Subject: core dump with fvwm-themes

From: Dominik Vogt <[email-masked]>
Date: Fri, 8 Sep 2000 13:07:15 +0200

While testing fvwm-themes yesterday, fvwm crashed in

  FindPopup()

  mr = 0x80b9bb0
    s = 0x0  <- screwed up pointer
    d = 0x39 <- screwed up pointer

called from

  destroy_menu()

Unfortunaltely ddd crashed while debugging this and overwrote
the core file.  I just chose [All] from the default theme and
fvwm crashed before it was restarted.  So, if anybody sees this
again, please try to reproduce it or narrow it down.

BTW, there is a sure fire way to crash fvwm in the menu code
which I am aware of since I wrote it a long time ago.  I can't
remember exactly what it is, but it has to do with deleting
or modifying the menu style of a dynamic menu from within this
menu.

Bye

Dominik ^_^  ^_^

-- 
Dominik Vogt, Agilent Technologies, Dept. BVS
Herrenberger Str.130, 71034 Boeblingen, Germany
phone: 07031/464-4596, fax: 07031/464-3883, [email-masked]
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Mikhael Goikhman <[email-masked]>
Date: Mon, 11 Sep 2000 01:53:21 +0200

> again, please try to reproduce it or narrow it down.

It is interesting. Olivier reported some hard to spot (unconsistent) core
dumps. But I myself never got core dumps on my machine. Now, I ran the
same fvwm on another X Server remotely using rsh and always got core
dumps. I am attaching 5 core dump outputs (the last 2 are suspicious, they
are in line 42 (malloc) of safemalloc). I don't know how helpful they are.

Once I got a core, which was lost, that gave in the stack "free(token);"
line in AddToMenu, IIRC.

The first core dump is caused by these two commands:

  Key Enter  A       CM      -
  Key Enter  A       SM      -

(trying to destroy a non-existing binding). You can find these 2 lines
in themes/default/bindings and comment them in to avoid this core.

> or modifying the menu style of a dynamic menu from within this

This may explain other core dumps (if you say you know the cause).
Here is what happens, a menu function is executed, this function calls
more functions and among many other commands, the menu style is redefined.

BTW, we currently only use MenuStyle "*", mainly because there is no
something like UseMenuStyle (ok, CopyMenuStyle) to avoid duplication.

Regards,
Mikhael.

---

From: Olivier Chapuis <[email-masked]>
Date: Sat, 30 Sep 2000 23:55:01 +0200

> are in line 42 (malloc) of safemalloc). I don't know how helpful they are.

Hello,

Yes, when I used the glibc 2.0.7 and gcc 2.7.2.3 (RH 5.1) I've got
a few core dumps with inconsistent core files.
Now I use glibc-2.1.3 and gcc 2.95.3 19991030 (Mandrake 7.1)
and I've *no* core dump (and I try to get some ...).
It seems that there is something strange. So, I use dmalloc and
it suggests a few fix that I have applied. I think it will be great
if one (Dan, Brad ?) can run Purify with fvwm-themes. Reapeting
"load all a_theme" will do somethings similar than the test/purify
"script" but updated for 2.4.

Olivier

---

From: Dan Espen <[email-masked]>
Date: Sat, 30 Sep 2000 21:51:57 -0400

> "script" but updated for 2.4.

I used the latest beta for fvwm-themes.

I got lots of FMRs and some UMRs.  I've trimmed out the duplicates.
If you'd like the complete file, I can mail it to you,
its too big for this list.
The first UMRs seemed to be caused by icons getting focused.
The FMRs came from the theme loading.

The theme loading never completed, I got one of those lockups that
purify is prone to when running purify in gui mode and trying to
purify a window manager.

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
UMR: Uninitialized memory read (16 times):
  * This is occurring while in:
	_write         [libc.so.1]
	FlushMessageQueue [module_interface.c:1363]
	My_XNextEvent  [events.c:2264]
	HandleEvents   [events.c:2408]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 40 bytes from 0x2f2410 in the heap (4 bytes at 0x2f2434 uninit).
  * Address 0x2f2410 is at the beginning of a malloc'd block of 40 bytes.
  * This block was allocated from:
	malloc         [rtlib.o]
	safemalloc     [safemalloc.c:42]
	AddToMessageQueue [module_interface.c:1319]
	PositiveWrite  [module_interface.c:1240]
	BroadcastPacket [module_interface.c:809]
	HandleFocusIn  [events.c:243]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
UMR: Uninitialized memory read (2 times):
  * This is occurring while in:
	pop_menu_up    [menus.c:2237]
	do_menu        [menus.c:755]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 4 bytes from 0xefffb228 on the stack.
  * Address 0xefffb228 is      168 bytes below frame pointer in function do_menu.

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
UMR: Uninitialized memory read:
  * This is occurring while in:
	MenuInteraction [menus.c:1954]
	do_menu        [menus.c:795]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 4 bytes from 0xefffb18c on the stack.
  * Address 0xefffb18c is      164 bytes past start of local variable "mi" in function MenuInteraction.

