Might be that it is too late, but I find it at least curious that the following few lines seem to be causing a segmentation fault if and only when compiled with gcc's optimization, even "-O1"!
settings_dialog = gtk_dialog_new_with_buttons("gatotray Settings"
, NULL, 0, GTK_STOCK_CANCEL, FALSE, GTK_STOCK_SAVE, TRUE, 0);
g_signal_connect(G_OBJECT(settings_dialog), "response", G_CALLBACK(gtk_widget_destroy), NULL);
g_signal_connect(G_OBJECT(settings_dialog), "destroy", G_CALLBACK(settings_destroyed), NULL);
GtkWidget *vb = gtk_dialog_get_content_area(GTK_DIALOG(settings_dialog));
GtkWidget *hb = gtk_hbox_new(FALSE, 3);
gtk_container_add(GTK_CONTAINER(hb), gtk_label_new("Background:"));
GtkWidget *cb = gtk_color_button_new();
gtk_container_add(GTK_CONTAINER(hb), cb);
gtk_container_add(GTK_CONTAINER(vb), hb);
This is the backtrace:
(gdb) backtrace
#0 0x00007ffff4d88052 in ?? () from /lib/libc.so.6
#1 0x00007ffff5304112 in g_strdup () from /lib/libglib-2.0.so.0
#2 0x00007ffff5bc799d in ?? () from /usr/lib/libgobject-2.0.so.0
#3 0x00007ffff5ba826c in g_object_new_valist ()
from /usr/lib/libgobject-2.0.so.0
#4 0x00007ffff5ba84f1 in g_object_new () from /usr/lib/libgobject-2.0.so.0
#5 0x00007ffff78502d5 in gtk_button_new_from_stock ()
from /usr/lib/libgtk-x11-2.0.so.0
#6 0x00007ffff787cc95 in gtk_dialog_add_button ()
from /usr/lib/libgtk-x11-2.0.so.0
#7 0x00007ffff787cd60 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#8 0x00007ffff787cf60 in gtk_dialog_new_with_buttons ()
from /usr/lib/libgtk-x11-2.0.so.0
#9 0x0000000000402bb9 in show_settings_dialog () at settings.c:24
#10 0x0000000000403328 in main (argc=1, argv=0x7fffffffe2b8) at gatotray.c:286
... settings.c:24 is exactly the first line listed above, seems like "gtk_dialog_new_with_buttons" is the culprit...
Versions:
gcc: 4.4.3
GTK+: 2.20.1
BTW, forgot to mention that commenting out certain lines after the conflictive call prevents it from happening. Particularly the line with "gtk_container_add(GTK_CONTAINER(hb), cb);"
I tried almost all suitable combinations of GtkTypes/GTK_MACROS, it makes no difference.
Long story short: use NULL when the manual says NULL, and not a plain 0!
(Since I can't choose the comments as an answer, I am writing the answer myself, giving credit to the helpful comments...)
GTK+ documentation states this:
GtkWidget*
gtk_dialog_new_with_buttons (const gchar *title,
GtkWindow *parent,
GtkDialogFlags flags,
const gchar *first_button_text,
...);
title : Title of the dialog, or NULL. allow-none.
parent : Transient parent of the dialog, or NULL. allow-none.
flags : from GtkDialogFlags
first_button_text : stock ID or text to go in first button, or NULL. allow-none.
... : response ID for first button, then additional buttons, ending with NULL
But I was lazy that night and typed just a '0' where the NULL was expected:
settings_dialog = GTK_DIALOG(gtk_dialog_new_with_buttons("gatotray Settings"
, NULL, 0, GTK_STOCK_CANCEL, FALSE, GTK_STOCK_SAVE, TRUE, 0));
... Not noticing that NULL is a pointer which in my 64-bits system is 64-bits wide, whereas 0 is a 32-bit integer...
Also, seems like in the variable argument list the compiler was not able to detect the inconsistency: the code compiled quietly with -Wall.
As Myforwik suggested and Havoc P further clarified, using 'NULL' there instead of the '0' fixed the issue. Thanks guys!
