Crashes in connection with annotations

Urs Holzer <[email protected]> Thu, 31 Jan 2008 22:30:50 +0100

Newsgroups	gmane.comp.web.amaya.devel
Message-ID	<[email protected]>

Hi

Long ago I reported this bug, however nobody took care of it. Also, the 
bug itself is quite old. It was introduced somewhere around version 
8.5. I investigated the problem a little bit. I found out more than I 
reported last time. I ask myself why no-one else complains about this 
problem. Does nobody use the annotations functionality anymore?

I observe the following:

1. When I load annotations of a page which actually has no annotations 
at all, Amaya crashes with
*** glibc detected *** double free or corruption (!prev): 
0x000000000427d000 ***

2. When I load annotations of a page which has at least one annotation, 
everything works well. But as soon as this page gets cleaned away, 
Amaya crashes with a segmentation fault.
With "cleaned away" I mean the following:
- I close the tab or window
- I enter another URI and laod it in the same tab
- I follow a link and load its target in the same tab
- I close Amaya

I used a debugger to make backtraces for both cases. They are attached, 
bt_1.txt and bt_2.txt

Looking at the backtrace of situation 2, I see that the crash really 
happens while closing a document. I guess that something gets freed 
twice. However, Backtrace 2 does not indicate where to look for the 
problem. But backtrace 1 is interesting. There we find that
RemoteLoad_callback at annotlib/ANNOTevent.c:591 calls TtaFreeMemory. 
This line is:
  TtaFreeMemory (ctx->remoteAnnotIndex);

I simply have commented out this line and looked what happens. And 
indeed, both crashes described above are gone. Of course this might have 
introduced a memory leak ...

I give up at this point. I hope that the Amaya developers will be able 
to eliminate this bug this time.

For the sake of completeness:
I tested it on Debian Linux Etch x86 as well as x86_64.

Greetings
Urs

bt_1.txt (text/plain, 3 KB)

#0  0x00002b2af3b5207b in raise () from /lib/libc.so.6
#1  0x00002b2af3b5384e in abort () from /lib/libc.so.6
#2  0x00002b2af3b886e9 in __fsetlocking () from /lib/libc.so.6
#3  0x00002b2af3b8f253 in mallopt () from /lib/libc.so.6
#4  0x00002b2af3b8f2de in free () from /lib/libc.so.6
#5  0x00000000005a397c in TtaFreeMemory (ptr=0x427d000) at ../../thotlib/base/memory.c:162
#6  0x000000000057e52c in RemoteLoad_callback (doc=1, status=0, urlName=0x4279fc0 "http://annotea.andonyar.com/test/",
    outputfile=0x4279af0 "/home/urs/.amaya/1/0010AM", proxyName=0x0, http_headers=0x427aed0, context=0x427f700) at ../../annotlib/ANNOTevent.c:591
#7  0x0000000000521672 in ProcessTerminateRequest (request=0x427f4f0, response=0x427b040, param=0x0, status=200) at ../../amaya/AHTBridge.c:221
#8  0x0000000000529c03 in terminate_handler (request=0x427f4f0, response=0x427b040, context=0x0, status=200) at ../../amaya/query.c:1519
#9  0x000000000078bb2f in HTNetCall_executeAfter (list=0x36cdf10, request=0x427f4f0, status=200)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTNet.c:314
#10 0x000000000078bdf5 in HTNet_executeAfterAll (request=0x427f4f0, status=200) at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTNet.c:420
#11 0x000000000078ce26 in HTNet_delete (net=0x42b6920, status=200) at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTNet.c:920
#12 0x000000000075d1e6 in HTTPCleanup (req=0x427f4f0, status=200) at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTTP.c:176
#13 0x0000000000760686 in HTTPEvent (soc=26, pVoid=0x42b7200, type=HTEvent_READ)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTTP.c:1331
#14 0x0000000000785fee in HostEvent (soc=26, pVoid=0x427fad0, type=HTEvent_READ)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTHost.c:201
#15 0x0000000000754aa7 in HTEventList_dispatch (s=26, type=HTEvent_READ, now=1201805904052)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTEvtLst.c:581
#16 0x00000000005215a7 in AHTCallback_bridgeWX (register_id=1, socket=26, condition=WXAMAYASOCKET_READ) at ../../amaya/AHTBridge.c:187
#17 0x00000000005a2d64 in wxAmayaSocketEvent::CheckSocketStatus (bloking_time=0) at ../../thotlib/base/wxAmayaSocketEvent.cpp:196
#18 0x00000000005a2fc8 in wxAmayaSocketEventLoop::Notify (this=0x3403290) at ../../thotlib/base/wxAmayaSocketEventLoop.cpp:82
#19 0x000000000088eb84 in timeout_callback ()
#20 0x00002b2af30dfe1b in g_source_get_current_time () from /usr/lib/libglib-2.0.so.0
#21 0x00002b2af30df913 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#22 0x00002b2af30e275d in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#23 0x00002b2af30e2a46 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#24 0x00002b2af1bea6b2 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#25 0x0000000000964860 in wxEventLoop::Run ()
#26 0x00000000008e9554 in wxAppBase::MainLoop ()
#27 0x00000000009b3ef0 in wxEntry ()
#28 0x0000000000666630 in main (argc=1, argv=0x7fffb97c8eb8) at ../../thotlib/base/AmayaApp.cpp:43

bt_2.txt (text/plain, 4.2 KB)

