[xml] Weird xmlTextReaderRead(

[Jianqing Zhang <arrow jianqing gmail com>]

I'm implementing a parser by xmlreader on C++.  I design a nested
framework to parse the XML file. If the parser gets a new element, a
corresponding C++ object is created and xmlTextReaderPtr is passed to
the new object to parse and initialize its sub-elements (objects).

As the program size increases, I encounter a weird problem. See the
sample code below:

void initialize(xmlTextReaderPtr reader){
  int ret;
  if (_state == END){
    // process the last node
    processEndNode(reader);
    ret = 0;
  } else if (_state == START_CHILD){
    ret = 1; // Node is ready read
    _state = IN_CHILD;
  } else {
    cout << "read a new node" << endl;
    ret = xmlTextReaderRead(reader);
 }
  while (ret == 1) {
    if (xmlTextReaderNodeType(reader) == XML_READER_TYPE_END_ELEMENT){
      processEndNode(reader);
    }
    else{
      processNode(reader);
    }
    if(_state == END)
      break;
    else {
      ret = xmlTextReaderRead(reader);
      //cout << "before read ret" << endl;
    }
  }
}

if I un-comment the last "cout" in while loop, the program works well.
If I make it as a comment, the program crashes after ret =
xmlTextReaderRead(reader) is executed and get the following error
message:

*** glibc detected *** ./test-sclparser: double free or corruption
(out): 0x00007fff662dc350 ***
======= Backtrace: =========
/lib/libc.so.6[0x7f8b5d0b5cb8]
/lib/libc.so.6(cfree+0x76)[0x7f8b5d0b8276]
./test-sclparser[0x40889e]
./test-sclparser[0x40220a]
./test-sclparser[0x406fd1]
./test-sclparser[0x40220a]
./test-sclparser[0x403e60]
./test-sclparser[0x40220a]
./test-sclparser[0x4039f3]
./test-sclparser[0x401bfb]
/lib/libc.so.6(__libc_start_main+0xe6)[0x7f8b5d05c5a6]
./test-sclparser[0x401a09]
======= Memory map: ========
00400000-0040d000 r-xp 00000000 08:08 934921
 .../test-sclparser
0060c000-0060d000 r--p 0000c000 08:08 934921
  .../test-sclparser
0060d000-0060e000 rw-p 0000d000 08:08 934921
.../test-sclparser
01aa8000-01ac9000 rw-p 01aa8000 00:00 0                                  [heap]
7f8b58000000-7f8b58021000 rw-p 7f8b58000000 00:00 0
7f8b58021000-7f8b5c000000 ---p 7f8b58021000 00:00 0
7f8b5ca06000-7f8b5ca1d000 r-xp 00000000 08:08 1684857
  /lib/libpthread-2.9.so
7f8b5ca1d000-7f8b5cc1c000 ---p 00017000 08:08 1684857
  /lib/libpthread-2.9.so
7f8b5cc1c000-7f8b5cc1d000 r--p 00016000 08:08 1684857
  /lib/libpthread-2.9.so
7f8b5cc1d000-7f8b5cc1e000 rw-p 00017000 08:08 1684857
  /lib/libpthread-2.9.so
7f8b5cc1e000-7f8b5cc22000 rw-p 7f8b5cc1e000 00:00 0
7f8b5cc22000-7f8b5cc39000 r-xp 00000000 08:08 1684281
  /lib/libz.so.1.2.3.3
7f8b5cc39000-7f8b5ce38000 ---p 00017000 08:08 1684281
  /lib/libz.so.1.2.3.3
7f8b5ce38000-7f8b5ce39000 r--p 00016000 08:08 1684281
  /lib/libz.so.1.2.3.3
7f8b5ce39000-7f8b5ce3a000 rw-p 00017000 08:08 1684281
  /lib/libz.so.1.2.3.3
7f8b5ce3a000-7f8b5ce3c000 r-xp 00000000 08:08 1684844
  /lib/libdl-2.9.so
7f8b5ce3c000-7f8b5d03c000 ---p 00002000 08:08 1684844
  /lib/libdl-2.9.so
7f8b5d03c000-7f8b5d03d000 r--p 00002000 08:08 1684844
  /lib/libdl-2.9.so
7f8b5d03d000-7f8b5d03e000 rw-p 00003000 08:08 1684844
  /lib/libdl-2.9.so
7f8b5d03e000-7f8b5d1a6000 r-xp 00000000 08:08 1684789
  /lib/libc-2.9.so
7f8b5d1a6000-7f8b5d3a6000 ---p 00168000 08:08 1684789
  /lib/libc-2.9.so
7f8b5d3a6000-7f8b5d3aa000 r--p 00168000 08:08 1684789
  /lib/libc-2.9.so
7f8b5d3aa000-7f8b5d3ab000 rw-p 0016c000 08:08 1684789
  /lib/libc-2.9.so
7f8b5d3ab000-7f8b5d3b0000 rw-p 7f8b5d3ab000 00:00 0
7f8b5d3b0000-7f8b5d3c6000 r-xp 00000000 08:08 1684278
  /lib/libgcc_s.so.1
7f8b5d3c6000-7f8b5d5c6000 ---p 00016000 08:08 1684278
  /lib/libgcc_s.so.1
7f8b5d5c6000-7f8b5d5c7000 r--p 00016000 08:08 1684278
  /lib/libgcc_s.so.1
7f8b5d5c7000-7f8b5d5c8000 rw-p 00017000 08:08 1684278
  /lib/libgcc_s.so.1
7f8b5d5c8000-7f8b5d64c000 r-xp 00000000 08:08 1684846
  /lib/libm-2.9.so
7f8b5d64c000-7f8b5d84b000 ---p 00084000 08:08 1684846
  /lib/libm-2.9.so
7f8b5d84b000-7f8b5d84c000 r--p 00083000 08:08 1684846
  /lib/libm-2.9.so
7f8b5d84c000-7f8b5d84d000 rw-p 00084000 08:08 1684846
  /lib/libm-2.9.so
7f8b5d84d000-7f8b5d93e000 r-xp 00000000 08:08 948757
  /usr/lib/libstdc++.so.6.0.10
7f8b5d93e000-7f8b5db3e000 ---p 000f1000 08:08 948757
  /usr/lib/libstdc++.so.6.0.10
7f8b5db3e000-7f8b5db45000 r--p 000f1000 08:08 948757
  /usr/lib/libstdc++.so.6.0.10
7f8b5db45000-7f8b5db47000 rw-p 000f8000 08:08 948757
  /usr/lib/libstdc++.so.6.0.10
7f8b5db47000-7f8b5db5a000 rw-p 7f8b5db47000 00:00 0
7f8b5db5a000-7f8b5db61000 r-xp 00000000 08:08 1684859
  /lib/librt-2.9.so
7f8b5db61000-7f8b5dd60000 ---p 00007000 08:08 1684859
  /lib/librt-2.9.so
7f8b5dd60000-7f8b5dd61000 r--p 00006000 08:08 1684859
  /lib/librt-2.9.so
7f8b5dd61000-7f8b5dd62000 rw-p 00007000 08:08 1684859
  /lib/librt-2.9.so
7f8b5dd62000-7f8b5deb5000 r-xp 00000000 08:08 949219
  /usr/lib/libxml2.so.2.6.32
7f8b5deb5000-7f8b5e0b4000 ---p 00153000 08:08 949219
  /usr/lib/libxml2.so.2.6.32
7f8b5e0b4000-7f8b5e0bc000 r--p 00152000 08:08 949219
  /usr/lib/libxml2.so.2.6.32
7f8b5e0bc000-7f8b5e0be000 rw-p 0015a000 08:08 949219
  /usr/lib/libxml2.so.2.6.32
7f8b5e0be000-7f8b5e0bf000 rw-p 7f8b5e0be000 00:00 0
7f8b5e0bf000-7f8b5e0df000 r-xp 00000000 08:08 1684274
  /lib/ld-2.9.so
7f8b5e2bc000-7f8b5e2c1000 rw-p 7f8b5e2bc000 00:00 0
7f8b5e2d9000-7f8b5e2de000 rw-p 7f8b5e2d9000 00:00 0
7f8b5e2de000-7f8b5e2df000 r--p 0001f000 08:08 1684274
  /lib/ld-2.9.so
7f8b5e2df000-7f8b5e2e0000 rw-p 00020000 08:08 1684274
  /lib/ld-2.9.so
7fff662ca000-7fff662df000 rw-p 7ffffffea000 00:00 0                      [stack]
7fff663fe000-7fff663ff000 r-xp 7fff663fe000 00:00 0                      [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
  [vsyscall]
Aborted

Do I miss something?

Thanks