For the record, I did a test compiling in 32 bits mode where NULL is also 32-bits, and in that case there was no segfault. It is still incorrect though, since the documentation is clear enough, and NULL is not 0, no matter what the C++ committeemen ever say! ;-)
Related
I am trying to use Allegro 5's native file dialog addon, but I am getting a seg fault. This issue only occurs if I press the debug or launch button from the bottom of vscode, or if I run it from the CMake/Launch terminal within vscode.
My app does not seg fault if I run it from the bash terminal.
I believe I am having any issue with the vscode-cmake-tools, but I just cannot figure out what.
I have boiled it down to the below code triggering a seg fault, the al_show_native_file_dialog() line is where it crashes.
#include <stdio.h>
#include <allegro5/allegro.h>
#include <allegro5/allegro_native_dialog.h>
int main()
{
al_init();
al_init_native_dialog_addon();
ALLEGRO_DISPLAY *disp = al_create_display(800, 800);
ALLEGRO_FILECHOOSER *fc = al_create_native_file_dialog(NULL, "Test", NULL, ALLEGRO_FILECHOOSER_FILE_MUST_EXIST);
if (!fc || !disp) return 1;
al_show_native_file_dialog(disp, fc);
if (al_get_native_file_dialog_count(fc) > 0)
{
printf("%s\n", al_get_native_file_dialog_path(fc, 0));
}
al_destroy_native_file_dialog(fc);
al_destroy_display(disp);
return 0;
}
I've been told on the Allegro.cc forums that it can crash if I try to write to a protected location, but in this example it just opens a dialog showing your recent files.
I am posting here because it seems less like an Allegro issue (as it does work without issue running from the terminal), and more of a vscode problem I'm having.
Any ideas why it might crash when launching from one terminal and not the other?
EDIT:
Backtrace:
#0 __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:240
#1 0x00007ffff60b079d in () at /lib/x86_64-linux-gnu/libpng16.so.16
#2 0x00007ffff60a0538 in () at /lib/x86_64-linux-gnu/libpng16.so.16
#3 0x00007ffff60a09d8 in () at /lib/x86_64-linux-gnu/libpng16.so.16
#4 0x00007ffff60a0cbb in () at /lib/x86_64-linux-gnu/libpng16.so.16
#5 0x00007ffff60a0eab in png_process_data () at /lib/x86_64-linux-gnu/libpng16.so.16
#6 0x00007fffdc550cd9 in () at /snap/code/93/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-png.so
#7 0x00007ffff6b8e281 in () at /lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#8 0x00007ffff6b8eb15 in gdk_pixbuf_loader_close () at /lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#9 0x00007ffff6b8b233 in () at /lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#10 0x00007ffff6b8c2c1 in gdk_pixbuf_new_from_stream () at /lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#11 0x00007ffff76f257f in () at /lib/x86_64-linux-gnu/libgtk-3.so.0
Output of program in CMake/Launch terminal, and bash terminal:
I've been experimenting with wrapping some Qt classes with a C interface to use with my latest D project. For what ever reason, this code works fine on Windows but segfaults on Linux and I haven't been able to track down the reason behind it. I haven't tried building on OSX yet.
I'm using Qt 5.3, and running Linux Mint.
The code is kind of spread out over a few different files so I thought it might be easier if I put all the related code into some pastebins.
QApplication Wrapper Stuff
QMainWindow Wrapper Stuff
These are very thin wrappers though, so even if you don't look at them it should be easy enough to understand my test program.
#include <Application.h>
#include <MainWindow.h>
int main( int argc, char* argv[])
{
Qt_Application* app = Qt_Application_create(argc, argv);
Qt_MainWindow* window = Qt_MainWindow_create();
Qt_MainWindow_show(window);//<- Segfault happens here
Qt_Application_exec(app);
Qt_Application_destroy(app);
Qt_MainWindow_destroy(window);
return 0;
}
Due to some printf tests, I know the segfault happens on when I try to call Qt_MainWindow_show, and likewise I know the window object exists when I pass it so that isn't the cause. Also, if I comment Qt_MainWindow_show out, Qt_Application_exec will get called no problem so as far as I know the wrapped objects are being created correctly.
