View Issue Details

IDProjectCategoryView StatusLast Update
0019898LazarusLCLpublic2014-09-21 18:10
ReporterSven BarthAssigned ToFelipe Monteiro de Carvalho 
PrioritynormalSeveritymajorReproducibilitysometimes
Status resolvedResolutionfixed 
Product Version0.9.30Product Build 
Target VersionFixed in Version 
Summary0019898: [WinCE] Sometimes an access violation or a bus error occurs when creating a form with a menu
DescriptionI have a form that I show as a modal dialog which contains a menu. When this form is shown rather often then sooner or later an access violation or bus error occurs.

This exception is located in WinCEWSMenus.CeSetMenu when accessing LCLMenu.Items as one can see in the following backtrace:

MENUS_TMENUITEM_$__GETCOUNT$$LONGINT + 24 in section .text
WINCEWSMENUS_CESETMENU$LONGWORD$LONGWORD$TMENU + 516 in section .text
WINCEINT_TWINCEWIDGETSET_$__SETMENU$LONGWORD$LONGWORD$$BOOLEAN + 208 in section .text
LCLINTF_SETMENU$LONGWORD$LONGWORD$$BOOLEAN + 64 in section .text
MENUS_TMAINMENU_$__SETWINDOWHANDLE$LONGWORD + 104 in section .text
FORMS_TCUSTOMFORM_$__UPDATEMENU + 192 in section .text
FORMS_TCUSTOMFORM_$__CREATEWND + 72 in section .text
FORMS_TFORM_$__CREATEWND + 64 in section .text
CONTROLS_TWINCONTROL_$__CREATEHANDLE + 64 in section .text
CONTROLS_TWINCONTROL_$__HANDLENEEDED + 184 in section .text
CONTROLS_TWINCONTROL_$_DOALLAUTOSIZE_CHECKHANDLEALLOCATED$TWINCONTROL$$BOOLEAN
+ 88 in section .text
CONTROLS_TWINCONTROL_$__DOALLAUTOSIZE + 192 in section .text
CONTROLS_TCONTROL_$__ENABLEAUTOSIZING + 312 in section .text
CONTROLS_TCONTROL_$__SETVISIBLE$BOOLEAN + 476 in section .text
FORMS_TCUSTOMFORM_$__SETVISIBLE$BOOLEAN + 184 in section .text
FORMS_TCUSTOMFORM_$__SHOW + 48 in section .text
FORMS_TCUSTOMFORM_$__SHOWMODAL$$LONGINT + 616 in section .text
Additional InformationThe problem seems to be the following:
In TWinCEWidgetSet.SetMenu (located in wincewinapi.inc) the menu handle is searched in a list MenuHandleList and then the returned index is used to obtain the corresponding TMenu object. These two lists are filled in WinCEWSMenus.TWinCEWSMenu.CreateHandle, but once an entry is added it isn't removed anywhere. So when the handle is freed in WinCEWSMenus.TWinCEWSMenuItem.DestroyHandle (the handle of the top menu item is the handle of the menu) Windows is free to use the handle value again (which it does sometimes). So then another entry with this handle is added, but the search in SetMenu will stop at the first (old) entry and return the now invalid object.

Attached is
1. an example application showing the problem (just hit the "Open" and the "Close" button often enough)
2. a patch which solves the problem by deleting the entries in WinCEWSMenus.TWinCEWSMenuITem.DestroyHandle (thus also the two lists keep small)
TagsNo tags attached.
Fixed in Revision31869
LazTarget-
WidgetsetWinCE
Attached Files
  • menubug.zip (3,004 bytes)
  • cemenubug.patch (822 bytes)
    --- P:/tests/menubug/wincewsmenus.pp	Tue Oct 26 16:32:52 2010
    +++ D:/lazarus/0.9.30/lcl/interfaces/wince/wincewsmenus.pp	Fri Aug 05 10:01:01 2011
    @@ -913,7 +913,18 @@
     end;
     
