[Tsemgr-linux] edit phonebook entry crash and possible fix?

[Michael F. <re...@oc...>]

excuse me for hacking away at your code, but I found it most annoying
that tsemgr 0.07 and CVS hung in the following condition:

Step 1: load phone book from SE T610 over bluetooth
Step 2: edit an entry
Step 3: save entry
Step 4: edit another entry
<program hangs>

initial inspection was with GDB. the above steps were performed in
between run and sending SIGINT (^C) and interrupting it:

crackrock tsemgr-0.07 # gdb tsemgr
GNU gdb 5.3
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i586-pc-linux-gnu"...
(gdb) run
Starting program: /root/src/tsemgr-0.07/tsemgr 
...
<perform steps 1-4 above>
...
<interrupt with ^C>
Program received signal SIGINT, Interrupt.
0x40386db4 in malloc_consolidate () from /lib/libc.so.6
(gdb)  bt
#0  0x40386db4 in malloc_consolidate () from /lib/libc.so.6
#1  0x40386693 in _int_malloc () from /lib/libc.so.6
#2  0x40385891 in malloc () from /lib/libc.so.6
#3  0x40385adc in realloc () from /lib/libc.so.6
#4  0x401d21e4 in g_realloc () from /usr/lib/libglib-1.2.so.0
#5  0x4009d5c8 in gtk_entry_grow_text () from /usr/lib/libgtk-1.2.so.0
#6  0x40136a9d in gtk_type_new () from /usr/lib/libgtk-1.2.so.0
#7  0x40098558 in gtk_entry_new_with_max_length ()
   from /usr/lib/libgtk-1.2.so.0
#8  0x0805726f in editPBentryDialog ()
#9  0x400cd106 in gtk_marshal_NONE__NONE () from
/usr/lib/libgtk-1.2.so.0
#10 0x401053a6 in gtk_handlers_run () from /usr/lib/libgtk-1.2.so.0
#11 0x401045cb in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#12 0x40102272 in gtk_signal_emit () from /usr/lib/libgtk-1.2.so.0
#13 0x40055440 in gtk_button_clicked () from /usr/lib/libgtk-1.2.so.0
#14 0x4005656b in gtk_real_button_released () from
/usr/lib/libgtk-1.2.so.0
#15 0x400cd106 in gtk_marshal_NONE__NONE () from
/usr/lib/libgtk-1.2.so.0
#16 0x401044d9 in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#17 0x40102272 in gtk_signal_emit () from /usr/lib/libgtk-1.2.so.0
#18 0x40055350 in gtk_button_released () from /usr/lib/libgtk-1.2.so.0
#19 0x40055f21 in gtk_button_button_release () from
/usr/lib/libgtk-1.2.so.0
#20 0x400ccd36 in gtk_marshal_BOOL__POINTER () from
/usr/lib/libgtk-1.2.so.0
#21 0x4010460b in gtk_signal_real_emit () from /usr/lib/libgtk-1.2.so.0
#22 0x40102272 in gtk_signal_emit () from /usr/lib/libgtk-1.2.so.0
#23 0x40145eb8 in gtk_widget_event () from /usr/lib/libgtk-1.2.so.0
#24 0x400cc9ef in gtk_propagate_event () from /usr/lib/libgtk-1.2.so.0
#25 0x400cb924 in gtk_main_do_event () from /usr/lib/libgtk-1.2.so.0
#26 0x4019c005 in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#27 0x401d200e in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#28 0x401d1dd9 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#29 0x401d0d34 in g_main_run () from /usr/lib/libglib-1.2.so.0
#30 0x400cb3af in gtk_main () from /usr/lib/libgtk-1.2.so.0
#31 0x0804d235 in main ()
#32 0x403267a6 in __libc_start_main () from /lib/libc.so.6


we apear to be stuck off in malloc and realloc land off of a gtk call,
and this gtk call seems to be gtk_entry_with_new_max_length.  Other than
this being a depreciated GTK call, I can't find anyone ever having this
particular problem.

Trudging along further, I decided to run tsemgr, albeit very
sloooowwwlllyyyy  under valgrind.  Valgrind finds all sorts of nifty
problems......  but aside from this, it prints an interesting message
relating to editPBentry after clicking save on the first edit dialog
(step 3 above):

==1176== Invalid free() / delete / delete[]
==1176==    at 0x4015E64C: free (in /usr/lib/valgrind/valgrind.so)
==1176==    by 0x403BE262: g_free (in /usr/lib/libglib-1.2.so.0.0.10)
==1176==    by 0x40285E62: gtk_entry_finalize (in
/usr/lib/libgtk-1.2.so.0.9.1)
==1176==    by 0x402D193B: gtk_object_unref (in
/usr/lib/libgtk-1.2.so.0.9.1)
==1176==    Address 0x41CB06A8 is 0 bytes inside a block of size 8
free'd
==1176==    at 0x4015E64C: free (in /usr/lib/valgrind/valgrind.so)
==1176==    by 0x403BE262: g_free (in /usr/lib/libglib-1.2.so.0.0.10)
==1176==    by 0x805703B: editPBentry (in /root/src/tsemgr-0.07/tsemgr)
==1176==    by 0x402BA105: gtk_marshal_NONE__NONE (in
/usr/lib/libgtk-1.2.so.0.9.1)


This seems bad.  Upon looking at the code in editPBentry, we free name
and number which are return results from gtk_entry_get_text.  The
documentation I found said that under no condition were you to attempt
to free the pointers returned from gtk_entry_get_text..... sure enough
at line 1113 and 1114 of callbacks.c i see the following:

  g_free (number);
  g_free (name);

Here ends my understanding of what is going on.  all that I know is that
commenting out these free calls enables me to edit multiple entries in a
row without the apparent malloc hang... maybe we're freeing memory that
we shouldn't, as the gtk manual suggests?  I don't know, but I thought
that I would point this out... and maybe this isn't a good solution...
hopefully this will point to a real bug somewhere else...

-- 
Michael Furman, KD6OCS
regor attt ocs dott net