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
FMR: Free memory read (16 times):
  * This is occurring while in:
	ParseBinding   [bindings.c:215]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 4 bytes from 0x1c90c4 in the heap.
  * Address 0x1c90c4 is 28 bytes into a freed  block at 0x1c90a8 of 32 bytes.
  * This block was allocated from:
	malloc         [rtlib.o]
	safemalloc     [safemalloc.c:42]
	AddBinding     [Bindings.c:269]
	ParseBinding   [bindings.c:276]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	main           [fvwm.c:645]
  * There have been 0 frees since this block was freed from:
	free           [rtlib.o]
	RemoveBinding  [Bindings.c:187]
	ParseBinding   [bindings.c:221]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
FMR: Free memory read (16 times):
  * This is occurring while in:
	MatchBinding   [Bindings.c:337]
	ParseBinding   [bindings.c:215]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 4 bytes from 0x1c90b8 in the heap.
  * Address 0x1c90b8 is 16 bytes into a freed  block at 0x1c90a8 of 32 bytes.
  * This block was allocated from:
	malloc         [rtlib.o]
	safemalloc     [safemalloc.c:42]
	AddBinding     [Bindings.c:269]
	ParseBinding   [bindings.c:276]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	main           [fvwm.c:645]
  * There have been 0 frees since this block was freed from:
	free           [rtlib.o]
	RemoveBinding  [Bindings.c:187]
	ParseBinding   [bindings.c:221]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
FMR: Free memory read (16 times):
  * This is occurring while in:
	activate_binding [bindings.c:286]
	ParseBinding   [bindings.c:220]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 1 byte from 0x1c90a8 in the heap.
  * Address 0x1c90a8 is at the beginning of a freed block of 32 bytes.
  * This block was allocated from:
	malloc         [rtlib.o]
	safemalloc     [safemalloc.c:42]
	AddBinding     [Bindings.c:269]
	ParseBinding   [bindings.c:276]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	main           [fvwm.c:645]
  * There have been 1 frees since this block was freed from:
	free           [rtlib.o]
	RemoveBinding  [Bindings.c:187]
	ParseBinding   [bindings.c:221]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
FMR: Free memory read (128 times):
  * This is occurring while in:
	GrabWindowKey  [Bindings.c:428]
	activate_binding [bindings.c:304]
	ParseBinding   [bindings.c:220]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 4 bytes from 0x1c90b4 in the heap.
  * Address 0x1c90b4 is 12 bytes into a freed  block at 0x1c90a8 of 32 bytes.
  * This block was allocated from:
	malloc         [rtlib.o]
	safemalloc     [safemalloc.c:42]
	AddBinding     [Bindings.c:269]
	ParseBinding   [bindings.c:276]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	run_command_stream [read.c:80]
	run_command_file [read.c:153]
	ReadFile       [read.c:205]
	ExecuteFunction [functions.c:1002]
	main           [fvwm.c:645]
  * There have been 1 frees since this block was freed from:
	free           [rtlib.o]
	RemoveBinding  [Bindings.c:187]
	ParseBinding   [bindings.c:221]
	binding_cmd    [bindings.c:325]
	key_binding    [bindings.c:336]
	ExecuteFunction [functions.c:1002]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	execute_complex_function [functions.c:1501]
	ExecuteFunction [functions.c:1019]
	ExecuteFunctionSaveTmpWin [functions.c:1056]
	do_menu        [menus.c:832]
	menu_func      [menus.c:5058]
	staysup_func   [menus.c:5074]
	ExecuteFunction [functions.c:1002]
	HandleButtonPress [events.c:1411]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]

****  Purify instrumented /opt/public/src/fvwm/2.3.22/fvwm2 (pid 3418)  ****
UMR: Uninitialized memory read:
  * This is occurring while in:
	SelectDecor    [decorations.c:418]
	init_style     [update.c:69]
	apply_window_updates [update.c:119]
	flush_window_updates [update.c:346]
	HandleEvents   [events.c:2402]
	main           [fvwm.c:733]
	_start         [crt1.o]
  * Reading 4 bytes from 0x2e8cf4 in the heap.
  * Address 0x2e8cf4 is 132 bytes into a malloc'd block at 0x2e8c70 of 620 bytes.
  * This block was allocated from:
	malloc         [rtlib.o]
	safemalloc     [safemalloc.c:42]
	setup_window_structure [add_window.c:123]
	AddWindow      [add_window.c:1179]
	HandleMapRequestKeepRaised [events.c:894]
	HandleMapRequest [events.c:863]
	DispatchEvent  [events.c:2370]
	HandleEvents   [events.c:2410]
	main           [fvwm.c:733]
	_start         [crt1.o]

--
Dan Espen
444 Hoes Lane  Room RRC 1C-214           E-mail: [email-masked]
Piscataway, NJ 08854                     Phone: (732) 699-5570
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]