Opened 11 years ago

Closed 10 years ago

#2712 closed bug (fixed)

Tracker crashes when deleting a replicant

Reported by: jackburton Owned by: aldeck
Priority: normal Milestone: R1
Component: Kits/Interface Kit Version: R1/pre-alpha1
Keywords: Cc:
Blocked By: Blocking:
Has a Patch: no Platform: All

Description (last modified by jackburton)

100% reproducible on a gcc4 build: Drag a replicant (for example DeskCalc) to the tracker's background. Delete it. You'll get a crash.

Attachments (4)

bt1.txt (1.6 KB) - added by aldeck 10 years ago.
bt2.txt (1.6 KB) - added by aldeck 10 years ago.
bt3.txt (1.8 KB) - added by aldeck 10 years ago.
bt3_from_kdl.txt (2.7 KB) - added by aldeck 10 years ago.

Download all attachments as: .zip

Change History (17)

comment:1 Changed 11 years ago by jackburton

Description: modified (diff)

comment:2 Changed 11 years ago by jackburton

Can't attach the stack trace due to a Trac bug

comment:3 Changed 11 years ago by jackburton

Resolution: fixed
Status: newclosed

Fixed in hrev27400

comment:4 Changed 11 years ago by jackburton

Component: Applications/TrackerKits/Interface Kit
Resolution: fixed
Status: closedreopened

Can reproduce it again. Reopening.

comment:5 Changed 10 years ago by aldeck

Can reproduce here, hrev29385 either with gcc2 or gcc4. Reproducible in ShelfTest (which builds again in hrev29385).

I can't find a reliable testcase, but what seems to help is to have at least 2 replicants of the same view/app and playing with mouse focus on them before trying to delete one.

Crash happens either in BView::_Pulse or BWindow::_FindView, not sure why yet.

comment:6 Changed 10 years ago by aldeck

Owner: changed from axeld to aldeck
Status: reopenednew

Found an always reproducible testcase (here at least):

Create two Deskcalc replicants on the desktop or ShelfTest, without clicking anything else, delete the firstly created replicant. It will crash Tracker or ShelfTest. There are three different crashes, backtraces follow.

Working on it, let's see what i can do :)

Changed 10 years ago by aldeck

Attachment: bt1.txt added

Changed 10 years ago by aldeck

Attachment: bt2.txt added

Changed 10 years ago by aldeck

Attachment: bt3.txt added

comment:7 Changed 10 years ago by diver

#3029 could be related

comment:8 Changed 10 years ago by aldeck

Blocking: 3029 added

comment:8 in reply to:  7 Changed 10 years ago by aldeck

Blocking: 3029 removed

Replying to diver:

#3029 could be related

Yep, definitely, thanks for the pointer.

comment:9 Changed 10 years ago by aldeck

Ingo, if you're watching, i was playing in the marvelous KDL for debugging, and saw strange things when looking at the backtrace. Specifically BView::_Pulse() shows lots of arguments where it shouldn't, isn't this a demangler issue? If you confirm this, i can create a specific ticket if you'd like. See attached file.

Changed 10 years ago by aldeck

Attachment: bt3_from_kdl.txt added

comment:10 Changed 10 years ago by aldeck

Forget the previous comment, memory is corrupted after unload_add_on(image) in BShelf::_DeleteReplicant, the crash happens on a BView method call (of the second replicant):

http://dev.haiku-os.org/browser/haiku/trunk/src/kits/interface/Shelf.cpp#L1170

At least, commenting this line avoids the crash, investigating :)

comment:11 Changed 10 years ago by aldeck

Ok, with some help from korli, i found out that the unload_add_on logic is flawed, it will always unload the image on (and only on) deleting the first instance, even if the image is still needed by the other instances. Working on a fix.

comment:12 Changed 10 years ago by aldeck

Resolution: fixed
Status: newclosed

fixed in hrev29439

Note: See TracTickets for help on using tickets.