Ken Giusti commented on PROTON-687:

>From what I can tell, the engine decrements the delivery's reference count 
>when it is removed from the owning links' settled/unsettled delivery list - 
>but it never increments the delivery when it is initially put on the list.   
>This appears to be causing the corruption, at least for the above test.

I've tried the following fix:

diff --git a/proton-c/src/engine/engine.c b/proton-c/src/engine/engine.c
index 0765a81..b7239d8 100644
--- a/proton-c/src/engine/engine.c
+++ b/proton-c/src/engine/engine.c
@@ -1123,6 +1123,7 @@ pn_delivery_t *pn_delivery(pn_link_t *link, 
pn_delivery_tag_t tag)
   delivery->updated = false;
   delivery->settled = false;
   LL_ADD(link, unsettled, delivery);
+  pn_incref(delivery);
   delivery->work_next = NULL;
   delivery->work_prev = NULL;
   delivery->work = false;

This prevents the memory corruption, but it results in memory leaks in 
Messenger, and a failure in the delivery event tests:

Error during test:  Traceback (most recent call last):
    File "./tests/python/proton-test", line 352, in run
line 2219, in testDeliveryEvents
line 2087, in expect
      return self.expect_oneof(types)
line 2102, in expect_oneof
      assert False, "actual events %s did not match any of the expected 
sequences: %s" % (events, sequences)
  AssertionError: actual events [PN_CONNECTION_UNBOUND(<proton.Connection 
object at 0xba77ac0>), PN_TRANSPORT(<proton.Transport object at 0xc40d0c0>)] 
did not match any of the expected sequences: ((3, 23, 21, 14, 8),)

I'm not sure I understand the intent of the reference counting in the case of 
deliveries - I'm turning this bug over to Rafi for his analysis.

> Memory corruption in proton-test
> --------------------------------
>                 Key: PROTON-687
>                 URL: https://issues.apache.org/jira/browse/PROTON-687
>             Project: Qpid Proton
>          Issue Type: Bug
>          Components: proton-c, python-binding
>    Affects Versions: 0.8
>            Reporter: Cliff Jansen
>            Assignee: Ken Giusti
>            Priority: Blocker
>         Attachments: segv.patch
> proton-test will fail with memory violations.  Deallocated memory is 
> accessed, usually with benign results but less often on Windows.
> The attached crude patch allows the bug to be "discovered" on Linux as well.
> It is not clear to me if the problem is with the swig wrapper, or whether 
> this just exposes a reference counting bug in proton-c.

This message was sent by Atlassian JIRA

Reply via email to