When I run gdb, it says:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff789a92a in strlen () from /lib/x86_64-linux-gnu/libc.so.6
getting the backtrace at the point of the segfault shows this:
#0 0x00007ffff789a92a in strlen () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007ffff6b6c6bc in QCoreApplication::arguments() ()
from /home/jebbs/Qt/5.3/gcc_64/lib/libQt5Core.so.5
#2 0x00007ffff1470213 in ?? ()
from /home/jebbs/Qt/5.3/gcc_64/plugins/platforms/libqxcb.so
#3 0x00007ffff14705f9 in ?? ()
from /home/jebbs/Qt/5.3/gcc_64/plugins/platforms/libqxcb.so
#4 0x00007ffff147d127 in ?? ()
from /home/jebbs/Qt/5.3/gcc_64/plugins/platforms/libqxcb.so
#5 0x00007ffff1470009 in ?? ()
from /home/jebbs/Qt/5.3/gcc_64/plugins/platforms/libqxcb.so
#6 0x00007ffff5d47e03 in QWindow::create() ()
from /home/jebbs/Qt/5.3/gcc_64/lib/libQt5Gui.so.5
#7 0x00007ffff716b97a in QWidgetPrivate::create_sys(unsigned long long, bool, bool) () from /home/jebbs/Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
#8 0x00007ffff714e6f5 in QWidget::create(unsigned long long, bool, bool) ()
from /home/jebbs/Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
#9 0x00007ffff71512ea in QWidget::setVisible(bool) ()
from /home/jebbs/Qt/5.3/gcc_64/lib/libQt5Widgets.so.5
#10 0x00007ffff7bd8205 in Qt_MainWindow_show ()
from /home/jebbs/Documents/projects/HeliosCTest/libqtcl.so.1
#11 0x0000000000400922 in main (argc=1, argv=0x7fffffffe158) at main.cpp:22 <-actually points to Qt_MainWindow_show(window), but this is from a test with printf's in it
So it looks like some string somewhere is NULL and strlen cries? I couldn't find any reason that QMainWindow.show() might segfault. Any pointers into where I should look or what I should do next would be an excellent help.
I'm getting a segfault when using libCURL in my HTTP flooder that I wrote for load-testing my site.
Here is the relevant code: https://gist.github.com/AppleDash/a26e0ce0b138cd9eacd2 (A bit large to paste here.)
Here's a link to the line it is segfaulting on: https://gist.github.com/AppleDash/a26e0ce0b138cd9eacd2#file-httpflood-improved-c-L57
And here is a backtrace of the segfault:
#0 0x00007ffff760d65b in fwrite () from /usr/lib/libc.so.6
#1 0x00007ffff79656d8 in ?? () from /usr/lib/libcurl.so.4
#2 0x00007ffff797a76b in ?? () from /usr/lib/libcurl.so.4
#3 0x00007ffff7984349 in ?? () from /usr/lib/libcurl.so.4
#4 0x00007ffff7984b11 in curl_multi_perform () from /usr/lib/libcurl.so.4
#5 0x00007ffff797b977 in curl_easy_perform () from /usr/lib/libcurl.so.4
#6 0x0000000000400f42 in flood (structPointer=0x7fffffffe060) at httpflood.c:57
#7 0x00007ffff7bc5124 in start_thread () from /usr/lib/libpthread.so.0
#8 0x00007ffff768b4bd in clone () from /usr/lib/libc.so.6
I don't see why this call would cause a segfault. Any ideas?
I know you're meant to only provide a small sample of relevant code, but here I am providing the whole thing due to the fact that I feel like context is needed here. (The fact it is being run from many threads and such.)
This is your problem:
for (i = 0; i < threadnum; i++) {
struct flood_data ddosData;
memset(&ddosData, 0, sizeof(struct flood_data));
ddosData.url = url;
ddosData.proxy = getProxy();
pthread_create(&threads[i], NULL, flood, (void *)&ddosData);
}
You're allocating a single struct flood_data instance on the stack and passing that to all of the new threads simultaneously. Each time you iterate through the loop, you overwrite the same instance at the same time that threads spawned from earlier iterations might be trying to read from it. Major undefined behavior.
The proper way to do this is to dynamically allocate a separate instance for each thread:
for (i = 0; i < threadnum; i++) {
struct flood_data *ddosData = calloc(1, sizeof(*ddosData));
ddosData->url = url;
ddosData->proxy = getProxy();
pthread_create(&threads[i], NULL, flood, ddosData);
}
...
void *flood(void *structPointer) {
struct flood_data *data = structPointer;
char *bootable = data->url;
char *proxy = data->proxy;
free(data);
...
