Hi Folks,
I just stumbled across this today when I was probing some parts of a
library I'd written based on using SAX parsing with libxml. Basically,
I couldn't figure out what was causing the ruby interpreter to crash
based on guaranteed syntactically correct XML input (verified by tidy
and other tools).
What I found was that there was a case where I was throwing a
RuntimeError inside of a SAX callback handler method because an element
attribute was missing. Each time this happened, I crashed the runtime.
I tried this with several versions, thinking that I'd screwed up my ruby
install somehow, but the results are the same.
Any chance of a fix by someone who understands libxml's C API would be
most appreciated! :)
Host details:
nene$ ruby -v
ruby 1.8.7 (2008-08-11 patchlevel 72) [x86_64-linux]
nene$ uname -a
Linux nene 2.6.28-11-generic #42-Ubuntu SMP Fri Apr 17 01:58:03 UTC 2009 x86_64
GNU/Linux
excalibur$ ruby -v
ruby 1.8.6 (2007-09-24 patchlevel 111) [x86_64-linux]
excalibur$ uname -a
Linux excalibur 2.6.24-26-generic #1 SMP Tue Dec 1 17:55:03 UTC 2009 x86_64
GNU/Linux
Both are Ubuntu boxes with libxml-ruby version 1.1.3 and the following
libraries installed:
nene$ ls /usr/lib/libxml*
/usr/lib/libxml++-2.6.so.2 /usr/lib/libxml2.so
/usr/lib/libxml++-2.6.so.2.0.7 /usr/lib/libxml2.so.2
/usr/lib/libxml2.a /usr/lib/libxml2.so.2.6.32
/usr/lib/libxml2.la
excalibur$ ls /usr/lib/libxml*
/usr/lib/libxml2.a /usr/lib/libxml2.so.2.6.31 /usr/lib/libxml.so.0
/usr/lib/libxml2.la /usr/lib/libxml.a /usr/lib/libxml.so.1
/usr/lib/libxml2.so /usr/lib/libxml.la /usr/lib/libxml.so.1.8.17
/usr/lib/libxml2.so.2 /usr/lib/libxml.so
The backtrace on the Ubuntu 8.04 machine (excalibur) looks like this:
Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7f65346ec6e0 (LWP 2495)]
0x00007f65335f3095 in raise () from /lib/libc.so.6
(gdb)
(gdb) where
#0 0x00007f65335f3095 in raise () from /lib/libc.so.6
#1 0x00007f65335f4af0 in abort () from /lib/libc.so.6
#2 0x00007f653362da7b in ?? () from /lib/libc.so.6
#3 0x00007f653363508a in ?? () from /lib/libc.so.6
#4 0x00007f6533638c1c in free () from /lib/libc.so.6
#5 0x00007f65304f6be4 in xmlFreeParserCtxt () from /usr/lib/libxml2.so.2
#6 0x00007f6534247882 in garbage_collect () at gc.c:1209
#7 0x00007f6534247e6c in ruby_xmalloc (size=2495) at gc.c:103
#8 0x00007f653422683d in frame_dup (frame=0x2470180) at eval.c:8264
#9 0x00007f6534227e19 in blk_dup (dup=0x246fc90, orig=<value optimized out>)
at eval.c:8301
#10 0x00007f653422a65d in proc_clone (self=140072540849440) at eval.c:8325
#11 0x00007f6534235511 in rb_mod_define_method (argc=<value optimized out>,
argv=<value optimized out>, mod=140072540856200) at eval.c:9642
#12 0x00007f653423148f in rb_call0 (klass=140072648096320,
recv=140072540856200, id=4193, oid=4193, argc=1, argv=0x7fff6cb72708,
body=0x7f65346e73f0, flags=<value optimized out>) at eval.c:5846
#13 0x00007f65342317b8 in rb_call (klass=140072648096320,
recv=140072540856200, mid=4193, argc=1, argv=0x7fff6cb72708, scope=1,
self=6) at eval.c:6093
#14 0x00007f6534236ebf in rb_f_send (argc=2, argv=0x7fff6cb72700,
recv=140072540856200) at eval.c:6141
#15 0x00007f653423148f in rb_call0 (klass=140072648096080,
recv=140072540856200, id=4049, oid=4049, argc=2, argv=0x7fff6cb72700,
body=0x7f65346e7aa8, flags=<value optimized out>) at eval.c:5846
#16 0x00007f65342317b8 in rb_call (klass=140072648096080,
recv=140072540856200, mid=4049, argc=2, argv=0x7fff6cb72700, scope=0,
self=140072540856840) at eval.c:6093
#17 0x00007f65342375b7 in rb_eval (self=140072540856840,
n=<value optimized out>) at eval.c:3473
#18 0x00007f653423ace3 in rb_eval (self=140072540856840,
n=<value optimized out>) at eval.c:3203
#19 0x00007f65342313b3 in rb_call0 (klass=140072576454360,
recv=140072540856840, id=94817, oid=94817, argc=0, argv=0x7fff6cb74060,
body=0x7f653029c858, flags=<value optimized out>) at eval.c:5997
#20 0x00007f65342317b8 in rb_call (klass=140072576454360,
recv=140072540856840, mid=94817, argc=1, argv=0x7fff6cb74060, scope=0,
self=140072540856840) at eval.c:6093
Based on this message about potentially having a double free on the
context
(http://www.mail-archive.com/libxml-de...@rubyforge.org/msg00625.html)
as well as earlier discussions about garbage collection after memory
optimization changes, I'm wondering if something similar isn't the cause
here.
