[Pnet-developers] [bugs #11627] Crash during Garbage collection of StreamWriter based on HttpStream

[Erich Kitzmüller]

This is an automated notification sent by Savannah.
It relates to:
                bugs #11627, project DotGNU Portable.NET

==============================================================================
 LATEST MODIFICATIONS of bugs #11627:
==============================================================================

               Posted by: Erich Kitzmüller <ammoq>
               Posted on: 2005-01-20 10:00 (GMT)
    _______________________________________________________

Follow-up Comment:
This second program Crash.cs works better for reproducing the crash. It's a
simple loop that opens an XmlTextReader and immediately closes it. After 4
Iterations, it segfaults on my PC... with the quickhack (see previous post)
it works.
For reproducing the crash, you need to access the file from a http server;
reading a local xml file does not cause the crash.


address@hidden erich]$ cscc Crash.cs -lSystem.Xml -o Crash.exe
address@hidden erich]$ cat test.xml
<hello><world></world></hello>
address@hidden erich]$ ilrun Crash.exe http://10.1.1.11/test.xml
0
1
2
3
4
Segmentation fault
address@hidden erich]$ ilrun Crash.exe test.xml
0
1
2
3
4
5
6
...
99
address@hidden erich]$

    _______________________________________________________

Additional Item Attachment:
File name: Crash.cs                       Size:0 KB

<http://savannah.gnu.org/bugs/download.php?item_id=11627&amp;item_file_id=2080>

==============================================================================
 OVERVIEW of bugs #11627:
==============================================================================

URL:
  <http://savannah.gnu.org/bugs/?func=detailitem&item_id=11627>

                 Summary: Crash during Garbage collection of StreamWriter
based on HttpStream
                 Project: DotGNU Portable.NET
            Submitted by: ammoq
            Submitted on: Die 18.01.2005 um 01:37
                Category: None
                Severity: 5 - Average
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open

    _______________________________________________________


In StreamWriter.Dispose(bool disposing), stream.Flush() is called.
Unfortunately, HttpStream is already disposed, so "underlying" is already
null. HttpStream.Flush() simply calls underlying.Flush(), so this should IMO
throw a NullReferenceException. But, even more unfortunately, the virtual
machine crashes with a segmentation violation, in cvm_call.c line 934, since
tempptr is a null pointer.

    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Don 20.01.2005 um 10:00       By: Erich Kitzmüller <ammoq>
This second program Crash.cs works better for reproducing the crash. It's a
simple loop that opens an XmlTextReader and immediately closes it. After 4
Iterations, it segfaults on my PC... with the quickhack (see previous post)
it works.
For reproducing the crash, you need to access the file from a http server;
reading a local xml file does not cause the crash.


address@hidden erich]$ cscc Crash.cs -lSystem.Xml -o Crash.exe
address@hidden erich]$ cat test.xml
<hello><world></world></hello>
address@hidden erich]$ ilrun Crash.exe http://10.1.1.11/test.xml
0
1
2
3
4
Segmentation fault
address@hidden erich]$ ilrun Crash.exe test.xml
0
1
2
3
4
5
6
...
99
address@hidden erich]$


-------------------------------------------------------
Date: Mit 19.01.2005 um 17:26       By: Erich Kitzmüller <ammoq>
Stephen Compall: I did my own build, with default options. Where can I find
your rpms?
All: Sorry, my example (Test.cs) was too simple, I can't reproduce the bug
now. Maybe I was fooled by the segfault inside gdb... Anyway, I'm sure there
is such a problem, maybe in more difficult cases (garbage collection?)
In my real-world program, the program segfaults (most likely during garbage
collection); if I add the following few lines in cvm_call.c, it works:

--- cvm_call.c  2005-01-19 18:07:25.282411440 +0100
+++ cvm_call_orig.c     2005-01-19 18:04:39.228655448 +0100
@@ -928,12 +928,6 @@
 {
        /* Call a virtual method */
        tempptr = stacktop[-((ILInt32)CVM_ARG_DWIDE1_SMALL)].ptrValue;
-
-       /* ERICH quickhack */
-       if (tempptr == NULL) {
-         NULL_POINTER_EXCEPTION();
-       }
-
        BEGIN_NULL_CHECK(tempptr)
        {
                /* Locate the method to be called */

Obviously this should be obsolete when using the signal-based
BEGIN_NULL_CHECK... 
The same program worked fine on Mandrake 9.1 (Kernel 2.4.x)...

-------------------------------------------------------
Date: Mit 19.01.2005 um 13:50       By: Stephen Compall <S11001001>
Erich Kitzmüller: since you mentioned the platform, I am curious: did you use
the RPMs I built for Mandrake 10.1?  If so, could you see if the problem is
duplicable in an installation from source with default options?

-------------------------------------------------------
Date: Mit 19.01.2005 um 09:38       By: Anonymous
I just checked a simple example which throws an NullRef exception normally
but segfaults inside gdb ?.

-------------------------------------------------------
Date: Die 18.01.2005 um 09:30       By: Erich Kitzmüller <ammoq>
It seems that (at least in my configuration: MandrakeLinux 10.1, kernel
2.6.8.1, glibc-2.3.3, gcc 3.4.1) Nullpointer references are not caught for
virtual method calls. The attached short program is enough to cause a crash.







    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Don 20.01.2005 um 10:00  Name: Crash.cs  Size: 218B   By: ammoq

<http://savannah.gnu.org/bugs/download.php?item_id=11627&item_file_id=2080>
-------------------------------------------------------
Date: Die 18.01.2005 um 09:30  Name: Test.cs  Size: 138B   By: ammoq

<http://savannah.gnu.org/bugs/download.php?item_id=11627&item_file_id=2074>

==============================================================================

This item URL is:
  <http://savannah.gnu.org/bugs/?func=detailitem&item_id=11627>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/