#0  0x00002b3ceaba9295 in free () from /lib/libc.so.6
#1  0x00000000005a397c in TtaFreeMemory (ptr=0x58) at ../../thotlib/base/memory.c:162
#2  0x00000000005a3d5f in FreeSchStruc (pSS=0x422edd0) at ../../thotlib/base/memory.c:1663
#3  0x00000000005cb5d0 in ReleaseStructureSchema (pSS=0x422edd0, pDoc=0x36d8ba0) at ../../thotlib/document/schemas.c:866
#4  0x00000000005cc418 in FreeDocumentSchemas (pDoc=0x36d8ba0) at ../../thotlib/document/schemas.c:1470
#5  0x00000000005c1266 in UnloadDocument (pDoc=0x7fffc27ab0a8) at ../../thotlib/document/documentapi.c:263
#6  0x000000000064c8f7 in TCloseDocument (pDoc=0x36d8ba0) at ../../thotlib/view/displayview.c:446
#7  0x000000000064c98f in CloseDocumentView (pDoc=0x36d8ba0, view=1, closeDoc=true) at ../../thotlib/view/displayview.c:519
#8  0x000000000064caa3 in CleanImageView (View=1, pDoc=0x36d8ba0, complete=true) at ../../thotlib/view/displayview.c:582
#9  0x000000000064cc6a in TtaFreeView (document=1, view=1) at ../../thotlib/view/displayview.c:967
#10 0x00000000004e7067 in InitDocAndView (oldDoc=1, replaceOldDoc=true, inNewWindow=false, docname=0x42a2000 "noname.html", docType=docHTML,
    sourceOfDoc=0, readOnly=false, profile=4, method=1) at ../../amaya/init.c:2180
#11 0x00000000004ea41b in LoadDocument (doc=1, pathname=0x429b420 "http://www.andonyar.com/math/", form_data=0x0,
    initial_url=0x41cbd30 "http://www.andonyar.com/math/", method=1, tempfile=0x429b750 "/home/urs/.amaya/1/0007AM", documentname=0x42a2000 "noname.html",
    http_headers=0x42042d0, history=true, inNewWindow=0x7fffc27ac3bf, realdocname=0x0) at ../../amaya/init.c:3313
#12 0x00000000004eb2d2 in GetAmayaDoc_callback (newdoc=1, status=0, urlName=0x4204690 "http://www.andonyar.com/math/",
    outputfile=0x4204360 "/home/urs/.amaya/1/0007AM", proxyName=0x0, http_headers=0x42042d0, context=0x41cb9d0) at ../../amaya/init.c:4496
#13 0x0000000000521672 in ProcessTerminateRequest (request=0x42a0c90, response=0x41cb2c0, param=0x0, status=200) at ../../amaya/AHTBridge.c:221
#14 0x0000000000529c03 in terminate_handler (request=0x42a0c90, response=0x41cb2c0, context=0x0, status=200) at ../../amaya/query.c:1519
#15 0x000000000078bb2f in HTNetCall_executeAfter (list=0x36cdeb0, request=0x42a0c90, status=200)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTNet.c:314
#16 0x000000000078bdf5 in HTNet_executeAfterAll (request=0x42a0c90, status=200) at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTNet.c:420
#17 0x000000000078ce26 in HTNet_delete (net=0x4204a20, status=200) at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTNet.c:920
#18 0x000000000075d1e6 in HTTPCleanup (req=0x42a0c90, status=200) at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTTP.c:176
#19 0x0000000000760686 in HTTPEvent (soc=25, pVoid=0x412a700, type=HTEvent_READ)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTTP.c:1331
#20 0x0000000000785fee in HostEvent (soc=25, pVoid=0x410b300, type=HTEvent_READ)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTHost.c:201
#21 0x0000000000754aa7 in HTEventList_dispatch (s=25, type=HTEvent_READ, now=1201807629505)
    at /home/urs/bin/AmayaHEAD/Amaya/linux/../../libwww/Library/src/HTEvtLst.c:581
#22 0x00000000005215a7 in AHTCallback_bridgeWX (register_id=0, socket=25, condition=WXAMAYASOCKET_READ) at ../../amaya/AHTBridge.c:187
#23 0x00000000005a2d64 in wxAmayaSocketEvent::CheckSocketStatus (bloking_time=0) at ../../thotlib/base/wxAmayaSocketEvent.cpp:196
#24 0x00000000005a2fc8 in wxAmayaSocketEventLoop::Notify (this=0x353d5c0) at ../../thotlib/base/wxAmayaSocketEventLoop.cpp:82
#25 0x000000000088eb84 in timeout_callback ()
#26 0x00002b3cea0f9e1b in g_source_get_current_time () from /usr/lib/libglib-2.0.so.0
#27 0x00002b3cea0f9913 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#28 0x00002b3cea0fc75d in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#29 0x00002b3cea0fca46 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#30 0x00002b3ce8c046b2 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#31 0x0000000000964860 in wxEventLoop::Run ()
#32 0x00000000008e9554 in wxAppBase::MainLoop ()
#33 0x00000000009b3ef0 in wxEntry ()
#34 0x0000000000666630 in main (argc=1, argv=0x7fffc27acea8) at ../../thotlib/base/AmayaApp.cpp:43