Menu
▾
▴
#1542 crash when many bitmaps are used (Windows)
closed-fixed
8
2009-05-09
2003-08-15
No
On Windows-NT, tk 8.3.3, the following snippet crashes
wish with a NULL pointer dereference:
set image [image create bitmap -data \
{
#define cross_width 14
#define cross_height 14
static char cross_bits[] = {
0x00, 0x00, 0x00, 0x00, 0x06, 0x18, 0x0e, 0x1c,
0x1c, 0x0e, 0x38, 0x07,
0xf0, 0x03, 0xe0, 0x01, 0xe0, 0x01, 0xf0, 0x03,
0x38, 0x07, 0x1c, 0x0e,
0x0e, 0x1c, 0x06, 0x18};
}]
set maxi 200
set maxj 62
for {set i 0} {$i < $maxi} {incr i} {
for {set j 0} {$j < $maxj} {incr j} {
grid [button .b$i-$j -image $image] -row $i
-column $j
}
}
The reason is a failure of CreateBitmap() in
win/tkWinPixmap.c, #68
newTwdPtr->bitmap.handle = CreateBitmap(width,
height, planes, depth, NULL);
which returns NULL (probably out-of-resources). This
is not checked by the calling function, and the
NULL-Pointer is eventually passed on to
TkWinGetDrawableDC() which dereferences it.
I haven't checked by running this in 8.4.4, but from
looking at the code, the error is not caught there
either.
Simply returning NULL im ximage.c does not help, since
the return-Value of XCreateBitmapFromData() is not
checked either and simply used.
Logged In: YES
user_id=79902
Yuck. This can make other apps (especially other Tk apps,
at least in my test) unstable too, and it is definitely
still current.
Logged In: YES
user_id=79902
Hmm. There's a different model of how failures work in X, so
we'll need to think through what to do here. And things
fail sooner on Win9x. Alas, I have no compiler/debugger
suite on the Win platform, so I cannot track this one down
to nearer where the failure is. (Should vast numbers of
bitmaps be being allocated?)
Logged In: YES
user_id=80530
crash sounds bad; is
this report still valid
against 8.4.13 ?
Logged In: YES
user_id=377375
Just downloaded the 8.4.13rc0, compiled with vc 2003,
and run the above code.
After a short while of 100%CPU, a window pops up:
window title "fatal error in wish"
window message: "fail to allocate"
So it seems the error is caught at least and a panic window
is issued. From looking at the code, there are conditionals
now checking for success of the relevant functions, so this
would make sense.
wish is still aborted at that point, but this seems due to a
controlled call to WishPanic() as a result of some
allocation failure.
HTH
R'
CreateDIBSection has been added as a fallback in tkWinPixmap.c:Tk_GetPixmap for 8.5.8, 8.4.20 and 8.6-head