レナート   Wunschkonzert, Ponyhof und Abenteuerspielplatz   ﻟﻴﻨﺎﺭﺕ

Posted by Søren Hauberg at Tue Mar 23 23:28:55 2010
I am really curious about this here thing. I mean, how is it possible for an application to trigger a crash in PA? I can understand that an application can crash itself, but how can it take PA with it? And why isn't this considered a bug in PA? In a perfect world, shouldn't PA be able to handle even the most stupid applications?

Søren

P.S. I realise that the above text can be read as a criticism of PA, but it really isn't. I am simply curious.

Posted by Robert Szalai at Wed Mar 24 12:42:41 2010
Indeed, would be nice to know what rsvg_term() does or xmlCleanupParser() for that matter. Does it screw up the stack? Does it write to some memory where it is not supposed to? I read the full bug report and what I can see that there is some understanding behind the comments that I didn't get. Could you explain it to me?
Thanks,
Robert

Posted by Lennart at Wed Mar 24 12:57:55 2010
Søren: it's the PA client code. It lives in the same process (obviously) as the code calling xmlCleanupParser()/rsvg_term(). PA allocates a TLS variable and if you issue those two calls twice it might end up being freed by them although they belong to the PA client code. If the PA client code then subsequently tries to access the TLS var it will crash, or in the best case hit an assert. The PA server will of course not be pulled down by all of this.

Robert: just read the older blog story, follow the links, It should explain everything.

Posted by Søren Hauberg at Wed Mar 24 17:20:25 2010
Ahh, I see. I thought the server died. Thanks for explaining (and for the nice work you do).

Søren

Posted by Daniel Elstner at Thu Mar 25 14:41:28 2010
Ah. I've always considered rsvg_term() as Valgrind aid, meant to be called just before exiting from the application. I think it's mentioned somewhere.