Basically, the goal here is to run this in an unattended Web
environment, so crashing isn't very friendly at all since there's no way
to recover from it except to implement a watchdog process (which I'm
likely to do anyway).
Here's an example:
excalibur$ cat /tmp/puke.rb
require 'rubygems'
require 'xml'
class Handler
def on_cdata_block(cdata)
end
def on_characters(chars)
end
def on_comment(text)
end
def on_end_document
end
def on_error(error)
end
def on_processing_instruction(target, data)
end
def on_start_document
end
def on_start_element(qname, attributes)
end
def on_end_element(qname)
end
def on_start_element_ns(qname, attributes, prefix, uri, nslist)
raise RuntimeError, "die a horrible death!"
end
def on_end_element_ns(qname, prefix, uri)
end
end
parser = XML::SaxParser.string(File.new(ARGV[0]).read)
parser.callbacks = Handler.new
begin
parser.parse
rescue RuntimeError => e
STDERR.puts "oops: #{e}"
end
Here's the input:
excalibur$ cat /tmp/test.xml
<MyElement xmlns="http://example.com/schemas/v1"/>
Here's the output:
excalibur$ ruby /tmp/puke.rb /tmp/test.xml
oops: die a horrible death!
*** glibc detected *** ruby: free(): invalid pointer: 0x00007f33b1503440 ***
======= Backtrace: =========
/lib/libc.so.6[0x7f33b2b5b08a]
/lib/libc.so.6(cfree+0x8c)[0x7f33b2b5ec1c]
/usr/lib/libxml2.so.2(xmlFreeParserCtxt+0xd4)[0x7f33b0fccbe4]
/usr/lib/libruby1.8.so.1.8(rb_gc_call_finalizer_at_exit+0xa1)[0x7f33b376c21 1]
/usr/lib/libruby1.8.so.1.8[0x7f33b37515c3]
/usr/lib/libruby1.8.so.1.8(ruby_cleanup+0x161)[0x7f33b375a281]
/usr/lib/libruby1.8.so.1.8(ruby_stop+0x9)[0x7f33b375a399]
/usr/lib/libruby1.8.so.1.8[0x7f33b3765c4f]
ruby[0x400883]
/lib/libc.so.6(__libc_start_main+0xf4)[0x7f33b2b051c4]
ruby[0x4007b9]
======= Memory map: ========
00400000-00401000 r-xp 00000000 08:03 232251
/usr/bin/ruby1.8
00600000-00601000 rw-p 00000000 08:03 232251
/usr/bin/ruby1.8
00601000-009ea000 rw-p 00601000 00:00 0 [heap]
7f33ac000000-7f33ac021000 rw-p 7f33ac000000 00:00 0
7f33ac021000-7f33b0000000 ---p 7f33ac021000 00:00 0
7f33b0b73000-7f33b0b80000 r-xp 00000000 08:03 426465
/lib/libgcc_s.so.1
7f33b0b80000-7f33b0d80000 ---p 0000d000 08:03 426465
/lib/libgcc_s.so.1
7f33b0d80000-7f33b0d81000 rw-p 0000d000 08:03 426465
/lib/libgcc_s.so.1
7f33b0d81000-7f33b0d97000 r-xp 00000000 08:03 231832
/usr/lib/libz.so.1.2.3.3
7f33b0d97000-7f33b0f97000 ---p 00016000 08:03 231832
/usr/lib/libz.so.1.2.3.3
7f33b0f97000-7f33b0f98000 rw-p 00016000 08:03 231832
/usr/lib/libz.so.1.2.3.3
7f33b0f98000-7f33b10d5000 r-xp 00000000 08:03 230582
/usr/lib/libxml2.so.2.6.31
7f33b10d5000-7f33b12d5000 ---p 0013d000 08:03 230582
