[openi18n-im:01104] Re: report on unitLE crashes

Leon,
it seems that the initial allocation to inpinfo->mcch is missing?
Adding 

    inpinfo->mcch = calloc(1, mcch_size * sizeof(wch_t));

before the do loop for realloc in match_keystroke will fix the problem.

Also, practically it works, but efence does not allow :-) is the code
in freeConf() in xmlconf.c
        while( node != inputstyles->last ){
            free(node);
            node = node->next;
	}

We changed it to 

        imnodes *temp;
        while( node != inputstyles->last ){
            temp = node;
            node = node->next;
            free(temp);
        }

then the problems are gone...Just a live update.:-).

> From: Hideki Hiura <[email protected]>
> Subject: [openi18n-im:01102] Re: report on unitLE crashes
> Date: Mon, 25 Oct 2004 18:20:32 -0700 (PDT)
>
> Leon,
> 
> > From: Leon Ho <[email protected]>
> > Anyone see this segfault from unitLE? This happens when starts loading
> > or switching to unitLE (i.e. LANG=bn_IN.UTF-8 gedit)
> 
> This seems to be memery trashing, so the trashing might happen somewhere
> before.
> 
> So we linked htt_server with efence to trace this problem, and efence
> caught the suspected memory trash when we switched between xcin and unit.
> As you know the efence detects the memory overrun or accessing to the
> already freed memory by causing segfault, so this does not happen if you
> don't link with efence. 
> 
> So it seems that we need to check the validity of the arguments passed all the way to match_keystroke().
> 
> I'm not sure if this is the reason, but if there is a memory trashing in 
> xcin, and crashing in unit happens when you switch from xcin to unit, it
> explains that we have not seen til you've reported , as we did not test 
> with the xcin module before....but they can be totally different two 
> problems :-).
> 
> 
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 1104403376 (LWP 31007)]
> 0x40339173 in memmove () from /lib/tls/libc.so.6
> (gdb) where 10
> #0  0x40339173 in memmove () from /lib/tls/libc.so.6
> #1  0x41a0cfae in match_keystroke (cf=0x4c233000, inpinfo=0x4c237000, iccf=0x4ce16000)
>     at gen_inp.c:153
> #2  0x41a0fa4f in receive_keylist (s=0x4b9c4000, keylist=0xf46f5000) at key_event.c:271
> #3  0x41a0c1e2 in if_xcin_SendEvent (s=Variable "s" is not available.
> ) at xcin.c:674
> #4  0x08089b23 in if_SendEvent (s=0x4b9c4000, e=0x41d3d940) at SunIM.c:472
> #5  0x0806e76d in LEContext::send_event (this=0x4b9b8000, pimlex=0x4204d000, pimevent=0x41d3d940)
>     at LE.cpp:396
> #6  0x080730a5 in IMInputContext::send_event (this=0x4204b000, pimlex=0x4204d000, 
>     pimevent=0x41d3d940) at IMInputContext.cpp:117
> #7  0x0807fa3b in IIIMP_ICState_REQUESTED::forward_event (this=0x4ce14000, pmes=0x4ce0c000)
>     at IIIMP_ICState.cpp:650
> #8  0x0807d465 in IIIMP_ICState::message_proc (this=0x4204f000, x_pmes=0x4ce0c000)
>     at IIIMP_ICState.cpp:79
> #9  0x080773bd in ICState::deliver (this=0x4204f000, message=0x4ce0c000) at ICState.cpp:17