}
As pointed out in the comments, you also need to check your system calls for failure. You should validate that all of your calls to fopen() are succeeding, as you could very well be hitting the maximum number of file descriptors open in your process. Rather than opening up a file to /dev/null, why don't you just set a no-op write function with the CURLOPT_WRITEFUNCTION option?
static size_t noop_write_callback(char *ptr, size_t size, size_t nmemb, void *userdata)
{
// Do nothing
return size * nmemb;
}
...
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, &noop_write_callback);
// No need to call fopen("/dev/null") or set CURLOPT_WRITEDATA now
I was testing out libspotify library (version 12.1.51 x86 for linux) and the application keeps crashing when I call sp_session_create() with a segmentation fault.
I don't have application key, nor a Premium Spotify account (yet), but that shouldn't be the reason for the crash, since if I remember correctly, there is an error code for invalid application key.
My code is as follows:
static uint_8_t g_appkey[] = {1, 2, 3};
static const char *username = "MyUsername";
static const char *password = "MyPassword";
static int logged_in;
static sp_session_callbacks session_callbacks;
static sp_session_config spconfig;
static void on_login(sp_session *session, sp_error error) {
printf("Callback: on_login");
if (error != SP_ERROR_OK) {
printf("Error: Unable to login: %d\n", (int) error);
exit(-1);
}
logged_in = 1;
}
static void on_main_thread_notified(sp_session *session) {
printf("callback: on_main_thread_notified");
}
static void on_log_message(sp_session *session, const char *data) {
printf("callback: on_log_message");
}
int main(int argc, char **argv) {
sp_error error;
sp_session *session;
int next_timeout;
/* struct fill */
memset(&session_callbacks, 0, sizeof(session_callbacks));
memset(&spconfig, 0, sizeof(spconfig));
session_callbacks.logged_in = &on_login;
session_callbacks.notify_main_thread = &on_main_thread_notified;
session_callbacks.log_message = &on_log_message;
spconfig.api_version = SPOTIFY_API_VERSION;
spconfig.cache_location = "tmp";
spconfig.settings_location = "tmp";
spconfig.application_key = g_appkey;
spconfig.application_key_size = sizeof(g_appkey);
spconfig.user_agent = "spot";
spconfig.callbacks = &session_callbacks;
/* session creation */
error = sp_session_create(&spconfig, &session);
if (error != SP_ERROR_OK) {
printf("ERROR: Unable to create spotify session: %s\n", sp_error_message(error));
exit(-1);
}
/* log in */
logged_in = 0;
sp_session_login(session, username, password, 0, NULL);
while(!logged_in) {
sp_session_process_events(session, &next_timeout);
sleep(next_timeout);
}
printf("Sucess!!");
exit(0);
}
Any tips for where could be the problem?
Appreciated for any help given.
backtrace from gdb:
[Thread debugging using libthread_db enabled]
[New Thread 0xb7fe6b70 (LWP 1839)]
[New Thread 0xb7f65b70 (LWP 1840)]
Program received signal SIGSEGV, Segmentation fault.
0x002b9b36 in sp_session_create () from /usr/local/lib/libspotify.so.12
(gdb) thread apply all backtrace
Thread 3 (Thread 0xb7f65b70 (LWP 1840)):
#0 0x0012d422 in __kernel_vsyscall ()
#1 0x003e6ce6 in nanosleep () at ../sysdeps/unix/syscall-template.S:82
#2 0x0041644c in usleep (useconds=10000) at ../sysdeps/unix/sysv/linux/usleep.c:33
#3 0x00293581 in ?? () from /usr/local/lib/libspotify.so.12
#4 0x00293990 in ?? () from /usr/local/lib/libspotify.so.12
#5 0x001d42b7 in ?? () from /usr/local/lib/libspotify.so.12
#6 0x004ae96e in start_thread (arg=0xb7f65b70) at pthread_create.c:300
#7 0x0041ca4e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
Thread 2 (Thread 0xb7fe6b70 (LWP 1839)):
#0 0x0012d422 in __kernel_vsyscall ()
#1 0x004b5245 in sem_wait##GLIBC_2.1 () at ../nptl/sysdeps/unix/sysv/linux/i386/i686/../i486/sem_wait.S:80
#2 0x002178fa in ?? () from /usr/local/lib/libspotify.so.12
#3 0x001d42b7 in ?? () from /usr/local/lib/libspotify.so.12
#4 0x004ae96e in start_thread (arg=0xb7fe6b70) at pthread_create.c:300
#5 0x0041ca4e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
Thread 1 (Thread 0xb7fe78d0 (LWP 1836)):
#0 0x002b9b36 in sp_session_create () from /usr/local/lib/libspotify.so.12
#1 0x080487d5 in main ()
(gdb)
Problem solved.
