Bug 137007

I can nearly 100% reproduce it when i run with:
# gdb --args htt_server -d

I have lesser chance reproduce it when i run with:
# htt_server -d 

I have not yet reproduce it when i run with:
# valgrind --tool=memcheck htt_server -d

Can this narrow down to a toolchain problem?

I recompiled im-sdk 12.1-1 on rawhide-20041024. After installing these
rpms, and quite a bit of testing, i was not able to crash the htt
server. This looks like a toolchain problem to me now. Leon, can you
do the same on your end and verify?

I can still able to reproduce it after recompliation.

Actually I can able to crash htt_server running with valgrind. However
it is much harder (For one time I need over 30 runs of gedit to get
one crash):

Here is the valgrind output of last mem error before segfault:
--
if_le_CreateSC() : Loading Engines ...
if_le_SetSCFocus() s:1bf98d48, current_session:1bf98d48, udp:0x1bf6d358
==2261==
==2261== Thread 2:
==2261== Invalid read of size 4
==2261==    at 0x80769A3: ??? (IIIMP_ICState.cpp:1205)
==2261==    by 0x807896B: ??? (IIIMP_ICState.cpp:1229)
==2261==    by 0x806AA8A: ??? (ICState.cpp:17)
==2261==    by 0x806A3D6: ??? (stl_tree.h:175)
==2261==  Address 0x4 is not stack'd, malloc'd or (recently) free'd
==2295==
==2295== Thread 2:
==2295== Syscall param execve(envp) contains uninitialised or
unaddressable byte(s)
==2295==    at 0x9274BF: execve (in /lib/tls/libc-2.3.3.so)
==2295==    by 0x9277FA: execl (in /lib/tls/libc-2.3.3.so)
==2295==    by 0x8055D3F: ??? (basic_string.h:1452)
==2295==    by 0x8055DFE: ??? (IMSignal.cpp:36)
==2295==  Address 0x52BFE8F0 is not stack'd, malloc'd or (recently) free'd
==2295==
==2295== Thread 2:
==2295== Syscall param execve(envp[i]) contains uninitialised or
unaddressable byte(s)
==2295==    at 0x9274BF: execve (in /lib/tls/libc-2.3.3.so)
==2295==    by 0x9277FA: execl (in /lib/tls/libc-2.3.3.so)
==2295==    by 0x8055D3F: ??? (basic_string.h:1452)
==2295==    by 0x8055DFE: ??? (IMSignal.cpp:36)
==2295==  Address 0x52BFEA1E is not stack'd, malloc'd or (recently) free'd
/proc/2261/exe: No such file or directory.
/root/2261: No such file or directory.Killed
[root@reflex ~]#
/usr/lib/im/share/iiim/gdbcmd:1: Error in sourced command file:
No stack.

Look like some code in per-user config creates this screwing effect.
Will need to backport to make fc3 stable until further improvement on
that particular implementation, as it is important for Indic users for
FC3.

Fixed in -4 in dist-fc3-HEAD right?

Revented to stable state. Tagoh-san has rebuilt it in 12.1-4.

still happens, another backtrace is here:
(gdb) thread apply 2 bt
                                                                     
                                                       
Thread 2 (Thread -1208271952 (LWP 11181)):
#0  0x0019b7a2 in ?? () at rtld.c:577 from /lib/ld-linux.so.2
#1  0x003f23fb in ?? () from /lib/tls/libpthread.so.0
#2  0x08055e38 in IMSignal::_segv (this=0x893fb78, num=11) at
IMSignal.cpp:104
#3  0x08055f9f in IMSignal::segv (this=0xfffffe00) at IMSignal.cpp:36
#4  0x080552f0 in signal_handler (num=0) at IMSignal.cpp:137
#5  <signal handler called>
#6  0x08077063 in IIIMP_ICState_WAITING::match_waiting_message
(this=0x894db18, pmes=0x8960fe8) at IIIMP_ICState.cpp:1203
#7  0x0807903c in IIIMP_ICState_WAITING::message_proc (this=0x894db18,
x_pmes=0x8960fe8) at IIIMP_ICState.cpp:1227
#8  0x0806b0eb in ICState::deliver (this=0x89502b8, message=0x894db18)
at ICState.cpp:17
#9  0x0806aa47 in IMState::dispatch (this=0x8964ae0, im_id=1, ic_id=1,
message=0x8960fe8) at stl_tree.h:175
#10 0x0806ba34 in IIIMProtocol::receive_and_dispatch (this=0x8950ac0,
pims=0x8964ae0, flags=0) at IIIMProtocol.cpp:32
#11 0x08069ea3 in IMScheduler_MTPC_thread_entry (priv=0x0) at
IMScheduler_MTPC.cpp:25
#12 0x003ec1d5 in start_thread (arg=0x0) at pthread_create.c:269
#13 0x0027d2da in ?? () from /lib/tls/libc.so.6
(gdb) thread apply 2 frame 6
                                                                     
