Re: balsa crash identified

[Frederick Ros <Frederick Ros ulticom com>]

OK, I put a watch point of the offending message field, and here's where
this field is overwritten :


chunk_free (ar_ptr=0x40579860, p=0x813f238) at malloc.c:3064
3064    malloc.c: No such file or directory.
1: *135525048 = 128
(gdb) where
#0  chunk_free (ar_ptr=0x40579860, p=0x813f238) at malloc.c:3064
#1  0x404ebad8 in __libc_free (mem=0x813f240) at malloc.c:2967
#2  0x40441b27 in g_free (mem=0xec15) at gmem.c:411
#3  0x4020167c in gtk_object_finalize (object=0x813f240) at
gtkobject.c:272
#4  0x402587ca in gtk_widget_finalize (object=0x813f240) at
gtkwidget.c:4440
#5  0x40249245 in gtk_viewport_finalize (object=0x813f240) at
gtkviewport.c:256
#6  0x40203664 in gtk_object_unref (object=0x813f240) at
gtkobject.c:1194
#7  0x40201566 in gtk_object_destroy (object=0x813f240) at
gtkobject.c:247
#8  0x40250ec9 in gtk_widget_destroy (widget=0x813f240) at
gtkwidget.c:1388
#9  0x40185509 in gtk_bin_forall (container=0x813e230,
include_internals=0,
    callback=0x8059824 <gtk_widget_destroy>, callback_data=0x0) at
gtkbin.c:276
#10 0x40219938 in gtk_scrolled_window_forall (container=0x813e230,
    include_internals=0, callback=0x8059824 <gtk_widget_destroy>,
    callback_data=0x0) at gtkscrolledwindow.c:567
#11 0x401abdd0 in gtk_container_foreach (container=0x813e230,
    callback=0x8059824 <gtk_widget_destroy>, callback_data=0x0)
    at gtkcontainer.c:1125
#12 0x401aac36 in gtk_container_destroy (object=0x813e230)
    at gtkcontainer.c:631
#13 0x402193e5 in gtk_scrolled_window_destroy (object=0x813e230)
    at gtkscrolledwindow.c:471
#14 0x401efd67 in gtk_marshal_NONE__NONE (object=0x813e230,
    func=0x402192f8 <gtk_scrolled_window_destroy>, func_data=0x0,
    args=0xbfffda4c) at gtkmarshal.c:312
#15 0x4021ef3d in gtk_signal_real_emit (object=0x813e230, signal_id=1,
    params=0xbfffda4c) at gtksignal.c:1492
#16 0x4021cef7 in gtk_signal_emit (object=0x813e230, signal_id=1)
    at gtksignal.c:552
#17 0x402015bc in gtk_object_shutdown (object=0x813e230) at
gtkobject.c:255
#18 0x4025862a in gtk_widget_shutdown (object=0x813e230) at
gtkwidget.c:4386
#19 0x4020155a in gtk_object_destroy (object=0x813e230) at
gtkobject.c:246
#20 0x40250ec9 in gtk_widget_destroy (widget=0x813e230) at
gtkwidget.c:1388
#21 0x402086dd in gtk_paned_forall (container=0x813d990,
include_internals=0,
    callback=0x8059824 <gtk_widget_destroy>, callback_data=0x0)
    at gtkpaned.c:497
#22 0x401abdd0 in gtk_container_foreach (container=0x813d990,
    callback=0x8059824 <gtk_widget_destroy>, callback_data=0x0)
    at gtkcontainer.c:1125
#23 0x401aac36 in gtk_container_destroy (object=0x813d990)
    at gtkcontainer.c:631
#24 0x401efd67 in gtk_marshal_NONE__NONE (object=0x813d990,
    func=0x401aab74 <gtk_container_destroy>, func_data=0x0,
args=0xbfffdefc)
    at gtkmarshal.c:312
#25 0x4021ef3d in gtk_signal_real_emit (object=0x813d990, signal_id=1,
    params=0xbfffdefc) at gtksignal.c:1492
#26 0x4021cef7 in gtk_signal_emit (object=0x813d990, signal_id=1)
    at gtksignal.c:552
#27 0x402015bc in gtk_object_shutdown (object=0x813d990) at
gtkobject.c:255
#28 0x4025862a in gtk_widget_shutdown (object=0x813d990) at
gtkwidget.c:4386
#29 0x4020155a in gtk_object_destroy (object=0x813d990) at
gtkobject.c:246
#30 0x40250ec9 in gtk_widget_destroy (widget=0x813d990) at
gtkwidget.c:1388
#31 0x402086dd in gtk_paned_forall (container=0x813db88,
include_internals=0,
    callback=0x8059824 <gtk_widget_destroy>, callback_data=0x0)
    at gtkpaned.c:497
#32 0x401abdd0 in gtk_container_foreach (container=0x813db88,
    callback=0x8059824 <gtk_widget_destroy>, callback_data=0x0)
    at gtkcontainer.c:1125
#33 0x401aac36 in gtk_container_destroy (object=0x813db88)
    at gtkcontainer.c:631
#34 0x401efd67 in gtk_marshal_NONE__NONE (object=0x813db88,
    func=0x401aab74 <gtk_container_destroy>, func_data=0x0,
args=0xbfffe3ac)
    at gtkmarshal.c:312
#35 0x4021ef3d in gtk_signal_real_emit (object=0x813db88, signal_id=1,
    params=0xbfffe3ac) at gtksignal.c:1492
#36 0x4021cef7 in gtk_signal_emit (object=0x813db88, signal_id=1)
    at gtksignal.c:552
#37 0x402015bc in gtk_object_shutdown (object=0x813db88) at
gtkobject.c:255
#38 0x4025862a in gtk_widget_shutdown (object=0x813db88) at
gtkwidget.c:4386
#39 0x4020155a in gtk_object_destroy (object=0x813db88) at
gtkobject.c:246