I got a valid application key from spotify, tested out my code and now it works.
It seems that the current live libspotify version has a bug when entering invalid application keys.
variables with storage class static do not need to be nullified, they are by default
/* struct fill */
memset(&session_callbacks, 0, sizeof(session_callbacks));
memset(&spconfig, 0, sizeof(spconfig));
Make sure these folders actually exist
EDIT: Actually cache_location should be created by the lib.
spconfig.cache_location = "tmp";
spconfig.settings_location = "tmp";
For a complete example see:
http://damienradtke.org/playing-with-the-spotify-api/
Your fake app-key is very short. Looking at a valid app-key, it's 321 bytes long and the first two bytes are the big-endian number 322. I'd guess that perhaps those first two bytes tell libspotify how big a null-terminated string it needs to allocate to store the whole key. If libspotify trusts that instead of application_key_size, that might be why it's crashing instead of returning an error.
I took this code and built it against libspotify-12, and got it to execute with the expected error about app ID:
libspotify/examples/jukebox$ make
cc -I/usr/include/alsa -I/home/nik/Code/spotify/libspotify/targets/Linux-x86_64-release/include -Wall -Wl,-rpath,/home/nik/Code/spotify/libspotify/targets/Linux-x86_64-release/lib -L/home/nik/Code/spotify/libspotify/targets/Linux-x86_64-release/lib jukebox.o appkey.o alsa-audio.o audio.o -o jukebox -lasound -lpthread -lspotify
libspotify/examples/jukebox$ ./jukebox
ERROR: Unable to create spotify session: Invalid application key
If you're having trouble getting things up and running, I would encourage you to take a look at the example code which ships with libspotify, specifically the jukebox example. In the above shell example, I just replaced jukebox.c with your code and got it to build with no problems.
It is possible that there is some bug here which was fixed in a later version of libspotify (disclaimer: I work for Spotify and actually compiled the above example with the latest 12.x code, which may contain some unreleased bugfixes). However, the code itself doesn't seem to do anything out of the ordinary, but again, if you're having problems I would suggest adapting jukebox.c to your purposes.
I’m trying to extend OCaml-Xlib with bindings for the MIT-SHM extension.
It’s the first time I’m trying to interface C with OCaml and I’ve never written anything in C, so I guess I’m doing something stupid somewhere.
I first added the XShmQueryExtension function. I added the following to the Xlib.ml file
external xShmQueryExtension: dpy:display -> bool = "ml_xShmQueryExtension"
the following to the wrap_xlib.c file
CAMLprim value
ml_xShmQueryExtension( value dpy )
{
int ans = XShmQueryExtension( Display_val(dpy) );
return Val_bool(ans);
}
I changed the Makefile to link with Xext, and it works: when I call the xShmQueryExtension function from OCaml I get true.
