bugGNUstep - Bugs: bug #23040, crasher in...

Group
 
 

bug #23040: crasher in NSNotificationCenter.m:464 on sparc64

Submitter:  Sebastian Reitenbach <buzzdee>
Submitted:  Thu 24 Apr 2008 06:24:56 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Duplicate
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 14 Jun 2008 08:26:39 AM UTC, comment #2: 

Fairly certainly this is that ffcall/ffi do not work properly on sparc64 .. so this is effectively a duplicate of #23039

Richard Frith-Macdonald <CaS>
Group Member
Wed 07 May 2008 06:26:21 PM UTC, comment #1: 

now, after recompiling gnustep-base against libffi, gdnc does not crash anymore, but the applications still crash, but in another place. Now the crasher is in NSDistributedNotificationCenter.m:780.



(file #15635)

Sebastian Reitenbach <buzzdee>
Group Member
Thu 24 Apr 2008 06:24:56 PM UTC, original submission:  

AddressManager and ProjectCenter, maybe other applications too, will crash, in case gdnc crashes when an application tries to connect to it. This happens on OpenBSD 4.3 sparc 64, with these versions installed:

gnustep-back-0.13.2
gnustep-base-1.15.3p0
gnustep-gui-0.13.2p1
gnustep-make-2.0.5
ffcall-1.10

gcc -v
Reading specs from /usr/lib/gcc-lib/sparc64-unknown-openbsd4.3/3.3.5/specs
Configured with:
Thread model: single
gcc version 3.3.5 (propolice)

Program received signal SIGSEGV, Segmentation fault.
listPurge (list=0x4ebea810, observer=0x4859cc10) at NSNotificationCenter.m:464
464               if (tmp->next->observer == observer)
Current language:  auto; currently objective-c
(gdb) bt
#0  listPurge (list=0x4ebea810, observer=0x4859cc10) at NSNotificationCenter.m:464
#1  0x000000004230c274 in -[NSNotificationCenter removeObserver:name:object:] (self=0x41a2c790, _cmd=0xfffffffffffbf670, observer=0x4859cc10,
    name=0x0, object=0x0) at NSNotificationCenter.m:507
#2  0x000000004230c74c in -[NSNotificationCenter removeObserver:] (self=0x41a2c790, _cmd=0x437d3100, observer=0x4859cc10)
    at NSNotificationCenter.m:932
#3  0x0000000043415334 in -[NSWindow dealloc] (self=0x4859cc10, _cmd=0x42766ef0) at NSWindow.m:716
#4  0x000000004231cb30 in -[NSObject release] (self=0x4859cc10, _cmd=0x43794fa8) at NSObject.m:1992
#5  0x000000004335f070 in -[NSMenu dealloc] (self=0x55897110, _cmd=0x42766ef0) at NSMenu.m:507
#6  0x000000004231cb30 in -[NSObject release] (self=0x55897110, _cmd=0x43798a30) at NSObject.m:1992
#7  0x000000004336a768 in -[NSMenuItem dealloc] (self=0x4c440810, _cmd=0x42766ef0) at NSMenuItem.m:119
#8  0x000000004231cb30 in -[NSObject release] (self=0x4c440810, _cmd=0x4379a0f0) at NSObject.m:1992
...

Previous frame identical to this frame (corrupt stack?)
(gdb) list NSNotificationCenter.m:507
502         }
503       else
504         {
505           Observation       *start = list;
506
507           list = listPurge(list, observer);
508           if (list == ENDOBS)
509             {
510               /*
511                * The list is empty so remove from map.
(gdb) list NSNotificationCenter.m:464
459       if (list != ENDOBS)
460         {
461           tmp = list;
462           while (tmp->next != ENDOBS)
463             {
464               if (tmp->next->observer == observer)
465                 {
466                   Observation       *next = tmp->next;
467
468                   tmp->next = next->next;
(gdb) print tmp->next->observer
Cannot access memory at address 0x0
(gdb) print observer
$1 = 0x4859cc10
(gdb) frame 1
#1  0x000000004230c274 in -[NSNotificationCenter removeObserver:name:object:] (self=0x41a2c790, _cmd=0xfffffffffffbf670, observer=0x4859cc10,
    name=0x0, object=0x0) at NSNotificationCenter.m:507
507           list = listPurge(list, observer);
(gdb) print list
$2 = list
(gdb) print  listPurge(list, observer);
Invalid character '
(gdb) print  listPurge(list, observer)

Program received signal SIGBUS, Bus error.
0x0000000042309b70 in listPurge (list=0x7, observer=0x4859cc10) at NSNotificationCenter.m:452
452       while (list != ENDOBS && list->observer == observer)
The program being debugged was signaled while in a function called from GDB.
GDB remains in the frame where the signal was received.
To change this behavior use "set unwindonsignal on"
Evaluation of the expression containing the function (listPurge) will be abandoned.

GNUMail doesn't crash at that point, it popups a window, showing an exception connection refused.

Sebastian Reitenbach <buzzdee>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #15635:  output.txt added by buzzdee (57KiB - text/plain - error messages before crash, gdb backtrace)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by buzzdee (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-06-14 CaS StatusNone Duplicate
        Open/ClosedOpen Closed
        Summarycrasher in NSNotificationCenter.m:464 when gdnc crashes crasher in NSNotificationCenter.m:464 on sparc64
    2008-05-07 buzzdee Attached File- Added output.txt, #15635

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code