View Issue Details

IDProjectCategoryView StatusLast Update
0011564LazarusIDEpublic2009-01-16 19:00
ReporterJesus Reyes Assigned ToMattias Gaertner  
PrioritynormalSeverityminorReproducibilitysometimes
Status closedResolutionfixed 
Product Version0.9.25 (SVN) 
Target Version1.0.0 
Summary0011564: Access violation when closing IDE
Descriptionsometimes when closing the IDE I found this AV, windows & linux gtk1:


TProject.UpdateUnitComponentDependencies checking designers ...
LAZARUS END - cleaning up ...
[TMainIDE.Destroy] A
[FORMS.PP] ExceptionOccurred
  Sender=EAccessViolation
  Exception=Access violation
  Stack trace:
  $080625BD fpc_intf_decr_ref, line 55 of /home/prog/fpc/rtl/inc/objpas.inc
  $08065D74 fpc_finalize, line 166 of /home/prog/fpc/rtl/inc/rtti.inc
  $08062F77 TOBJECT__CLEANUPINSTANCE, line 563 of /home/prog/fpc/rtl/inc/objpas.inc
  $080629C1 TOBJECT__FREEINSTANCE, line 225 of /home/prog/fpc/rtl/inc/objpas.inc
  $080D7546 TCOMPONENT__DESTROY, line 444 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $080D75AB TCOMPONENT__DESTROYCOMPONENTS, line 463 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $080D7506 TCOMPONENT__DESTROY, line 441 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $08197D3E TLCLCOMPONENT__DESTROY, line 96 of lclclasses.pp
  $081787FD TCONTROL__DESTROY, line 3808 of ./include/control.inc
  $0816D7F3 TWINCONTROL__DESTROY, line 5853 of ./include/wincontrol.inc
  $0817A40E TCUSTOMCONTROL__DESTROY, line 61 of ./include/customcontrol.inc
  $0807A60A TSCROLLINGWINCONTROL__DESTROY, line 250 of ./include/scrollingwincontrol.inc
  $0807B004 TCUSTOMFORM__DESTROY, line 91 of ./include/customform.inc
  $080860EE THINTWINDOW__DESTROY, line 52 of ./include/hintwindow.inc
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $082ED2B3 FREETHENNIL, line 1070 of ideprocs.pp
  $0846EEA4 TSOURCENOTEBOOK__DESTROY, line 3102 of sourceeditor.pp
TApplication.HandleException Access violation
  Stack trace:
  $080625BD fpc_intf_decr_ref, line 55 of /home/prog/fpc/rtl/inc/objpas.inc
  $08065D74 fpc_finalize, line 166 of /home/prog/fpc/rtl/inc/rtti.inc
  $08062F77 TOBJECT__CLEANUPINSTANCE, line 563 of /home/prog/fpc/rtl/inc/objpas.inc
  $080629C1 TOBJECT__FREEINSTANCE, line 225 of /home/prog/fpc/rtl/inc/objpas.inc
  $080D7546 TCOMPONENT__DESTROY, line 444 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $080D75AB TCOMPONENT__DESTROYCOMPONENTS, line 463 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $080D7506 TCOMPONENT__DESTROY, line 441 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $08197D3E TLCLCOMPONENT__DESTROY, line 96 of lclclasses.pp
  $081787FD TCONTROL__DESTROY, line 3808 of ./include/control.inc
  $0816D7F3 TWINCONTROL__DESTROY, line 5853 of ./include/wincontrol.inc
  $0817A40E TCUSTOMCONTROL__DESTROY, line 61 of ./include/customcontrol.inc
  $0807A60A TSCROLLINGWINCONTROL__DESTROY, line 250 of ./include/scrollingwincontrol.inc
  $0807B004 TCUSTOMFORM__DESTROY, line 91 of ./include/customform.inc
  $080860EE THINTWINDOW__DESTROY, line 52 of ./include/hintwindow.inc
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $082ED2B3 FREETHENNIL, line 1070 of ideprocs.pp
  $0846EEA4 TSOURCENOTEBOOK__DESTROY, line 3102 of sourceeditor.pp
exception at 080625BD:
Access violation.
[TMainIDE.Destroy] A
[FORMS.PP] ExceptionOccurred
  Sender=EAccessViolation
  Exception=Access violation
  Stack trace:
  $080CF3E4 TFPLIST__GET, line 33 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $080D043F TLIST__GET, line 498 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $084778A2 TSOURCENOTEBOOK__GETEDITORS, line 5721 of sourceeditor.pp
  $0846EDEA TSOURCENOTEBOOK__DESTROY, line 3087 of sourceeditor.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $082ED2B3 FREETHENNIL, line 1070 of ideprocs.pp
  $080931CF TMAINIDE__DESTROY, line 1255 of main.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $08082AC4 TAPPLICATION__DOBEFOREFINALIZATION, line 861 of ./include/application.inc
  $0807863D BEFOREFINALIZATION, line 1424 of forms.pp
  $08066938 INTERNALEXIT, line 810 of /home/prog/fpc/rtl/inc/system.inc
