bugGNUstep - Bugs: bug #39072, Gorm segfaults trying to rename...

Group
 
 

bug #39072: Gorm segfaults trying to rename ImageWindow of LaternaMagica

Submitter:  Sebastian Reitenbach <buzzdee>
Submitted:  Sun 26 May 2013 09:23:22 AM UTC
   
 
Category:  Gorm Severity:  4 - Important
Item Group:  Bug Status:  Ready For Test
Privacy:  Public Assigned to:  gcasa
Open/Closed:  In Test
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 25 May 2014 06:30:25 PM UTC, comment #3: 

Sebastian, does still reproduce for you?
I just tried on NetBSD with Gorm and the LaternaMagica file and it did not crash.

Riccardo Mottola <rmottola>
Group Member
Mon 27 May 2013 08:33:12 AM UTC, comment #2: 

Thanks Fred,

I tried this:

--- GormCore/GormDocument.m.orig        Mon May 27 09:47:59 2013
+++ GormCore/GormDocument.m     Mon May 27 09:48:58 2013
@@ -2211,7 +2211,9 @@ static void _real_close(GormDocument *self,
       className = [cc objectForKey: oldName];
       if(className != nil)
        {
+         RETAIN(oldName);
          [cc removeObjectForKey: oldName];
+         RELEASE(oldName);
          [cc setObject: className forKey: aName];
        }
     }

But it still crashes the same way.

But something else I recognized:
With the NSLog I had there before:
NSLog(@"the OLD name %@ and its class name: %@, and cc: %@", oldName, className, cc);

it printed:
2013-05-26 10:49:08.130 Gorm[27147] the OLD name ImageWindow and its class name: LMWindow, and cc: {ImageView = LMFlipView; ImageWindow = LMWindow; }

The class name is an LMWindow, a custom class. But when you click in the Gorm main window on the ImageWindow icon, and have the Gorm Inspector open, showing the "Custom Class" panel, then the class listed there is just an NSWindow. I don't know if this should have printed LMWindow there? LMWindow is a subclass of NSWindow.
But it may also have nothing to do with it.
The other windows/panels in LaternaMagica don't seem to be custom classes, and can be renamed fine.

Sebastian Reitenbach <buzzdee>
Group Member
Sun 26 May 2013 10:57:22 PM UTC, comment #1: 

From the code snippet I would guess that this is caused by className being freed up right in the middle. Try to add RETAIN() just before line 2216 and RELEASE() after line 2217 to that variable.

Fred Kiefer <FredKiefer>
Group Member
Sun 26 May 2013 09:23:22 AM UTC, original submission:  

How to reproduce:

  • open LaternaMagica interface from GAP in Gorm.
  • in Gorms main window in the Objects view, activate the ImageWindow with the mouse
  • activate Gorms menu -> Edit -> Set Name...
  • enter a new name, and click the set name button


Backtrace is as follows:

2013-05-26 10:49:08.130 Gorm[27147] the OLD name ImageWindow and its class name: LMWindow, and cc: {ImageView = LMFlipView; ImageWindow = LMWindow; }
2013-05-26 10:49:08.130 Gorm[27147] className was not NIL