     class procedure TWinCEWSMenuItem.DestroyHandle(const AMenuItem: TMenuItem);
    +var
    +  idx: Integer;
     begin
    +  if AMenuItem = AMenuItem.Menu.Items then begin
    +    // this is the top item of a menu, so we must undo TWinCEWSMenu.CreateHandle
    +    idx := MenuHandleList.IndexOf(Pointer(AMenuItem.Handle));
    +    if idx >= 0 then begin
    +      // the object is at the same position as the handle
    +      MenuHandleList.Delete(idx);
    +      MenuLCLObjectList.Delete(idx);
    +    end;
    +  end;
       if Assigned(AMenuItem.Parent) then
         DeleteMenu(AMenuItem.Parent.Handle, AMenuItem.Command, MF_BYCOMMAND);
       DestroyMenu(AMenuItem.Handle);
    
    cemenubug.patch (822 bytes)

Relationships

related to 0019972 resolvedFelipe Monteiro de Carvalho Packages Crash while closing a modal window on WinCE 
related to 0020274 resolvedFelipe Monteiro de Carvalho Lazarus [WinCE] Access Violation when freeing a menu item (follow up of 0019898
related to 0026757 assignedStephano Lazarus [Patch] AV when destroying form with menu 

Activities

2011-08-05 10:29

 

menubug.zip (3,004 bytes)

2011-08-05 10:29

 

cemenubug.patch (822 bytes)
--- P:/tests/menubug/wincewsmenus.pp	Tue Oct 26 16:32:52 2010
+++ D:/lazarus/0.9.30/lcl/interfaces/wince/wincewsmenus.pp	Fri Aug 05 10:01:01 2011
@@ -913,7 +913,18 @@
 end;
 
 class procedure TWinCEWSMenuItem.DestroyHandle(const AMenuItem: TMenuItem);
+var
+  idx: Integer;
 begin
+  if AMenuItem = AMenuItem.Menu.Items then begin
+    // this is the top item of a menu, so we must undo TWinCEWSMenu.CreateHandle
+    idx := MenuHandleList.IndexOf(Pointer(AMenuItem.Handle));
+    if idx >= 0 then begin
+      // the object is at the same position as the handle
+      MenuHandleList.Delete(idx);
+      MenuLCLObjectList.Delete(idx);
+    end;
+  end;
   if Assigned(AMenuItem.Parent) then
     DeleteMenu(AMenuItem.Parent.Handle, AMenuItem.Command, MF_BYCOMMAND);
   DestroyMenu(AMenuItem.Handle);
cemenubug.patch (822 bytes)

Felipe Monteiro de Carvalho

2011-08-05 11:07

developer   ~0050464

Thanks, applied. Please test and close if ok

Issue History

Date Modified Username Field Change
2011-08-05 10:29 Sven Barth New Issue
2011-08-05 10:29 Sven Barth File Added: menubug.zip
2011-08-05 10:29 Sven Barth Widgetset => WinCE
2011-08-05 10:29 Sven Barth File Added: cemenubug.patch
2011-08-05 11:07 Felipe Monteiro de Carvalho Fixed in Revision => 31869
2011-08-05 11:07 Felipe Monteiro de Carvalho LazTarget => -
2011-08-05 11:07 Felipe Monteiro de Carvalho Status new => resolved
2011-08-05 11:07 Felipe Monteiro de Carvalho Resolution open => fixed
2011-08-05 11:07 Felipe Monteiro de Carvalho Assigned To => Felipe Monteiro de Carvalho
2011-08-05 11:07 Felipe Monteiro de Carvalho Note Added: 0050464
2011-09-27 08:55 Felipe Monteiro de Carvalho Relationship added related to 0019972
2011-09-28 10:44 Felipe Monteiro de Carvalho Relationship added related to 0020274
2014-09-21 18:10 Juha Manninen Relationship added related to 0026757