Bug 69779 - kopete crash when setting yahoo plugin to 'offline'
Summary: kopete crash when setting yahoo plugin to 'offline'
Status: RESOLVED FIXED
Alias: None
Product: kopete
Classification: Applications
Component: Yahoo Plugin (show other bugs)
Version: unspecified
Platform: unspecified Linux
: NOR crash
Target Milestone: ---
Assignee: Kopete Developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-12-07 08:41 UTC by Amit Shah
Modified: 2004-01-01 20:56 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Shah 2003-12-07 08:41:37 UTC
Version:           0.7.93 (using KDE 3.1.93 (3.2 beta 1), compiled sources)
Compiler:          gcc version 3.3.2 (Debian)
OS:          Linux (i686) release 2.6.0-test11

The following debug trace may not be entirely useful, but here it is nevertheless.

(no debugging symbols found)...0x4191a331 in __waitpid_nocancel () from /lib/tls/libpthread.so.0
#0  0x4191a331 in __waitpid_nocancel () from /lib/tls/libpthread.so.0
#1  0x40f5d784 in KCrash::defaultCrashHandler(int) ()
   from /home/Amit/kde3.2-beta1/lib/libkdecore.so.4
#2  <signal handler called>
#3  0x41f8d734 in YahooSession::logOff() ()
   from /home/Amit/kde3.2-beta1/lib/kde3/kopete_yahoo.so
#4  0xbfffea20 in ?? ()

--------------

I wanted to disconnect and quit kopete, so I right-clicked the yahoo icon and selected 'offline'. kopete immediately crashed. I don't know how to reproduce this.
Comment 1 Martijn Klingens 2003-12-07 12:42:42 UTC
Subject: Re: [Kopete-devel]  New: kopete crash when setting yahoo plugin to 'offline'

Do you have any output on the console?

Did you compile Kopete using --enable-debug=full? It seems you don't, which 
makes tracking it down a lot harder for us.

Do you have valgrind tracelogs? ('valgrind --num-callers=12 kopete --nofork')

Is this the entire backtrace? If so, #4 makes me suspect serious stack or 
memory corruption. The most likely way to trigger this is to write data to a 
deleted object that happens to overlap with the stack. OTOH, #3 seems sane 
again, which is a bit strange. All in all a very weird backtrace.

Comment 2 Richard Smith 2003-12-07 15:38:14 UTC
Subject: Re: [Kopete-devel]  kopete crash when setting yahoo plugin to 'offline'

On Sunday 07 December 2003 11:42 am, Martijn Klingens wrote:
> Is this the entire backtrace? If so, #4 makes me suspect serious stack or
> memory corruption. The most likely way to trigger this is to write data to
> a deleted object that happens to overlap with the stack. OTOH, #3 seems
> sane again, which is a bit strange. All in all a very weird backtrace.

Maybe the stack corruption occurred in the function which called #3...
Looks like #3 is probably YahooAccount::disconnect (which is a very dangerous 
name for a function in a QObject anyway - maybe QObject::disconnect was 
intended to be called by someone?)
The only thing that calls on the way is isConnected. And the only way I can 
see that going wrong is if the myself contact is deleted but not NULL'd.

Any insights, anyone?

lilac

Comment 3 Martijn Klingens 2003-12-07 16:28:39 UTC
Subject: Re: [Kopete-devel]  kopete crash when setting yahoo plugin to 'offline'

On Sunday 07 December 2003 15:38, Richard Smith wrote:
> Maybe the stack corruption occurred in the function which called #3...
> Looks like #3 is probably YahooAccount::disconnect (which is a very
> dangerous name for a function in a QObject anyway - maybe
> QObject::disconnect was intended to be called by someone?)

Unlikely. Our disconnect is a void method, the Qt versions take 3 or 4 
parameters, that's easy to distinguish.

> The only thing that calls on the way is isConnected. And the only way I can
> see that going wrong is if the myself contact is deleted but not NULL'd.

Well, _IF_ it is indeed stack corruption it can have happened anytime. Unlike 
reading deleted memory stack corruption alters a program's behaviour a LOT 
later, when returning from a method.

Example:

void foo()
{
    bar();
    doSomethingElse();
}

void bar()
{
    char[20] bla;
    char *c = &bla;

    int index = -1;

    *(c + index) = 0x12;
}

Such out-of-bounds accesses are fairly easy to get. And in a lot more 
potential places.

Comment 4 Richard Smith 2003-12-07 16:57:32 UTC
Subject: Re: [Kopete-devel]  kopete crash when setting yahoo plugin to 'offline'

On Sunday 07 December 2003 3:28 pm, Martijn Klingens wrote:
> On Sunday 07 December 2003 15:38, Richard Smith wrote:
> > Maybe the stack corruption occurred in the function which called #3...
> > Looks like #3 is probably YahooAccount::disconnect (which is a very
> > dangerous name for a function in a QObject anyway - maybe
> > QObject::disconnect was intended to be called by someone?)
>
> Unlikely. Our disconnect is a void method, the Qt versions take 3 or 4
> parameters, that's easy to distinguish.