Program received signal SIGSEGV, Segmentation fault.
0x000000020e5645c0 in objc_msgSend_fpret () from /usr/local/lib/libobjc2.so.1.0
(gdb) bt
#0  0x000000020e5645c0 in objc_msgSend_fpret () from /usr/local/lib/libobjc2.so.1.0
#1  0x0000000207386aa8 in GSIMapAddPair (map=0x20c502590, key=..., value=...)
    at ../Headers/GNUstepBase/GSIMap.h:1087
#2  0x0000000207387952 in -[GSMutableDictionary setObject:forKey:] (self=0x20c502588,
    _cmd=0x206431d70 <.objc_selector_list+4672>, anObject=0x204c67d28, aKey=0x205114708) at GSDictionary.m:439
#3  0x000000020618592b in -[GormDocument setName:forObject:] (self=0x20f75e408,
    _cmd=0x6178d0 <.objc_selector_list+1456>, aName=0x205114708, object=0x20bd9b608) at GormDocument.m:2217
#4  0x000000000040a2b8 in -[Gorm setName:] (self=0x20fc22408, _cmd=0x20bb0c2e0, sender=0x20f773a08)
    at Gorm.m:742
#5  0x000000020cbf2b78 in -[NSApplication sendAction:to:from:] (self=0x20fc22408,
    _cmd=0x20d1c0bc0 <.objc_selector_list+1456>, aSelector=0x20bb0c2e0, aTarget=0x0, sender=0x20f773a08)
    at NSApplication.m:2230
#6  0x000000020cd00da4 in -[NSMenu performActionForItemAtIndex:] (self=0x20f771108,
    _cmd=0x20d1c37d0 <.objc_selector_list+1744>, index=5) at NSMenu.m:1320
#7  0x000000020cd0eac5 in -[NSMenuView _trackWithEvent:startingMenuView:] (self=0x20f775408,
    _cmd=0x20d1c3400 <.objc_selector_list+768>, event=0x20813bf08, mainWindowMenuView=0x0) at NSMenuView.m:1819
#8  0x000000020cd0ec20 in -[NSMenuView trackWithEvent:] (self=0x20f775408,
    _cmd=0x20d1c3120 <.objc_selector_list+32>, event=0x206bc0188) at NSMenuView.m:1851
#9  0x000000020cd0eee8 in -[NSMenuView mouseDown:] (self=0x20f775408,
    _cmd=0x20d23b510 <.objc_selector_list+4192>, theEvent=0x206bc0188) at NSMenuView.m:1891
#10 0x000000020ce3c1a0 in -[NSWindow sendEvent:] (self=0x20e379808,
    _cmd=0x20d15d8b0 <.objc_selector_list+1360>, theEvent=0x206bc0188) at NSWindow.m:3790
#11 0x000000020cbf2527 in -[NSApplication sendEvent:] (self=0x20fc22408,
---Type <return> to continue, or q <return> to quit---
    _cmd=0x20d15d8b0 <.objc_selector_list+1360>, theEvent=0x206bc0188) at NSApplication.m:2105
#12 0x000000020cbf0a3d in -[NSApplication run] (self=0x20fc22408, _cmd=0x20d151c50 <.objc_selector_list+592>)
    at NSApplication.m:1562
#13 0x000000020cbc384a in NSApplicationMain (argc=1, argv=0x7f7ffffd54c0) at Functions.m:91
#14 0x000000000040d5cb in gnustep_base_user_main (argc=1, argv=0x7f7ffffd54c0) at main.m:30
#15 0x000000020752077a in main (argc=1, argv=0x7f7ffffd54c0, env=0x7f7ffffd54d0) at NSProcessInfo.m:984
#16 0x00000000004065a1 in ___start ()
#17 0x0000000000000001 in ?? ()
#18 0x00007f7ffffd55d8 in ?? ()
#19 0x0000000000000000 in ?? ()

The two lines of output are from frame #3:
(gdb) frame 3
#3  0x000000020618592b in -[GormDocument setName:forObject:] (self=0x20f75e408,
    _cmd=0x6178d0 <.objc_selector_list+1456>, aName=0x205114708, object=0x20bd9b608) at GormDocument.m:2217
2217              [cc setObject: className forKey: aName];
(gdb) list
2212    NSLog(@"the OLD name %@ and its class name: %@, and cc: %@", oldName, className, cc);
2213          if(className != nil)
2214            {
2215    NSLog(@"className was not NIL");
2216              [cc removeObjectForKey: oldName];
2217              [cc setObject: className forKey: aName];
2218            }
2219        }
2220   
2221      // release oldName, if we get to this point.


This is always reproducible.
Running latest releases of gnustep libobjc2, -base, -gui, Gorm on OpenBSD 5.3 -current amd64.


Sebastian Reitenbach <buzzdee>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gcasa (Updated the item)
  • -email is unavailable- added by rmottola (Posted a comment)
  • -email is unavailable- added by FredKiefer (Posted a comment)
  • -email is unavailable- added by buzzdee (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-27 gcasa StatusConfirmed Ready For Test
        Open/ClosedOpen In Test
    2014-05-26 gcasa StatusNone Confirmed
        Assigned toNone gcasa
    2013-05-26 FredKiefer Item GroupNone Bug

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code