Segmentation fault in wxErlang

[Sergei Golovan]

Hi!

A Debian user recently found a bug in wxErlang (in the current Erlang
R14A). It consistently segfaults when playing with sudoku demo.

I couldn't reproduce it with my default SMP settings (+S 8) but it
breaks soon (in a few minutes) after the application start and
interacting with the game field if Erlang VM is started with +S 1
option.

So, I run

% erl -pa /usr/lib/erlang/lib/wx-0.98.6/examples/sudoku +S 1
Erlang R14A (erts-5.8) [source] [smp:1:1] [rq:1] [async-threads:0]
[kernel-poll:false]

Eshell V5.8  (abort with ^G)
1> sudoku:start().
<0.34.0>
sudoku:40: Time: 3556875
Below level 39 40
Below level 34 35
Below level 29 30
Below level 24 25
No left 24

Then I start playing, putting numbers there and there...
After a while:

2> zsh: segmentation fault (core dumped)  erl -pa
/usr/lib/erlang/lib/wx-0.98.6/examples/sudoku +S 1

Below is a GDB session listing. I would be glad to provide any
additional info if required.

Core was generated by `/usr/lib/erlang/erts-5.8/bin/beam.smp -S 1 --
-root /usr/lib/erlang -progname e'.
Program terminated with signal 11, Segmentation fault.
[New process 11376]
[New process 11387]
[New process 11366]
[New process 11373]
[New process 11372]
[New process 11370]
[New process 11371]
#0  0xf51e7a75 in WxeApp::dispatch_cb (this=0x8453398,
batch=0x84942b0, temp=0x8494240, process=835)
    at wxe_impl.cpp:411
411               if(event->caller == process ||  // Callbacks from CB
process only
(gdb) bt
#0  0xf51e7a75 in WxeApp::dispatch_cb (this=0x8453398,
batch=0x84942b0, temp=0x8494240, process=835)
    at wxe_impl.cpp:411
#1  0xf51e7c0a in handle_event_callback (port=0x240, process=643) at
wxe_impl.cpp:306
#2  0xf528d0cc in sendevent (event=0xf2c81ab4, port=0x240) at
gen/wxe_events.cpp:821
#3  0xf528e496 in wxeEvtListener::forward (this=0x857ece0,
event=@0xf2c81ab4) at gen/wxe_events.cpp:328
#4  0xf49e77f1 in wxAppConsole::HandleEvent () from
/usr/lib/libwx_baseu-2.8.so.0
#5  0xf4a849ca in wxEvtHandler::ProcessEventIfMatches () from
/usr/lib/libwx_baseu-2.8.so.0
#6  0xf4a84b56 in wxEvtHandler::SearchDynamicEventTable () from
/usr/lib/libwx_baseu-2.8.so.0
#7  0xf4a85c8d in wxEvtHandler::ProcessEvent () from
/usr/lib/libwx_baseu-2.8.so.0
#8  0xf4c45fd0 in wxWindow::GtkSendPaintEvents () from
/usr/lib/libwx_gtk2u_core-2.8.so.0
#9  0xf4c4658d in ?? () from /usr/lib/libwx_gtk2u_core-2.8.so.0
#10 0xf45e6816 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#11 0x084aa220 in ?? ()
#12 0xf2c82070 in ?? ()
#13 0x085ec2f8 in ?? ()
#14 0xf4398678 in ?? () from /usr/lib/libgobject-2.0.so.0
#15 0x0857ee30 in ?? ()
#16 0x0857f320 in ?? ()
#17 0xf2c81c18 in ?? ()
#18 0xf436790b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
Backtrace stopped: frame did not save the PC
Current language:  auto; currently c++
(gdb) print event
$1 = (wxeCommand *) 0xf11023e8
(gdb) print event->caller
$2 = 611
(gdb) print process
$3 = 835
(gdb) print event->op
$4 = 10
(gdb) print memenv
$5 = (wxeMemEnv *) 0x0
(gdb) print event->port
$6 = (ErlDrvPort) 0x23f
(gdb)

All observed segfaults were at the same place in WxeApp::dispatch_cb() function.

(The Erlang was built without Debian-specific patches and with symbols enabled.)

Cheers!
-- 
Sergei Golovan