/usr/lib/libxml2.so.2.6.31
7f33b12d5000-7f33b12de000 rw-p 0013d000 08:03 230582
/usr/lib/libxml2.so.2.6.31
7f33b12de000-7f33b12df000 rw-p 7f33b12de000 00:00 0
7f33b12df000-7f33b1303000 r-xp 00000000 08:03 323966
/usr/lib/ruby/gems/1.8/gems/libxml-ruby-1.1.3/lib/libxml_ruby.so
7f33b1303000-7f33b1502000 ---p 00024000 08:03 323966
/usr/lib/ruby/gems/1.8/gems/libxml-ruby-1.1.3/lib/libxml_ruby.so
7f33b1502000-7f33b1504000 rw-p 00023000 08:03 323966
/usr/lib/ruby/gems/1.8/gems/libxml-ruby-1.1.3/lib/libxml_ruby.so
7f33b1504000-7f33b173e000 rw-p 7f33b1504000 00:00 0
7f33b173e000-7f33b1748000 r-xp 00000000 08:03 414994
/lib/libnss_files-2.7.so
7f33b1748000-7f33b1948000 ---p 0000a000 08:03 414994
/lib/libnss_files-2.7.so
7f33b1948000-7f33b194a000 rw-p 0000a000 08:03 414994
/lib/libnss_files-2.7.so
7f33b194a000-7f33b1954000 r-xp 00000000 08:03 414996
/lib/libnss_nis-2.7.so
7f33b1954000-7f33b1b53000 ---p 0000a000 08:03 414996
/lib/libnss_nis-2.7.so
7f33b1b53000-7f33b1b55000 rw-p 00009000 08:03 414996
/lib/libnss_nis-2.7.so
7f33b1b55000-7f33b1b6b000 r-xp 00000000 08:03 414991
/lib/libnsl-2.7.so
7f33b1b6b000-7f33b1d6a000 ---p 00016000 08:03 414991
/lib/libnsl-2.7.so
7f33b1d6a000-7f33b1d6c000 rw-p 00015000 08:03 414991
/lib/libnsl-2.7.so
7f33b1d6c000-7f33b1d6e000 rw-p 7f33b1d6c000 00:00 0
7f33b1d6e000-7f33b1d76000 r-xp 00000000 08:03 414992
/lib/libnss_compat-2.7.so
7f33b1d76000-7f33b1f75000 ---p 00008000 08:03 414992
/lib/libnss_compat-2.7.so
7f33b1f75000-7f33b1f77000 rw-p 00007000 08:03 414992
/lib/libnss_compat-2.7.so
7f33b1f77000-7f33b1f79000 r-xp 00000000 08:03 289717
/usr/lib/ruby/1.8/x86_64-linux/etc.so
7f33b1f79000-7f33b2179000 ---p 00002000 08:03 289717
/usr/lib/ruby/1.8/x86_64-linux/etc.so
7f33b2179000-7f33b217a000 rw-p 00002000 08:03 289717
/usr/lib/ruby/1.8/x86_64-linux/etc.so
7f33b217a000-7f33b22b7000 rw-p 7f33b217a000 00:00 0
7f33b22b7000-7f33b22d4000 r-xp 00000000 08:03 289280
/usr/lib/ruby/1.8/x86_64-linux/syck.so
7f33b22d4000-7f33b24d3000 ---p 0001d000 08:03 289280
/usr/lib/ruby/1.8/x86_64-linux/syck.so
7f33b24d3000-7f33b24d5000 rw-p 0001c000 08:03 289280
/usr/lib/ruby/1.8/x86_64-linux/syck.so
7f33b24d5000-7f33b24da000 r-xp 00000000 08:03 289278
/usr/lib/ruby/1.8/x86_64-linux/stringio.so
7f33b24da000-7f33b26d9000 ---p 00005000 08:03 289278
/usr/lib/ruby/1.8/x86_64-linux/stringio.so
7f33b26d9000-7f33b26da000 rw-p 00004000 08:03 289278
/usr/lib/ruby/1.8/x86_64-linux/stringio.so
7f33b26da000-7f33b26e2000 r-xp 00000000 08:03 415001
/lib/librt-2.7.so
7f33b26e2000-7f33b28e1000 ---p 00008000 08:03 415001
/lib/librt-2.7.so