Now I’m trying to write a function creating a shared xImage, initializing the shared memory and attaching it to the X server. I added the following to the Xlib.ml file:
type xShmSegmentInfo
external xShmCreateImageAndAttach:
dpy:display -> visual:visual -> depth:int -> fmt:ximage_format
-> width:uint -> height:uint -> xShmSegmentInfo * xImage
= "ml_xShmCreateImageAndAttach_bytecode"
"ml_xShmCreateImageAndAttach"
and the following to the wrap_xlib.c file:
#define Val_XShmSegmentInfo(d) ((value)(d))
#define XShmSegmentInfo_val(v) ((XShmSegmentInfo *)(v))
CAMLprim value
ml_xShmCreateImageAndAttach( value dpy, value visual, value depth, value format,
value width, value height)
{
CAMLparam5(dpy, visual, depth, format, width);
CAMLxparam1(height);
CAMLlocal1(ret);
XShmSegmentInfo *shminfo = malloc(sizeof(XShmSegmentInfo));
XImage *ximage = XShmCreateImage(
Display_val(dpy),
Visual_val(visual),
Int_val(depth),
XImage_format_val(format),
NULL,
shminfo,
UInt_val(width),
UInt_val(height)
);
shminfo->shmid = shmget (IPC_PRIVATE,
ximage->bytes_per_line * ximage->height, IPC_CREAT|0777);
shminfo->shmaddr = ximage->data = (char *) shmat (shminfo->shmid, 0, 0);
if (shminfo->shmaddr == -1)
fprintf(stderr,"Error");
shminfo->readOnly = False;
XShmAttach (Display_val(dpy), shminfo);
ret = caml_alloc(2, 0);
Store_field(ret, 0, Val_XShmSegmentInfo(shminfo) );
Store_field(ret, 1, Val_XImage(ximage) );
CAMLreturn(ret);
}
CAMLprim value
ml_xShmCreateImageAndAttach_bytecode( value * argv, int argn )
{
return ml_xShmCreateImageAndAttach(argv[0], argv[1], argv[2], argv[3],
argv[4], argv[5]);
}
Now I’m calling this function in my OCaml program:
let disp = xOpenDisplay ""
let screen = xDefaultScreen disp
let (shminfo, image) = xShmCreateImageAndAttach disp
(xDefaultVisual disp screen)
(xDefaultDepth disp screen) ZPixmap 640 174
This is a toplevel call in my OCaml program, and I’m never using the variables shminfo and image again (this is just to test that the function work). This call does not fail, but my program segfault a little while after (the rest of my program constantly dump the screen with xGetImage and do stuff with the pixels, and I get a segfault in some xGetPixel which has nothing to do with the call to xShmCreateImageAndAttach above).
I noticed that if I remove the line shminfo->shmaddr = ximage->data = (char *) shmat (shminfo->shmid, 0, 0); I don’t get the segfault anymore (but of course this won’t do what I want).
I assume that this has to do with the garbage collector somehow but I don’t know how to fix it.
On the OCaml doc, there is a warning about casting pointers obtained with malloc to the value type, but I don’t really understand what it means and I don’t know if it’s relevant.
Edit:
I replaced the two lines following shmat by the following:
fprintf(stderr,"%i\n",(int)shminfo->shmaddr);
fflush(stderr);
and I get something like 1009700864, so the call to shmat seems to be working.
Here is the backtrace given by gdb:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7acdde8 in ?? () from /usr/lib/libX11.so.6
(gdb) backtrace
#0 0x00007ffff7acdde8 in ?? () from /usr/lib/libX11.so.6
#1 0x000000000044070c in ml_XGetPixel ()
#2 0x00000000004165b9 in camlInit__rvb_at_1023 () at init.ml:43
#3 0x0000000000415743 in camlParse__find_guy_1046 () at parse.ml:58
#4 0x000000000041610c in camlParse__pre_parse_1044 () at parse.ml:95
#5 0x0000000000415565 in camlGame__entry () at game.ml:26
#6 0x00000000004141f9 in caml_program ()
#7 0x000000000045c03e in caml_start_program ()
#8 0x000000000044afa5 in caml_main ()
#9 0x000000000044afe0 in main ()
The warning is relevant if X is going to call free() on the shminfo pointer that you're casting to the value type. The problem is that OCaml assumes that values can be freely copied and handled later by GC. This isn't true for your pointer value, so there will potentially be dangling copies of the pointer. Also, the space can get reused as part of OCaml's heap, and then you have real trouble.
It doesn't seem to me that X will do this, and since you don't call free() in your code, I don't think this is the problem. But it could be--I don't know how X works.
It might be good to call fflush(stderr) after your call to fprintf(). It probably won't change anything, but I've found my tracing messages tend to get buffered up and never appear when the program crashes.
It would also be good to know what the segfaulting address looks like. Is it near 0? Or a big address in the middle of the heap somewhere?
Sorry I can't pinpoint your error. I don't see anything you're doing wrong after 4 or 5 readings of the code, assuming Display_val and the rest are working correctly. But this is tricky to get right.