Not true at all. The Qt versions take 2 or 3 parameters. The 3 parameter one 
has all three params defaulted. So if someone calls account->disconnect() 
through a pointer whose static type is KopeteAccount*, they might well be 
calling the wrong function.

These functions NEED renaming anyway (post 3.2 I guess), since they shadow a 
base class function which does something different.

> > The only thing that calls on the way is isConnected. And the only way I
> > can see that going wrong is if the myself contact is deleted but not
> > NULL'd.
>
> Well, _IF_ it is indeed stack corruption it can have happened anytime.
> Unlike reading deleted memory stack corruption alters a program's behaviour
> a LOT later, when returning from a method.

True indeed. In fact, this need not be stack corruption at all. It's 
theoretically possible the compiler uses ESP to store some value in 
YahooAccount::logOff(), and that value is still stored when the program 
crashes.

we-need-more-information-to-diagnose-ly yrs,
lilac

Comment 5 Martijn Klingens 2003-12-07 17:07:30 UTC
Subject: Re: [Kopete-devel]  kopete crash when setting yahoo plugin to 'offline'

On Sunday 07 December 2003 16:57, Richard Smith wrote:
> Not true at all. The Qt versions take 2 or 3 parameters. The 3 parameter
> one has all three params defaulted. So if someone calls
> account->disconnect() through a pointer whose static type is
> KopeteAccount*, they might well be calling the wrong function.

Oops, I meant connect(), not disconnect(), right.

> These functions NEED renaming anyway (post 3.2 I guess), since they shadow
> a base class function which does something different.

Well, the old name we had was butt ugly and AFAICS there are no ambiguous 
overloads. Also I modelled this after KExtendedSocket, which has the same 
naming convention.

What would you suggest? Following QSocket and use open()/close() ?

Comment 6 Richard Smith 2003-12-07 17:50:43 UTC
Subject: Re: [Kopete-devel]  kopete crash when setting yahoo plugin to 'offline'

On Sunday 07 December 2003 4:07 pm, Martijn Klingens wrote:
> On Sunday 07 December 2003 16:57, Richard Smith wrote:
> > These functions NEED renaming anyway (post 3.2 I guess), since they
> > shadow a base class function which does something different.
>
> Well, the old name we had was butt ugly and AFAICS there are no ambiguous
> overloads. Also I modelled this after KExtendedSocket, which has the same
> naming convention.
>
> What would you suggest? Following QSocket and use open()/close() ?

logOn() and logOff() seem more appropriate for IM accounts IMO.

lilac

Comment 7 Martijn Klingens 2003-12-07 19:18:36 UTC
Subject: Re: [Kopete-devel]  kopete crash when setting yahoo plugin to 'offline'

On Sunday 07 December 2003 17:50, Richard Smith wrote:
> logOn() and logOff() seem more appropriate for IM accounts IMO.

Fair enough. It's good to have some native speakers around :)

Comment 8 Amit Shah 2003-12-08 07:30:54 UTC
Subject: Re:  kopete crash when setting yahoo plugin to 'offline'

On Sunday 07 Dec 2003 17:12, Martijn Klingens wrote:
> Do you have any output on the console?

Sorry, didn't check.

> Did you compile Kopete using --enable-debug=full? It seems you don't, which
> makes tracking it down a lot harder for us.

no, I'm using the konstruct build, and it doesn't have --enable-debug=full 
turned on. I'll do that for beta2 (which is expected soon, right?)

> Do you have valgrind tracelogs? ('valgrind --num-callers=12 kopete
> --nofork')

no; and I couldn't reproduce it... so can't really say when I'll be able to 
provide more info

>
> Is this the entire backtrace? If so, #4 makes me suspect serious stack or

yes, it is. there were a lot of (debug symbols not found) messages at the top, 
but I stripped them. The most interesting part I've posted.

Comment 9 Matt Rogers 2003-12-19 17:26:32 UTC
Amit: provide more info when you can. If I don't hear anything back from you within the next couple of weeks, I'll probably close the bug since I've never seen it here myself.
Comment 10 Amit Shah 2003-12-20 05:08:55 UTC
Subject: Re:  kopete crash when setting yahoo plugin to 'offline'

On Friday 19 Dec 2003 21:56, Matt Rogers wrote:
> ------- Amit: provide more info when you can. If I don't hear anything back
> from you within the next couple of weeks, I'll probably close the bug since
> I've never seen it here myself.

Sorry, I too haven't seen it again. But from the discussion we had, I guess 
the bug was identified.... or am I wrong?

Comment 11 Matt Rogers 2003-12-24 05:37:49 UTC
there's a couple of places it might crash, i'm looking into those now
Comment 12 Matt Rogers 2004-01-01 20:56:09 UTC
ok, i think i've fixed a few of the places where it might crash, so I'll go ahead and close it. The updates are in CVS.