Re: [GnomeMeeting-devel-list] Crash in PFactory::~PFactory()

[Craig Southeren <craigs postincrement com>]

On Wed, 11 May 2005 19:33:54 +0200
Damien Sandras <dsandras seconix com> wrote:

> Hi Stefan,
> 
> I'm cc'ing Craig (he is subscribed on this mailing list), so that he can
> comment. Thanks for the bug report.

..deleted

> > there have been a lot of reports of GM crashing on exit in PFactory::~PFactory 
> > with the packages comming with SuSE 9.3. Although this bug only seems to 
> > happen on this particular distribution, it is a bug in pwlib. I dont know why 
> > only SuSE 9.3 is affected, but it may become visible on other distributions 
> > in future.
> > 
> > Details:
> > The crash is happening in PFactory<PSoundChannel>::~PFactory() on line 319 of 
> > include/ptlib/pfactory.h:
> > ---
> > if(entry->second->isDynamic)
> > 	delete entry->second;
> > ---
> > 
> > entry->second is a dangling Pointer pointing to somewhere in stack space.
> > 
> > It is initialized via the plugin code.
> > 
> > in include/ptlib/plugin.h:165:
> > 
> > class PPlugin_##serviceType##_##serviceName##_Registration {
> > public:
> > 	PPlugin_##serviceType##_##serviceName##_Registration(...) {
> > 		static PDevicePluginFactory<serviceType>::Worker factory(#serviceName);
> > 		pluginMgr->RegisterService(#serviceName, #serviceType, descriptor);
> > 	}
> > }
> > 
> > Here we have serviceType=PSoundChannel, serviceName=ALSA. 
> > 
> > So what happens is, we are first creating a static instance of 
> > PDevicePluginFactory<PSoundChannel>::Worker named factory. In the constructor 
> > of factory, we are calling "PFactory<PSoundChannel>::Register("ALSA", this), 
> > so a pointer to the static instance called factory is stored in the keyMap 
> > with a key with value "ALSA". Everything fine until now ...
> > 
> > Next, in (src/ptlib/common/pluginmgr.cxx) PPluginManager::RegisterService(...) 
> > "adapter = PFactory<>::CreateInstance(PSoundChannel)" is called, and for this 
> > "adapter->CreateFactory("ALSA");" This creates (plugin.h:87) a second 
> > PDevicePluginFactory<PSoundChannel>::Worker on the heap, the pointer to this 
> > instance is not stored in the keyMap (no values are stored for already 
> > existing keys).
> > 
> > On shutdown, the PluginManager is destroyed, and the static instance "factory" 
> > is destroyed, too, making the pointer in the keyMap a dangling pointer. 
> > Later, the PFactory<PSoundChannel> is destroyed, and the dangling pointer is 
> > hit -> crash!

I'll see what I can do in the short time before I leave for vacation. A
simple program that demonstrates the problem would be very helpful.

Also realise that I do not have ALSA on my Linux box :(

   Craig

-----------------------------------------------------------------------
 Craig Southeren      craigs postincrement com / craigs voxgratia org

 Phone:  +61 243654666      ICQ: #86852844
 Fax:    +61 243673140      MSN: craig_southeren hotmail com
 Mobile: +61 417231046   Jabber: craigs jabber voxgratia org

 Post Increment - Consulting & Services    http://www.postincrement.com
 Vox Gratia - The Open Source VoIP portal  http://www.voxgratia.org
 Raving Of A Strange Mind - the VoIP blog  http://www.southeren.com/blog