                                                       
Thread 2 (Thread -1208271952 (LWP 11181)):
#6  0x08077063 in IIIMP_ICState_WAITING::match_waiting_message
(this=0x894db18, pmes=0x8960fe8) at IIIMP_ICState.cpp:1203
1203            u16string mimname =
CONV_IIIMP_STR(pmes->v.aux_simple.input_method_name);
Current language:  auto; currently c++
(gdb) p pmes
$1 = (IIIMP_message *) 0x8960fe8
(gdb) p pmes->v
$2 = {connect = {byte_order = 1, protocol_version = 0, user_name =
0x894db70, auth = 0x0}, connect_reply = {
    language = 0x1}, disconnect = {dummy = "\001"}, disconnect_reply =
{dummy = "\001"}, register_trigger_keys = {
    trigger_on = 0x1, trigger_off = 0x0}, trigger_notify = {flag = 1},
trigger_notify_reply = {dummy = "\001"},
  register_hotkeys = {scope_and_profile_id = 1, scope = 0, profile_id
= 143973232, hotkeys = 0x0}, select_hotkey_profile = {
    scope_and_profile_id = 1, scope = 0, profile_id = 143973232},
hotkey_notify = {hotkey_id = 1, index = 0},
  hotkey_notify_reply = {dummy = "\001"}, hotkey_state_notify =
{hotkey_id = 1, current_state_flag = 0},
  hotkey_state_notify_reply = {dummy = "\001"}, im_read_ns =
{listener_id = 1, filename = 0x0}, im_read_ns_reply = {
    listener_id = 1, size = 0, object = 0x894db70}, setimvalues =
{attr_list = 0x1}, setimvalues_reply = {dummy = "\001"},
  getimvalues = {attr_list = 0x1}, getimvalues_reply = {attr_list =
0x1}, forward_event = {contents = 0x1},
  forward_event_reply = {dummy = "\001"}, commit_string = {contents =
0x1}, forward_event_with_operations = {
    contents = 0x1, operation = 0x0},
forward_event_with_operations_reply = {operation = 0x1}, createic = {
    attr_list = 0x1}, createic_reply = {dummy = "\001"}, destroyic =
{dummy = "\001"}, destroyic_reply = {dummy = "\001"},
  seticvalues = {attr_list = 0x1}, seticvalues_reply = {dummy =
"\001"}, geticvalues = {attr_list = 0x1},
  geticvalues_reply = {attr_list = 0x1}, seticfocus = {dummy =
"\001"}, seticfocus_reply = {dummy = "\001"},
  unseticfocus = {dummy = "\001"}, unseticfocus_reply = {dummy =
"\001"}, resetic = {dummy = "\001"}, resetic_reply = {
    dummy = "\001"}, preedit_start = {dummy = "\001"},
preedit_start_reply = {maximum_length = 1}, preedit_draw = {
    caret = 1, change_first = 0, change_length = 143973232, preedit =
0x0}, preedit_draw_reply = {dummy = "\001"},
  preedit_done = {dummy = "\001"}, preedit_done_reply = {dummy =
"\001"}, status_start = {dummy = "\001"},
  status_start_reply = {dummy = "\001"}, status_draw = {status = 0x1},
status_draw_reply = {dummy = "\001"}, status_done = {
    dummy = "\001"}, status_done_reply = {dummy = "\001"},
lookup_choice_start = {master = 1, choice_per_window = 0,
    rows = 143973232, columns = 0, direction = 1, label_owner =
143978228}, lookup_choice_start_reply = {dummy = "\001"},
  lookup_choice_draw = {first = 1, last = 0, current = 143973232,
choice = 0x0, index_label = 0x1, title = 0x894eef4},
  lookup_choice_draw_reply = {dummy = "\001"}, lookup_choice_done =
{dummy = "\001"}, lookup_choice_done_reply = {
    dummy = "\001"}, lookup_choice_process = {type = 1, value = 0},
lookup_choice_process_reply = {dummy = "\001"},
  aux_simple = {class_index = 1, input_method_name = 0x0}, aux_value =
{class_index = 1, input_method_name = 0x0,
    integer_value = 0x894db70, string_value = 0x0}, aux_start =
{class_index = 1, input_method_name = 0x0},
  aux_start_reply = {class_index = 1, input_method_name = 0x0},
aux_draw = {class_index = 1, input_method_name = 0x0,
    integer_value = 0x894db70, string_value = 0x0}, aux_draw_reply =
{class_index = 1, input_method_name = 0x0},
  aux_done = {class_index = 1, input_method_name = 0x0},
aux_done_reply = {class_index = 1, input_method_name = 0x0},
  aux_setvalues = {class_index = 1, input_method_name = 0x0,
integer_value = 0x894db70, string_value = 0x0},
  aux_setvalues_reply = {class_index = 1, input_method_name = 0x0},
aux_getvalues = {class_index = 1,
    input_method_name = 0x0, integer_value = 0x894db70, string_value =
0x0}, aux_getvalues_reply = {class_index = 1,
    input_method_name = 0x0, integer_value = 0x894db70, string_value =
0x0}, protocol_version = {number = 1}}
(gdb) p pmes->v.aux_simple
$3 = {class_index = 1, input_method_name = 0x0}
(gdb) p pmes->v.aux_simple.input_method_name
$4 = (IIIMP_string *) 0x0

Well, in IIIMPUtil.hh,
#define CONV_IIIMP_STR(ps) (((ps)->len > 0) ? u16string((ps)->ptr,
(ps)->len) : u16string(""))

This macro assumes that ps isn't NULL. but as gdb says, it was NULL.
I'm not 100% sure if this code also assumes input_method_name doesn't
have to be NULL or this macro should do NULL-check.

*** Bug 136753 has been marked as a duplicate of this bug. ***

should be fixed in 12.1-7

Confirmed fixed in im-sdk-12.1-7. I can activate UnitLE through the
hotkey menu and from the GIMLET (except bn).