I'm quite sure the problem is in postingsFreeListDW management:

The postings after postingsFreeCountDW are used somewhere (but are still here 
in a list). If you
remove block of free postings in balanceRAM, you are removing before 
postingsFreeCountDW
so an "empty block" is  created inside postingsFreeListDW (at the end of free 
postings but before
all used postings). Then if you return all/some used postings back into list, 
you return them to the beginning
of this empty block. This can cause duplicated pointers in the list.

It can also be a reason, why postingsFreeCountDW < postingsFreeListDW.length in 
the destructor.

Borek 


> -----Original Message-----
> From: Itamar Syn-Hershko [mailto:ita...@code972.com]
> Sent: Monday, June 28, 2010 10:46 PM
> To: clucene-developers@lists.sourceforge.net
> Subject: Re: [CLucene-dev] vector subscript outofrangeexceptionduringindexing
> 
> On 28/6/2010 10:48 PM, Kostka Bořivoj wrote:
> > I did some tests with cl_demo and found following:
> >
> > In DocumentsWriter destructor postingsFreeCountDW is 5888 and the length of
> postingsFreeListDW.values
> > is 7424. Maybe I'm wrong but if I understand the logic implemented in 
> > getPostings
> and recyclePostings well,
> > the postingsFreeListDW.values above postingsFreeCountDW shouldn't be
> considered a valid pointers
> > But they are by ArrayBase destructor, and delete attempt can (and will) 
> > cause crash.
> >
> > To test this, I simply added (yes it might be done more efficient way using 
> > memset)
> >
> > for ( size_t i = this->postingsFreeCountDW; i<  
> > this->postingsFreeListDW.length;
> i++ ){
> >       this->postingsFreeListDW.values[i] = NULL;
> >   }
> >
> > and cl_demo runs correctly.
> >
> > Of course I could miss something important in code and produce memory leaks
> instead of fixing bug....
> >
> 
> NULLifying alone is not the right solution, as it will leak memory. The
> _CLDELETE macro also sets that position in the array to NULL after
> deleting it, so your conclusion is incorrect.
> 
> The only reason why cl_demo runs correctly with your change is it
> prevents double deletion. Exactly what I said we should trace and fix...
> 
> postingsFreeListDW is ObjectArray, which deletes its value and the
> pointers contained within it. I would very much like to keep it this
> way and find why the values in it are being deleted twice (and from
> where), instead of transofrming it into ValueArray. Perhaps placing it
> on the heap instead of on the stack and deleting + NULLifying the actual
> postingsFreeListDW on destructor will do this?
> 
> Itamar.
> 
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> CLucene-developers mailing list
> CLucene-developers@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/clucene-developers

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
CLucene-developers mailing list
CLucene-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/clucene-developers

Reply via email to