7f33b28e1000-7f33b28e3000 rw-p 00007000 08:03 415001
/lib/librt-2.7.so
7f33b28e3000-7f33b28e7000 r-xp 00000000 08:03 289282
/usr/lib/ruby/1.8/x86_64-linux/thread.so
7f33b28e7000-7f33b2ae6000 ---p 00004000 08:03 289282
/usr/lib/ruby/1.8/x86_64-linux/thread.so
7f33b2ae6000-7f33b2ae7000 rw-p 00003000 08:03 289282
/usr/lib/ruby/1.8/x86_64-linux/thread.so
7f33b2ae7000-7f33b2c3f000 r-xp 00000000 08:03 414985
/lib/libc-2.7.so
7f33b2c3f000-7f33b2e3f000 ---p 00158000 08:03 414985
/lib/libc-2.7.so
7f33b2e3f000-7f33b2e42000 r--p 00158000 08:03 414985
/lib/libc-2.7.so
7f33b2e42000-7f33b2e44000 rw-p 0015b000 08:03 414985
/lib/libc-2.7.so
7f33b2e44000-7f33b2e49000 rw-p 7f33b2e44000 00:00 0
7f33b2e49000-7f33b2ec9000 r-xp 00000000 08:03 414989
/lib/libm-2.7.so
7f33b2ec9000-7f33b30c8000 ---p 00080000 08:03 414989
/lib/libm-2.7.so
7f33b30c8000-7f33b30ca000 rw-p 0007f000 08:03 414989
/lib/libm-2.7.so
7f33b30ca000-7f33b30d3000 r-xp 00000000 08:03 414987
/lib/libcrypt-2.7.so
7f33b30d3000-7f33b32d2000 ---p 00009000 08:03 414987
/lib/libcrypt-2.7.so
7f33b32d2000-7f33b32d4000 rw-p 00008000 08:03 414987
/lib/libcrypt-2.7.so
7f33b32d4000-7f33b3302000 rw-p 7f33b32d4000 00:00 0
7f33b3302000-7f33b3304000 r-xp 00000000 08:03 414988
/lib/libdl-2.7.so
7f33b3304000-7f33b3504000 ---p 00002000 08:03 414988
/lib/libdl-2.7.so
7f33b3504000-7f33b3506000 rw-p 00002000 08:03 414988
/lib/libdl-2.7.so
7f33b3506000-7f33b351c000 r-xp 00000000 08:03 414999
/lib/libpthread-2.7.so
7f33b351c000-7f33b371c000 ---p 00016000 08:03 414999
/lib/libpthread-2.7.so
7f33b371c000-7f33b371e000 rw-p 00016000 08:03 414999
/lib/libpthread-2.7.so
7f33b371e000-7f33b3722000 rw-p 7f33b371e000 00:00 0
7f33b3722000-7f33b37f5000 r-xp 00000000 08:03 232249
/usr/lib/libruby1.8.so.1.8.6
7f33b37f5000-7f33b39f4000 ---p 000d3000 08:03 232249
/usr/lib/libruby1.8.so.1.8.6
7f33b39f4000-7f33b39f9000 rw-p 000d2000 08:03 232249
/usr/lib/libruby1.8.so.1.8.6
7f33b39f9000-7f33b3a16000 rw-p 7f33b39f9000 00:00 0
7f33b3a16000-7f33b3a33000 r-xp 00000000 08:03 414982
/lib/ld-2.7.so
7f33b3b00000-7f33b3c16000 rw-p 7f33b3b00000 00:00 0
7f33b3c2f000-7f33b3c33000 rw-p 7f33b3c2f000 00:00 0
7f33b3c33000-7f33b3c35000 rw-p 0001d000 08:03 414982
/lib/ld-2.7.so
7fffda280000-7fffda2b4000 rw-p 7ffffffcb000 00:00 0 [stack]
7fffda3fe000-7fffda400000 r-xp 7fffda3fe000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
[vsyscall]
Aborted
Cheers,
ast
--
Andrew S. Townley<a...@atownley.org>http://atownley.org
_______________________________________________
libxml-devel mailing list
libxml-de...@rubyforge.orghttp://rubyforge.org/mailman/listinfo/libxml-devel