#40 0x40250ec9 in gtk_widget_destroy (widget=0x813db88) at
gtkwidget.c:1388
#41 0x4007daff in gnome_dock_forall () from /usr/lib/libgnomeui.so.32
#42 0x1062d in ?? ()
#43 0x8106370 in ?? ()
Cannot access memory at address 0xcb15


So it seems that a widget is screwing our message field.... Doesn't have
the time to look at that right now .. Perhaps someone with greater
knowledge on GTK than me could help :)

Best Regards.
Frederick Ros.

Frederick Ros wrote:
> 
> Here is what I have understodd just looking quickly at the code (so much
> work .. :( )
> 
> The object BalsaMessage contains a pointer to a LibBalsaMessage object.
> When the main window receives the destroy event, it handles it, and at
> some point the function libbalsa_mailbox_real_close is called, which in
> return calls
> libbalsa_mailbox_free_messages. This last function gets all the
> LibBalsaMessage of the mailbox and destroy it.
>
> Blah, blah , blah
> 
> Joaquim Fellmann wrote:
> >
> > Hye,
> >
> > I checked what Frederic Ros described :
> >
> > - run balsa.
> > - open a mailbox.
> > - select a message
> > - click on the small cross of the window, not on the File/Quit menu
> > - balsa crashes (every times I tried)
> >
> > running under gdb :
> >
> > Breakpoint 1, message_destroyed_cb (message=0x8175ca0, bm=0x806130c)
> >     at balsa-message.c:312
> > 312     balsa-message.c: Aucun fichier ou répertoire de ce type.
> > (gdb) print bm->message
> > $1 = (LibBalsaMessage *) 0x80a5e9a
> > (gdb) step
> > balsa_message_set (bm=0x813e110, message=0x0) at balsa-message.c:330
> > 330     in balsa-message.c
> > (gdb) print bm->message
> > $2 = (LibBalsaMessage *) 0x80
> >
> > bm->message is the symbol that causes problem. Before function
> > balsa_message_set (in message_destroyed_cb) , it's a significant value, but
> > at the very beginning of the function, it has an invalid value (0x80)
> >
> > Can someone explain this to me ?
> >
> > Thanks
> >
> > _______________________________________________
> > balsa-list mailing list
> > balsa-list@gnome.org
> > http://mail.gnome.org/mailman/listinfo/balsa-list
> 
> --
> Frederick Ros
> Ulticom, Inc
> Phone: +33.497.234.520
> Frederick.Ros@ulticom.com
> 
> _______________________________________________
> balsa-list mailing list
> balsa-list@gnome.org
> http://mail.gnome.org/mailman/listinfo/balsa-list

-- 
Frederick Ros
Ulticom, Inc
Phone: +33.497.234.520
Frederick.Ros@ulticom.com