#include "dynamic1.h"
#include "dynamic2.h"


int main() {

    set1(0, 0);
    set2(1, 1);

}

test application have been compiled:

g++  -g -c static.cpp -o static.o
ar rcs  libstatic.a static.o
g++ -g -shared -fPIC dynamic1.cpp -L. -lstatic -o libdynamic1.so
g++ -g -shared -fPIC dynamic2.cpp -L. -lstatic -o libdynamic2.so
g++ -g main.cpp -L. -ldynamic1 -ldynamic2  -o test

Running the test application I get the following:

TestClass ctor 0x60ca9c (nil)
TestClass ctor 0x936f008
TestClass ctor 0x60ca9c 0x936f008
TestClass ctor 0x936f038
TestClass dtor 0x60ca9c 0x936f038
TestClass dtor 0x60ca9c 0x936f038
*** glibc detected *** ./test: double free or corruption (fasttop):
0x0936f038 ***
======= Backtrace: =========
/lib/libc.so.6[0x178aa6]
/lib/libc.so.6(cfree+0x90)[0x17bfc0]
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0x953ef1]
/usr/lib/libstdc++.so.6(_ZdaPv+0x1d)[0x953f4d]
./libdynamic1.so(_ZN9TestClassD1Ev+0x38)[0x60b7b8]
./libdynamic2.so[0x11071a]
/lib/libc.so.6(__cxa_finalize+0xa9)[0x13db09]
./libdynamic2.so[0x1105f3]
./libdynamic2.so[0x11080c]
/lib/ld-linux.so.2[0x48e6de]
/lib/libc.so.6(exit+0xe9)[0x13d859]
/lib/libc.so.6(__libc_start_main+0xe4)[0x127df4]
./test(__gxx_personality_v0+0x31)[0x8048491]
======= Memory map: ========
00110000-00111000 r-xp 00000000 00:12 4091188
/home/alexey-s/Samples/SingletonInStatic/libdynamic2.so
00111000-00112000 rwxp 00000000 00:12 4091188
/home/alexey-s/Samples/SingletonInStatic/libdynamic2.so
00112000-0024c000 r-xp 00000000 08:02 265363     /lib/libc-2.5.so
0024c000-0024e000 r-xp 0013a000 08:02 265363     /lib/libc-2.5.so
0024e000-0024f000 rwxp 0013c000 08:02 265363     /lib/libc-2.5.so
0024f000-00252000 rwxp 0024f000 00:00 0
00480000-00499000 r-xp 00000000 08:02 265342     /lib/ld-2.5.so
00499000-0049a000 r-xp 00019000 08:02 265342     /lib/ld-2.5.so
0049a000-0049b000 rwxp 0001a000 08:02 265342     /lib/ld-2.5.so
00538000-00539000 r-xp 00538000 00:00 0          [vdso]
005e4000-00609000 r-xp 00000000 08:02 265370     /lib/libm-2.5.so
00609000-0060a000 r-xp 00024000 08:02 265370     /lib/libm-2.5.so
0060a000-0060b000 rwxp 00025000 08:02 265370     /lib/libm-2.5.so
0060b000-0060c000 r-xp 00000000 00:12 4091181
/home/alexey-s/Samples/SingletonInStatic/libdynamic1.so
0060c000-0060d000 rwxp 00000000 00:12 4091181
/home/alexey-s/Samples/SingletonInStatic/libdynamic1.so
00887000-00892000 r-xp 00000000 08:02 265372
/lib/libgcc_s-4.1.2-20070626.so.1
00892000-00893000 rwxp 0000a000 08:02 265372
/lib/libgcc_s-4.1.2-20070626.so.1
008a0000-00980000 r-xp 00000000 08:02 3115867
/usr/lib/libstdc++.so.6.0.8
00980000-00983000 r-xp 000e0000 08:02 3115867
/usr/lib/libstdc++.so.6.0.8
00983000-00985000 rwxp 000e3000 08:02 3115867
/usr/lib/libstdc++.so.6.0.8
00985000-0098b000 rwxp 00985000 00:00 0
08048000-08049000 r-xp 00000000 00:12 4091189
/home/alexey-s/Samples/SingletonInStatic/test
08049000-0804a000 rw-p 00000000 00:12 4091189
/home/alexey-s/Samples/SingletonInStatic/test
0936f000-09390000 rw-p 0936f000 00:00 0
b7e00000-b7e21000 rw-p b7e00000 00:00 0
b7e21000-b7f00000 ---p b7e21000 00:00 0
b7fba000-b7fbc000 rw-p b7fba000 00:00 0
b7fda000-b7fdc000 rw-p b7fda000 00:00 0
bf844000-bf859000 rw-p bf844000 00:00 0          [stack]
Abort

Static library defines some global variable (test_var), that during
library linking "injected" into the dynamic library bss segment.
Actually, static.o object file is linked with dynamic1.o and with
dynamic2.o files. 
Please, pay attention that constructor and destructor of the SAME
INSTANCE (at address 0x60ca9c) of global variable were called twice - at
each dynamic library start up. Generally, it seems that this is partial
solution of double definition problem during main application linking:  
Dynamic linker somehow merges two definition of the same global variable
- but each shared library start up code contains calls of this variable
constructor and destructor.

I would expect that TWO different instances of the global variable would
be created in TWO different shared libraries - maybe with name mangling.


Is this a linker/loader bug? Can we cause (by linker/loader options)
linker/loader more consistent behavior?

Thanks,
Alexey