[bug #18321] -[GSXMLDocument setRoot:] causes a crash when using a node that already belongs to another document

[Lon Varscsak]

URL:
  <http://savannah.gnu.org/bugs/?18321>

                 Summary: -[GSXMLDocument setRoot:] causes a crash when using
a node that already belongs to another document
                 Project: GNUstep
            Submitted by: varscsak
            Submitted on: Friday 11/17/2006 at 21:46
                Category: Base/Foundation
                Severity: 3 - Normal
              Item Group: Bug
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open

    _______________________________________________________

Details:

If you try to create a new document, then call setRoot: with a node that
already belongs to another document, and then release the pool that the new
document belongs to, it will crash.

Take a really simple example:

NSAutoreleasPool *pool = [[NSAutoreleasePool alloc] init];
GSXMLParser *p = [GSXMLParser parserWithContentsOfFile:@"somefile.xml"];
GSXMLDocument *pDoc = [p document];
GSXMLNode *rootNode = [pDoc root];

//create a new document
GSXMLDocument *tempDocument = [GSXMLDocument documentWithVersion:@"1.0"];

//use our existing root node (although any node in the document causes the
same problem
[tempDocument setRoot:rootNode];

[pool release]; //this is where the crash happens

This is the message logged:

warning: HEAP[SomeProgram.exe]: 
warning: Invalid Address specified to RtlFreeHeap( 003D0000, 00AE67D9 )

Here is the backtrace:

#0  0x7c901231 in ntdll!DbgUiConnectToDbg () from ntdll.dll
#1  0x7c96c943 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#2  0x0022fae4 in ?? ()
#3  0x7c96cd80 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#4  0x00ae6981 in ?? ()
#5  0x003d0000 in ?? ()
#6  0x00ae6989 in ?? ()
#7  0x0022fb58 in ?? ()
#8  0x7c96df66 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#9  0x003d0000 in ?? ()
#10 0x00ae6981 in ?? ()
#11 0x7c96e11c in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#12 0x003d0000 in ?? ()
#13 0x00ae6989 in ?? ()
#14 0x40000060 in ?? ()
#15 0xffffffff in ?? ()
#16 0x000001d0 in ?? ()
#17 0x00ae51e8 in ?? ()
#18 0x003d0000 in ?? ()
#19 0xffffffff in ?? ()
#20 0x7c96e0d4 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#21 0x0101a5d0 in ?? ()
#22 0x0022fad8 in ?? ()
#23 0x50000061 in ?? ()
#24 0x000777f0 in ?? ()
#25 0x00ae6981 in ?? ()
#26 0x003d0000 in ?? ()
#27 0xffffffff in ?? ()
#28 0x7c96e0d4 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#29 0x0001a5d0 in ?? ()
#30 0x0022faf8 in ?? ()
#31 0x50000061 in ?? ()
#32 0x0022fc30 in ?? ()
#33 0x7c90ee18 in strchr () from ntdll.dll
#34 0x7c96e0f8 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#35 0x00000001 in ?? ()
#36 0x0022fc40 in ?? ()
#37 0x7c94a5d0 in ntdll!RtlInsertElementGenericTableAvl () from ntdll.dll
#38 0x003d0000 in ?? ()
#39 0x50000061 in ?? ()
#40 0x00ae6989 in ?? ()
#41 0x003d0000 in ?? ()
#42 0x00ae6989 in ?? ()
#43 0x40000060 in ?? ()
#44 0x7c96e0d4 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll
#45 0x0101a5d0 in ?? ()
#46 0x0022fb38 in ?? ()
#47 0x50000061 in ?? ()
#48 0x0000fc70 in ?? ()
#49 0x7c90ee18 in strchr () from ntdll.dll
#50 0x0022fad4 in ?? ()
#51 0xffffffff in ?? ()
#52 0x0022fc68 in ?? ()
#53 0x7c90ee18 in strchr () from ntdll.dll
#54 0x7c926ac8 in ntdll!iswdigit () from ntdll.dll
#55 0xffffffff in ?? ()
#56 0x7c926abe in ntdll!iswdigit () from ntdll.dll
#57 0x7c9268ad in ntdll!iswdigit () from ntdll.dll
#58 0x00240000 in ?? ()
#59 0x40000060 in ?? ()
#60 0x003d0000 in ?? ()
#61 0x00244ce0 in ?? ()
#62 0x00244cc0 in ?? ()
#63 0x00ae5c48 in ?? ()
#64 0x003d0000 in ?? ()
#65 0xffffffff in ?? ()
#66 0x0000fca0 in ?? ()
#67 0x7c90ee18 in strchr () from ntdll.dll
#68 0x0022fb1c in ?? ()
#69 0xffffffff in ?? ()
#70 0x0000fcb0 in ?? ()
#71 0x7c90ee18 in strchr () from ntdll.dll
#72 0x003d0000 in ?? ()
#73 0xffffffff in ?? ()
#74 0x0022fcc0 in ?? ()
#75 0x7c90ee18 in strchr () from ntdll.dll
#76 0x7c926ac8 in ntdll!iswdigit () from ntdll.dll
#77 0xffffffff in ?? ()
#78 0x7c006abe in ?? ()
#79 0x7c9268ad in ntdll!iswdigit () from ntdll.dll
#80 0x003d0000 in ?? ()
#81 0x40000060 in ?? ()
#82 0x0022fce0 in ?? ()
#83 0x7c90ee18 in strchr () from ntdll.dll
#84 0x7c926ac8 in ntdll!iswdigit () from ntdll.dll
#85 0xffffffff in ?? ()
#86 0x7c006abe in ?? ()
#87 0x7c9268ad in ntdll!iswdigit () from ntdll.dll
#88 0x0022fb6c in ?? ()
#89 0x40000060 in ?? ()
#90 0x0022fd00 in ?? ()
#91 0x7c90ee18 in strchr () from ntdll.dll
#92 0x7c926ac8 in ntdll!iswdigit () from ntdll.dll
#93 0xffffffff in ?? ()
#94 0x0022fd10 in ?? ()
#95 0x7c9268ad in ntdll!iswdigit () from ntdll.dll
#96 0x003d0000 in ?? ()
#97 0x40000060 in ?? ()
#98 0x00ae6989 in ?? ()
#99 0x00000000 in ?? () from 
#100 0x00ae6989 in ?? ()
#101 0x00ae70b8 in ?? ()
#102 0x0022fbbc in ?? ()
#103 0x0022fc78 in ?? ()
#104 0x0022fc88 in ?? ()
#105 0x667b1fa9 in GSIMapBucketForKey (map=0xae6981, key={ptr = 0x3d0000,
cptr = 0x3d0000, str = 0x3d0000 "È", cstr = 0x3d0000 "È"}) at
../Headers/Additions/GNUstepBase/GSIMap.h:330






    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?18321>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/