Re: [GnomeMeeting-devel-list] Crash in PFactory::~PFactory()

[Damien Sandras <dsandras seconix com>]

Hi Stefan,

I'm cc'ing Craig (he is subscribed on this mailing list), so that he can
comment. Thanks for the bug report.

It seems I'll have to release GnomeMeeting 1.2.2 after all ;)

And given the current evolution of GnomeMeeting SIP, I wouldn't be
astonished to have to drop completely that branch for a while
unfortunately.

Le mercredi 11 mai 2005 à 17:01 +0200, Stefan Bruens a écrit :
> Hi,
> 
> there have been a lot of reports of GM crashing on exit in PFactory::~PFactory 
> with the packages comming with SuSE 9.3. Although this bug only seems to 
> happen on this particular distribution, it is a bug in pwlib. I dont know why 
> only SuSE 9.3 is affected, but it may become visible on other distributions 
> in future.
> 
> Details:
> The crash is happening in PFactory<PSoundChannel>::~PFactory() on line 319 of 
> include/ptlib/pfactory.h:
> ---
> if(entry->second->isDynamic)
> 	delete entry->second;
> ---
> 
> entry->second is a dangling Pointer pointing to somewhere in stack space.
> 
> It is initialized via the plugin code.
> 
> in include/ptlib/plugin.h:165:
> 
> class PPlugin_##serviceType##_##serviceName##_Registration {
> public:
> 	PPlugin_##serviceType##_##serviceName##_Registration(...) {
> 		static PDevicePluginFactory<serviceType>::Worker factory(#serviceName);
> 		pluginMgr->RegisterService(#serviceName, #serviceType, descriptor);
> 	}
> }
> 
> Here we have serviceType=PSoundChannel, serviceName=ALSA. 
> 
> So what happens is, we are first creating a static instance of 
> PDevicePluginFactory<PSoundChannel>::Worker named factory. In the constructor 
> of factory, we are calling "PFactory<PSoundChannel>::Register("ALSA", this), 
> so a pointer to the static instance called factory is stored in the keyMap 
> with a key with value "ALSA". Everything fine until now ...
> 
> Next, in (src/ptlib/common/pluginmgr.cxx) PPluginManager::RegisterService(...) 
> "adapter = PFactory<>::CreateInstance(PSoundChannel)" is called, and for this 
> "adapter->CreateFactory("ALSA");" This creates (plugin.h:87) a second 
> PDevicePluginFactory<PSoundChannel>::Worker on the heap, the pointer to this 
> instance is not stored in the keyMap (no values are stored for already 
> existing keys).
> 
> On shutdown, the PluginManager is destroyed, and the static instance "factory" 
> is destroyed, too, making the pointer in the keyMap a dangling pointer. 
> Later, the PFactory<PSoundChannel> is destroyed, and the dangling pointer is 
> hit -> crash!
> 
> Greetings,
> 
> Stefan
> 
> _______________________________________________
> Gnomemeeting-devel-list mailing list
> Gnomemeeting-devel-list gnome org
> http://mail.gnome.org/mailman/listinfo/gnomemeeting-devel-list
-- 
 _      Damien Sandras
(o-     GnomeMeeting: http://www.gnomemeeting.org/
//\     FOSDEM 2005 : http://www.fosdem.org
v_/_    H.323 phone : callto:ils.seconix.com/dsandras seconix com