  $08066B18 DO_EXIT, line 863 of /home/prog/fpc/rtl/inc/system.inc
  $08066B47 HALT, line 877 of /home/prog/fpc/rtl/inc/system.inc
  $080638F6 DOUNHANDLEDEXCEPTION, line 173 of /home/prog/fpc/rtl/inc/except.inc
  $08063B7C fpc_reraise, line 304 of /home/prog/fpc/rtl/inc/except.inc
  $0809339E TMAINIDE__DESTROY, line 1304 of main.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
TApplication.HandleException Access violation
  Stack trace:
  $080CF3E4 TFPLIST__GET, line 33 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $080D043F TLIST__GET, line 498 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $084778A2 TSOURCENOTEBOOK__GETEDITORS, line 5721 of sourceeditor.pp
  $0846EDEA TSOURCENOTEBOOK__DESTROY, line 3087 of sourceeditor.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $082ED2B3 FREETHENNIL, line 1070 of ideprocs.pp
  $080931CF TMAINIDE__DESTROY, line 1255 of main.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $08082AC4 TAPPLICATION__DOBEFOREFINALIZATION, line 861 of ./include/application.inc
  $0807863D BEFOREFINALIZATION, line 1424 of forms.pp
  $08066938 INTERNALEXIT, line 810 of /home/prog/fpc/rtl/inc/system.inc
  $08066B18 DO_EXIT, line 863 of /home/prog/fpc/rtl/inc/system.inc
  $08066B47 HALT, line 877 of /home/prog/fpc/rtl/inc/system.inc
  $080638F6 DOUNHANDLEDEXCEPTION, line 173 of /home/prog/fpc/rtl/inc/except.inc
  $08063B7C fpc_reraise, line 304 of /home/prog/fpc/rtl/inc/except.inc
  $0809339E TMAINIDE__DESTROY, line 1304 of main.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
exception at 080CF3E4:
Access violation.
[TMainIDE.Destroy] A
[FORMS.PP] ExceptionOccurred
  Sender=EAccessViolation
  Exception=
  Stack trace:
  $080CF3E4 TFPLIST__GET, line 33 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $080D043F TLIST__GET, line 498 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $084778A2 TSOURCENOTEBOOK__GETEDITORS, line 5721 of sourceeditor.pp
  $0846EDEA TSOURCENOTEBOOK__DESTROY, line 3087 of sourceeditor.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $082ED2B3 FREETHENNIL, line 1070 of ideprocs.pp
  $080931CF TMAINIDE__DESTROY, line 1255 of main.pp
  $080D75AB TCOMPONENT__DESTROYCOMPONENTS, line 463 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $080D7506 TCOMPONENT__DESTROY, line 441 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $081E6CFB TCUSTOMAPPLICATION__DESTROY, line 179 of src/custapp.pp
  $08081423 TAPPLICATION__DESTROY, line 159 of ./include/application.inc
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $08078B5F FREEWIDGETSET, line 1601 of forms.pp
  $080783F8 INTERFACES_finalize, line 46 of interfaces.pp
  $080668DD FINALIZEUNITS, line 776 of /home/prog/fpc/rtl/inc/system.inc
  $08066946 INTERNALEXIT, line 813 of /home/prog/fpc/rtl/inc/system.inc
  $08066B18 DO_EXIT, line 863 of /home/prog/fpc/rtl/inc/system.inc
TApplication.HandleException
  Stack trace:
  $080CF3E4 TFPLIST__GET, line 33 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $080D043F TLIST__GET, line 498 of /home/prog/fpc/rtl/objpas/classes/lists.inc
  $084778A2 TSOURCENOTEBOOK__GETEDITORS, line 5721 of sourceeditor.pp
  $0846EDEA TSOURCENOTEBOOK__DESTROY, line 3087 of sourceeditor.pp
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $082ED2B3 FREETHENNIL, line 1070 of ideprocs.pp
  $080931CF TMAINIDE__DESTROY, line 1255 of main.pp
  $080D75AB TCOMPONENT__DESTROYCOMPONENTS, line 463 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $080D7506 TCOMPONENT__DESTROY, line 441 of /home/prog/fpc/rtl/objpas/classes/compon.inc
  $081E6CFB TCUSTOMAPPLICATION__DESTROY, line 179 of src/custapp.pp
  $08081423 TAPPLICATION__DESTROY, line 159 of ./include/application.inc
  $08062820 TOBJECT__FREE, line 149 of /home/prog/fpc/rtl/inc/objpas.inc
  $08078B5F FREEWIDGETSET, line 1601 of forms.pp
  $080783F8 INTERFACES_finalize, line 46 of interfaces.pp
  $080668DD FINALIZEUNITS, line 776 of /home/prog/fpc/rtl/inc/system.inc
  $08066946 INTERNALEXIT, line 813 of /home/prog/fpc/rtl/inc/system.inc
  $08066B18 DO_EXIT, line 863 of /home/prog/fpc/rtl/inc/system.inc
:
.
TagsNo tags attached.
Fixed in Revision16419
LazTarget0.9.26
Widgetset
Attached Files

