[PD-dev] [ pure-data-Bugs-3517467 ] Crash in cloned 50.pure_data_files.pd

[SourceForge.net]

Bugs item #3517467, was opened at 2012-04-13 04:42
Message generated for change (Tracker Item Submitted) made by elmex
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=478070&aid=3517467&group_id=55736

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: pd-extended
Group: v0.43
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Robin Redeker (elmex)
Assigned to: Hans-Christoph Steiner (eighthave)
Summary: Crash in cloned 50.pure_data_files.pd

Initial Comment:
Using following System:

Pd Version: 0.43.1-extended-20120404
Debian GNU/Linux amd64

You can reproduce this crash by opening the 50.pure_data_files.pd examples in 0.Intro and check the toggle box at the top.
Then you wait until the clone has been populated. And then you click the toggle box at the top of the clone.
This leads to an immediate segfault here.

A git-animation screencast is which roughly shows what happens: http://ue.o---o.eu/data/pure_data_crash_50_pure_data_files.gif

I have compiled pd-extended myself and made a backtrace:

   #0  outlet_anything (x=<value optimized out>, s=0xc936e0, argc=0, argv=0x7fffb5b28490) at m_obj.c:470
   #1  0x000000000043cba9 in pd_typedmess (x=0xd58c30, s=<value optimized out>, argc=<value optimized out>, argv=<value optimized out>) at m_class.c:812
   #2  0x0000000000442a91 in binbuf_eval (x=<value optimized out>, target=0xd58c30, argc=0, argv=0x0) at m_binbuf.c:767
   #3  0x000000000043de19 in outlet_bang (x=<value optimized out>) at m_obj.c:399
   #4  0x000000000043df2f in outlet_float (x=<value optimized out>, f=1) at m_obj.c:425
   #5  0x00007f412879f9a7 in toggle_bang (z=0xd5b8a0, glist=<value optimized out>, xpix=<value optimized out>, ypix=<value optimized out>, shift=<value optimized out>, alt=<value optimized out>, dbl=0, doit=1) at tgl.c:251
   #6  toggle_click (z=0xd5b8a0, glist=<value optimized out>, xpix=<value optimized out>, ypix=<value optimized out>, shift=<value optimized out>, alt=<value optimized out>, dbl=0, doit=1) at tgl.c:278
   #7  toggle_newclick (z=0xd5b8a0, glist=<value optimized out>, xpix=<value optimized out>, ypix=<value optimized out>, shift=<value optimized out>, alt=<value optimized out>, dbl=0, doit=1) at tgl.c:283
   #8  0x0000000000438bc9 in gobj_click (x=0xd56470, xpos=241, ypos=118, which=<value optimized out>, mod=<value optimized out>, doit=1) at g_editor.c:162
   #9  canvas_doclick (x=0xd56470, xpos=241, ypos=118, which=<value optimized out>, mod=<value optimized out>, doit=1) at g_editor.c:1342
   #10 0x000000000043ce8d in pd_typedmess (x=0xd56470, s=<value optimized out>, argc=<value optimized out>, argv=<value optimized out>) at m_class.c:791
   #11 0x000000000043cba9 in pd_typedmess (x=0xcff4b0, s=<value optimized out>, argc=<value optimized out>, argv=<value optimized out>) at m_class.c:812
   #12 0x0000000000442a91 in binbuf_eval (x=<value optimized out>, target=0xcff4b0, argc=0, argv=0x0) at m_binbuf.c:767
   #13 0x0000000000447f29 in socketreceiver_read (x=0xcab2e0, fd=6) at s_inter.c:551
   #14 0x00000000004469e1 in sys_domicrosleep (microsec=<value optimized out>, pollem=1) at s_inter.c:191
   #15 0x000000000044483d in m_pollingscheduler () at m_sched.c:511
   #16 m_mainloop () at m_sched.c:571
   #17 0x00007f4130e09ead in __libc_start_main (main=<value optimized out>, argc=<value optimized out>, ubp_av=<value optimized out>, init=<value optimized out>, fini=<value optimized out>, rtld_fini=<value optimized out>, stack_end=0x7fffb5b28ac8) at libc-start.c:228
   #18 0x0000000000417501 in _start ()

And here some random prints of the frame 0:

   (gdb) f 0
   #0  outlet_anything (x=<value optimized out>, s=0xc936e0, argc=0, argv=0x7fffb5b28490) at m_obj.c:470
   470             typedmess(oc->oc_to, s, argc, argv);
   (gdb) list
   465         t_outconnect *oc;
   466         if(++stackcount >= STACKITER)
   467             outlet_stackerror(x);
   468         else
   469         for (oc = x->o_connections; oc; oc = oc->oc_next)
   470             typedmess(oc->oc_to, s, argc, argv);
   471         --stackcount;
   472     }
   473     
   474         /* get the outlet's declared symbol */
   (gdb) p oc
   $1 = (struct _outconnect *) 0x6f6c632d64702073
   (gdb) p oc->oc_to
   Cannot access memory at address 0x6f6c632d6470207b
   (gdb) p s
   $2 = (t_symbol *) 0xc936e0
   (gdb) p *s
   $3 = {
     s_name = 0xc93700 "clear", 
     s_thing = 0x0, 
     s_next = 0xcc6c20
   }
   (gdb) 

I'm not familiar with the codebase and currently don't have time to investigage this
further. Hope this helps to find the bug.


Greetings,
   Robin


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=478070&aid=3517467&group_id=55736