bugGNUstep - Bugs: bug #16031, -back: Segfault in XGServerEvent.m

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #16031: -back: Segfault in XGServerEvent.m

Submitted by:  Andrew Sveikauskas <asveikau>
Submitted on:  Tue 07 Mar 2006 10:55:30 PM UTC  
 
Category: BackendSeverity: 3 - Normal
Item Group: BugStatus: None
Privacy: PublicAssigned to: Fred Kiefer <FredKiefer>
Open/Closed: Closed

(Jump to the original submission Jump to the original submission)

Mon 27 Mar 2006 10:20:45 AM UTC, comment #7:

Closed as it is reported as fixed

Fred Kiefer <FredKiefer>
Project MemberIn charge of this item.
Mon 13 Mar 2006 03:00:52 AM UTC, comment #6:

SVN seems to fix the problem. Thanks a lot.

Andrew Sveikauskas <asveikau>
Sun 12 Mar 2006 11:32:05 PM UTC, comment #5:

I could not see the segmentation fault, but was able to see the described problem in valgrind. I submitted a change to SVN that solves this problem for me, by resetting the cached window in termwindow:
Could you please test this change and report the result?

Fred Kiefer <FredKiefer>
Project MemberIn charge of this item.
Sun 12 Mar 2006 04:54:08 PM UTC, comment #4:

I think I may have figured out a reliable way to reproduce this. If you put the cursor outside of a window and then hit Alt-W to close it. This usually generates a segfault on OpenBSD depending on memory usage (it only munmap()s if it has a page or more of unused data). Maybe to try to check this on Linux you could use valgrind. (I think I used to see this bug in valgrind output before, but never thought much of it until I started seeing segfaults on OpenBSD. I don't have access to a Linux box right now so I can't check.) I'm going out of town for a few days but I'll probably check back on this bug later.

Andrew Sveikauskas <asveikau>
Thu 09 Mar 2006 01:51:38 AM UTC, comment #3:

Thank you for pointing this out to me. I have a further look, but what you wrote may already be the problem.

Fred Kiefer <FredKiefer>
Project MemberIn charge of this item.
Thu 09 Mar 2006 12:53:32 AM UTC, comment #2:

No, it is also accessing it. Note that cWin is a macro for generic.cachedWindow. It then accesses cWin->number. After preprocessing this is generic.cachedWindow->number. Invalid pointer dereference... As for chasing the bug further, not sure. I'm not familiar with the way -back is organized nor very familiar with Xlib. But the problem seems to be that the structure is freed before any calls to NSMapRemove() (it seems to me like XGServerWindow-termwindow: does this.)

Andrew Sveikauskas <asveikau>
Thu 09 Mar 2006 12:30:38 AM UTC, comment #1:

I don't quite see how the behaviour you describe could happen. Within the LeaveNotify case the processEvent: method does only assign to the variable generic.cachedWindow. How could this ever cause a segmentation fault?
No idea who to go ahead from here. Do you have the skill to track down this bug a bit further?

Fred Kiefer <FredKiefer>
Project MemberIn charge of this item.
Tue 07 Mar 2006 10:55:30 PM UTC, original submission:

On OpenBSD, I occasionally get segfaults when I close an NSWindow. According to GDB this occurs in XGServerEvent-processEvent: with xEvent.type set to LeaveNotify. GDB also says that generic.cachedWindow is not a valid pointer. (The address looks like something on the heap, but GDB can't dereference it. My guess is that it's being accessed after it's free()d. On OpenBSD, free() returns data back to the kernel with munmap(), thus the segfault trying to access it later.)

Andrew Sveikauskas <asveikau>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 27 Mar 2006 10:20:45 AM UTCFredKieferOpen/ClosedIn Test=>Closed
Sun 12 Mar 2006 11:32:05 PM UTCFredKieferAssigned toNone=>FredKiefer
  Open/ClosedOpen=>In Test

Back to the top


Powered by Savane 3.1-cleanup1