Activities

Vincent Snijders

2008-06-26 21:44

manager   ~0020402

I have seen this very much.

I think it can be reproduces by showing two hints in the editor, so let the hintwindow popup on two different identifiers.

Vincent Snijders

2008-06-28 13:59

manager   ~0020440

Martin, was your note incorrect?

Martin Friebe

2008-06-28 14:03

manager   ~0020441

It was, unfortunately.

I thought it was HintWindow was double Freed, because it is explicitly freed in SourceNoteBook.Destroy and implicitly as an owned component in TComponent.Destroy.

I overlooked that while being Destroyed the first time, HintWindow removes itself from the list of components owned by the SourceNotebook. So the 2nd destroy is not happening.

Martin Friebe

2008-06-29 15:24

manager   ~0020450

ok, I have at least steps to reproduce it:

You need to use HTML hints, in my case I use

var:
  foo : TControl


- then position the mouse over the TControl, wait for the hint.
- move the mouse away, hint disapears
- move the mouse over TControl a 2nd time, so that the hint appears a 2nd time
- Close the IDE

=> crash

IMHO it is something to do with ide\sourceeditor.pp
  procedure TSourceNotebook.ActivateHint(const ScreenPos: TPoint;
    const BaseURL, TheHint: string);

  if FHintWindow.ControlCount>0 then begin
    FHintWindow.Controls[0].Free;

FHintWindow will have 2 controls (The HTMLControl and the provider).
From the log
> TSourceNotebook.ActivateHint :TSimpleHTMLControl

So the provider survives (The provider is owned by the hint window)

When you do FreeAndNil(HintWindow) in YComponent.Destroy / DestroyComponents the crash happens when the orphaned Provider is freed (it happens after Destroy, in fpc_intf_decr

Not sure, that is something to do with how interfaces are handled, so from here I can only try some lucky guesses:
- the provider holds a pointer to the (destroyed) TSimpleHTMLControl
  maybe this incremented the ref count of the interface?
- now that the provider is destroyed, the ref count goes down. But the object to which the interface belongs, is long gone?

Martin Friebe

2008-06-29 15:41

manager   ~0020451

As I said, I don't know much about ifaces, but I have just seen 0010897, maybe related?

