[Gambas-user] Super cool crash when reading settings twice

[Tobias Boege]

Hi Benoit,

I have a crash in one of my projects. I managed to isolate the problem to
the attached project. I have a class which has a Settings As Collection
property for use with Settings' Read() and Write() methods.

What I now do is write the object to the settings and then read it *twice*
in a row (I hit the bug because I happened to initialise some module twice
during startup in my project). The Settings_Write() implementation is
crucial as it seems:

  Public Number As Integer

  Public Sub Settings_Write(Value As Collection)
    Number = Value["Number", 0]
  End

When executing this code, the interpreter segfaults somewhere deep down:

  Program received signal SIGSEGV, Segmentation fault.
  EXEC_object_real (val=val at ...2861...=0x7ffff65cd140, pobject=pobject at ...2861...=0x7fffffffddb8) at gbx_exec.c:1448
  1448    gbx_exec.c: No such file or directory.
  (gdb) bt
  #0  EXEC_object_real (val=val at ...2861...=0x7ffff65cd140, pobject=pobject at ...2861...=0x7fffffffddb8) at gbx_exec.c:1448
  #1  0x0000000000436033 in _push_array (code=code at ...2861...=960) at gbx_exec_loop.c:3576
  #2  0x0000000000438b70 in EXEC_loop () at gbx_exec_loop.c:573
  #3  0x000000000040a4a4 in EXEC_function_loop () at gbx_exec.c:931
  #4  0x000000000040ab7f in EXEC_function_real () at gbx_exec.c:895
  #5  0x000000000040dcbd in EXEC_pop_unknown () at gbx_exec_pop.c:257
  #6  0x00000000004385c3 in EXEC_loop () at gbx_exec_loop.c:672
  #7  0x000000000040a4a4 in EXEC_function_loop () at gbx_exec.c:931
  #8  0x000000000040ab7f in EXEC_function_real () at gbx_exec.c:895
  #9  0x000000000040b976 in EXEC_public_desc (class=<optimized out>, object=object at ...2861...=0x0, desc=desc at ...2861...=0x6746d8, nparam=nparam at ...2861...=0) at gbx_exec.c:1616
  #10 0x0000000000404829 in main (argc=1, argv=0x7fffffffe6a8) at gbx.c:416

This is the faulty line:

  1448         else if (!class->is_virtual)

The valgrind log reveals that there is something strange going on with the
"class" variable:

  ==1330== Invalid read of size 1
  ==1330==    at 0x40B862: EXEC_object_real (gbx_exec.c:1448)
  ==1330==    by 0x436032: _push_array (gbx_exec_loop.c:3576)
  ==1330==    by 0x438B6F: EXEC_loop (gbx_exec_loop.c:573)
  ==1330==    by 0x40A4A3: EXEC_function_loop (gbx_exec.c:931)
  ==1330==    by 0x40AB7E: EXEC_function_real (gbx_exec.c:895)
  ==1330==    by 0x40DCBC: EXEC_pop_unknown (gbx_exec_pop.c:257)
  ==1330==    by 0x4385C2: EXEC_loop (gbx_exec_loop.c:672)
  ==1330==    by 0x40A4A3: EXEC_function_loop (gbx_exec.c:931)
  ==1330==    by 0x40AB7E: EXEC_function_real (gbx_exec.c:895)
  ==1330==    by 0x404828: main (gbx.c:416)
  ==1330==  Address 0x2b is not stack'd, malloc'd or (recently) free'd
  ==1330==
  ==1330==
  ==1330== Process terminating with default action of signal 11 (SIGSEGV): dumping core
  ==1330==  Access not within mapped region at address 0x2B
  ==1330==    at 0x40B862: EXEC_object_real (gbx_exec.c:1448)
  ==1330==    by 0x436032: _push_array (gbx_exec_loop.c:3576)
  ==1330==    by 0x438B6F: EXEC_loop (gbx_exec_loop.c:573)
  ==1330==    by 0x40A4A3: EXEC_function_loop (gbx_exec.c:931)
  ==1330==    by 0x40AB7E: EXEC_function_real (gbx_exec.c:895)
  ==1330==    by 0x40DCBC: EXEC_pop_unknown (gbx_exec_pop.c:257)
  ==1330==    by 0x4385C2: EXEC_loop (gbx_exec_loop.c:672)
  ==1330==    by 0x40A4A3: EXEC_function_loop (gbx_exec.c:931)
  ==1330==    by 0x40AB7E: EXEC_function_real (gbx_exec.c:895)
  ==1330==    by 0x404828: main (gbx.c:416)

And the best thing is that if I replace the line

    Number = Value["Number", 0]

with either of

    Number = Value!Number  ' or
    Number = Value["Number"]

then there is no segfault. Also, if I read the settings only once, the crash
disappears.

Regards,
Tobi

-- 
"There's an old saying: Don't change anything... ever!" -- Mr. Monk
-------------- next part --------------
A non-text attachment was scrubbed...
Name: settings-segfault-0.0.1.tar.gz
Type: application/octet-stream
Size: 4542 bytes
Desc: not available
URL: <http://lists.gambas-basic.org/pipermail/user/attachments/20151007/7add2069/attachment.obj>