Book Closing in HEAD kills objects in a "bad" order, corrupts memory.

Derek Atkins warlord at MIT.EDU
Tue May 25 10:33:18 EDT 2004

Ok, the problem is an order-of-operations during book closings.  I just
tested this with the current CVS HEAD branch and it's definitely
still exhibiting the problem.

Linas, can you take a look at this?  See the attached patch to build
test-query with efence.  This problem is 100% reproducible if you run
the rebuilt test-query linked against efence (assuming you have a
modern-enough libltdl that doesn't cause efence to die during startup,
but libtool-1.5 should be fine).  I just hand-modify the test script
that libtool builds and add a 'gdb' to the exec command, and then
'make check TESTS=test-query' to get it to just run my test.

I instrumented qof_object_book_end to print out the object it was
closing out (not included in the patch below).  As you can see, it's
closing out the CommodityTable before the AccountGroup, which is bad.
As you can see from the following trace this causes a memory access
failure because transactions are kept in balance even when we're
destroying the book, so it's trying to scrub against an
already-destroyed commodity.


DEBUG: Enter: qof_object_book_end
DEBUG: Debug: qof_object_book_end(): Closing CommodityTable
DEBUG: Debug: qof_object_book_end(): Closing Price
DEBUG: Debug: qof_object_book_end(): Closing Scheduled Transaction Templates
DEBUG: Debug: qof_object_book_end(): Closing AccountGroup
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -150624064 (LWP 13198)]
0x004a6097 in gnc_commodity_equiv (a=0xf36a8fd4, b=0xf4754fd4)
    at gnc-commodity.c:850
850       if(safe_strcmp(a->namespace, b->namespace) != 0) return FALSE;
(gdb) where
#0  0x004a6097 in gnc_commodity_equiv (a=0xf36a8fd4, b=0xf4754fd4)
    at gnc-commodity.c:850
#1  0x004990ce in xaccSplitScrub (split=0xf15bff64) at Scrub.c:244
#2  0x0049903a in xaccTransScrubSplits (trans=0xf36a8fd4) at Scrub.c:197
#3  0x00499416 in xaccTransScrubImbalance (trans=0xf1925f98, root=0x0,
    parent=0x0) at Scrub.c:333
#4  0x0049ef84 in xaccTransCommitEdit (trans=0xf1925f98) at Transaction.c:1575
#5  0x0048de5a in xaccAccountCommitEdit (acc=0xf3146f2c) at Account.c:365
#6  0x0048df90 in xaccAccountDestroy (acc=0xf36a8fd4) at Account.c:399
#7  0x00493a79 in xaccFreeAccountGroup (grp=0xf339afec) at Group.c:301
#8  0x0048dc42 in xaccAccountCommitEdit (acc=0xf34b8f2c) at Account.c:352
#9  0x0048df90 in xaccAccountDestroy (acc=0xf36a8fd4) at Account.c:399
#10 0x00493a79 in xaccFreeAccountGroup (grp=0xf4694fec) at Group.c:301
#11 0x00493a11 in xaccAccountGroupDestroy (grp=0xf4694fec) at Group.c:255
#12 0x0049365f in xaccCollSetAccountGroup (col=0xf4696ff0, grp=0x0)
    at Group.c:106
#13 0x00493729 in xaccSetAccountGroup (book=0x1, grp=0x0) at Group.c:131
#14 0x00494a21 in group_book_end (book=0xf54dcfc8) at Group.c:1246
#15 0x004c0de0 in qof_object_book_end (book=0xf54dcfc8) at qofobject.c:87
#16 0x004bfa00 in qof_book_destroy (book=0xf54dcfc8) at qofbook.c:109
#17 0x004c8665 in qof_session_destroy (session=0xf54dafe4) at qofsession.c:767
#18 0x0804b29e in run_test () at test-query.c:63
#19 0x0804b2d0 in main_helper (closure=0x0, argc=1, argv=0xfef16934)
---Type <return> to continue, or q <return> to quit---
    at test-query.c:75
#20 0x0015360f in scm_init_guile () from /usr/lib/
#21 0x001535cc in scm_init_guile () from /usr/lib/
#22 0x001532a0 in scm_boot_guile () from /usr/lib/
#23 0x0804b313 in main (argc=1, argv=0xfef16934) at test-query.c:86

-------------- next part --------------
A non-text attachment was scrubbed...
Name: gnc-efence.diff
Type: text/x-patch
Size: 549 bytes
Desc: Link test-query with efence
Url :
-------------- next part --------------

       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL:    PP-ASEL-IA     N1NWH
       warlord at MIT.EDU                        PGP key available

More information about the gnucash-devel mailing list