2008-08-31 16:01

 

hint_crash.patch (473 bytes)   
Index: ide/helpmanager.pas
===================================================================
--- ide/helpmanager.pas	(revision 16308)
+++ ide/helpmanager.pas	(working copy)
@@ -228,7 +228,7 @@
   HTMLControl:=TSimpleHTMLControl.Create(Owner);
   Result:=HTMLControl;
   if Provider=nil then
-    Provider:=CreateIDEHTMLProvider(Owner);
+    Provider:=CreateIDEHTMLProvider(HTMLControl);
   Provider.ControlIntf:=HTMLControl;
   HTMLControl.Provider:=Provider;
 end;
hint_crash.patch (473 bytes)   

Martin Friebe

2008-08-31 16:12

manager   ~0021838

ok, the issue seems that TSimpleHTMLControl and TLazIDEHTMLProvider have a circular reference (provider points to an interface of SimpleHtml).

If SimpleHtml is destroyed before the provider, then a crash occurs because provider still has a pointer to the interface of simpleHtml and it will be dereferenced on destroy of provider.

This *could* be solved by adding Destroy to SimpleHtml, and set the providers back-reference explicitly to nil. But that would fail, if provider was destroyed first. (And provider only knows the interface of SimpleHtml, so provider can not set SimpleHtml.provier:=nil...)

In the end this is best solved by ensuring the order of destruction.

As long as they are both owned by the hintWindow this is almost impossible (given that even if it was done, code in hintWindow can change in future (who can guarantee the order used in DestroyComponents?), and the issue would be back)

So the best way I could find, was setting the owner of Provider to be the HtmlControl. Now HtmlControl (which is a Component) will always ensure Provider is destroyed first (via DestroyComponents)

--------------------------

I believe there is a 2nd place where the issue must be fixed (and which is not part of my patch)
In turbopower_ipro is an alternative code setting up the same pair of SimpleHtml and Provider:
C:\lazarus_latest\components\turbopower_ipro\design\ipidehtmlcontrol.pas line 63
function IPCreateLazIDEHTMLControl(Owner: TComponent;
  var Provider: TAbstractIDEHTMLProvider): TControl;
var
  HTMLControl: TIPLazHtmlControl;
begin
  HTMLControl:=TIPLazHtmlControl.Create(Owner);
  Result:=HTMLControl;
  if Provider=nil then
    Provider:=CreateIDEHTMLProvider(Owner);
  Provider.ControlIntf:=HTMLControl;
  HTMLControl.Provider:=Provider;
end;

I do not know where this is used, but as I said, it is likely to cause the same issue.

Jesus Reyes

2009-01-16 19:00

developer   ~0024483

didn't get this problem anymore. thanks.

Issue History

Date Modified Username Field Change
2008-06-26 21:01 Jesus Reyes New Issue
2008-06-26 21:01 Jesus Reyes LazTarget => -
2008-06-26 21:01 Jesus Reyes Widgetset => GTK, Win32
2008-06-26 21:44 Vincent Snijders Note Added: 0020402
2008-06-27 05:33 Vincent Snijders LazTarget - => 1.0
2008-06-27 05:33 Vincent Snijders Status new => acknowledged
2008-06-27 05:33 Vincent Snijders Target Version => 1.0.0
2008-06-28 13:59 Vincent Snijders Note Added: 0020440
2008-06-28 14:03 Martin Friebe Note Added: 0020441
2008-06-29 15:24 Martin Friebe Note Added: 0020450
2008-06-29 15:41 Martin Friebe Note Added: 0020451
2008-08-31 16:01 Martin Friebe File Added: hint_crash.patch
2008-08-31 16:12 Martin Friebe Note Added: 0021838
2008-09-01 14:02 Paul Ishenin Status acknowledged => assigned
2008-09-01 14:02 Paul Ishenin Assigned To => Mattias Gaertner
2008-09-01 14:02 Paul Ishenin LazTarget 1.0 => 0.9.26
2008-09-04 23:49 Mattias Gaertner Fixed in Revision => 16419
2008-09-04 23:49 Mattias Gaertner Widgetset GTK, Win32 =>
2008-09-04 23:49 Mattias Gaertner Status assigned => resolved
2008-09-04 23:49 Mattias Gaertner Resolution open => fixed
2009-01-16 19:00 Jesus Reyes Status resolved => closed
2009-01-16 19:00 Jesus Reyes Note Added: 0024483