View Issue Details

IDProjectCategoryView StatusLast Update
0026757LazarusWidgetsetpublic2015-02-06 18:04
ReporterAndrew G. Khodotov Assigned ToStephano  
PrioritynormalSeverityminorReproducibilityalways
Status assignedResolutionfixed 
Platformarm-winceOSWindows Mobile 
Product Version1.2.4 
Summary0026757: [Patch] AV when destroying form with menu
DescriptionWhen application with MainMenu closes, one (if only one MenuItem exists) or two Access Violation are raised. It's "silent" exceptions: it's don't display messages (I think it's because application already destroying at this moment), but write to "lcldebug.log" file.
Steps To ReproduceSee attached trivial example.
Or create new project, plase MainMenu, add one or more items with or without subitems. Launch, then close. Examine "lcldebug.log" file. Example of this file is attached too.
Tagspatch
Fixed in Revision46728
LazTarget-
WidgetsetWinCE
Attached Files

Relationships

related to 0012105 closedFelipe Monteiro de Carvalho Lazarus simple project Exception 'External SIGSEGV' 
related to 0019898 resolvedFelipe Monteiro de Carvalho Lazarus [WinCE] Sometimes an access violation or a bus error occurs when creating a form with a menu 
related to 0019972 resolvedFelipe Monteiro de Carvalho Packages Crash while closing a modal window on WinCE 
related to 0020274 resolvedFelipe Monteiro de Carvalho Lazarus [WinCE] Access Violation when freeing a menu item (follow up of 0019898

Activities

Andrew G. Khodotov

2014-09-21 17:04

reporter  

CEMenuBug.7z (59,911 bytes)

Andrew G. Khodotov

2014-09-21 17:07

reporter  

wincewsmenus.pp.patch (337 bytes)   
Index: wincewsmenus.pp
===================================================================
--- wincewsmenus.pp
+++ wincewsmenus.pp
@@ -899,6 +899,7 @@ end;
 class procedure TWinCEWSMenuItem.CloseCommand(ACommand: LongInt);
 begin
   ACommand := ACommand - MenuBarID_BASE;
+  if aCommand>=0then
   inherited CloseCommand(ACommand);
 end;
wincewsmenus.pp.patch (337 bytes)   

Andrew G. Khodotov

2014-09-21 17:12

reporter   ~0077496

Attached patch solve this bug.
But maybe more durable check negative argument in TWSMenuItem.CloseCommand? I don't know.

Andrew G. Khodotov

2014-09-21 17:15

reporter   ~0077497

Maybe this bug has relations with something of:
http://bugs.freepascal.org/view.php?id=12105
http://bugs.freepascal.org/view.php?id=19972
http://bugs.freepascal.org/view.php?id=20274
http://bugs.freepascal.org/view.php?id=19898

Stephano

2014-10-05 12:58

developer   ~0078000

I put {$DEFINE VerboseWinCEMenu} in lcl/interfaces/wince/wincewsmenus.pp so that menu debug messages are output to lcldebug.log.

procedure PocketPCAddMenuToToolbar changes FCommand for all top level menu items:
TMenuItemAccess(LCLMenu.Items.Items[j]).FCommand := mi.wID;

and when these menuitems are freed, AV's occur for these. Note that the modified FCommand can be negative (causes AV) or a high number (does not cause AV). Hence the less than zero test is not even a complete workaround.

To confirm this, one can let the test project output MenuItem1/2.Command to show that the values have already changed.

I have attached the verbose lcldebug.log.

Stephano

2014-10-05 13:00

developer  

lcldebug-verbose.log (2,031 bytes)   
TMenuItem.Create: 1003, caption: 
TMenuItem.Create: 1004, caption: 
TMenuItem.Create: 1005, caption: 
[TWinCEWSMenuItem.AttachMenuEx] START
[TWinCEWSMenuItem.AttachMenuEx] InsertMenuW itemname = MenuItem1 caption New Item1 cmd 1004
[TWinCEWSMenuItem.AttachMenuEx] SetMenuItemInfoW Index = 0
[TWinCEWSMenuItem.AttachMenuEx] START
[TWinCEWSMenuItem.AttachMenuEx] InsertMenuW itemname = MenuItem2 caption New Item2 cmd 1005
[TWinCEWSMenuItem.AttachMenuEx] SetMenuItemInfoW Index = 1
[CeSetMenu]
[CeSetMenu] p1 menu bar window = 0 Wnd 2080948960 Menu 228272164
[CeSetMenu] MenuItemsList.Text 1004
1005

[CeSetMenu] menu bar window = 2080949776 mbi.nToolBarId = 20000
[CeSetMenu] TB_DELETEBUTTON
[CeSetMenu] TB_DELETEBUTTON
[CeSetMenu] p3 atPDA menuname: MenuItem1 Set FCommand = mi.wID = 1001
[CeSetMenu] atPDA Message TB_INSERTBUTTON with ButtonID: i = 0
[CeSetMenu] Adding menuitem to MenuItemsList
[CeSetMenu] p3 atPDA menuname: MenuItem2 Set FCommand = mi.wID = 1002
[CeSetMenu] atPDA Message TB_INSERTBUTTON with ButtonID: i = 1
[CeSetMenu] Adding menuitem to MenuItemsList
GetMenuItemInfo i=2 failed, breaking
[CeSetMenu]
[CeSetMenu] p1 menu bar window = 2080949776 Wnd 2080948960 Menu 228272164
[CeSetMenu] MenuItemsList.Text 1004
1005
1001
1002

[CeSetMenu] MenuItemsList.Delete 1001 Index 0
[CeSetMenu] MenuItemsList.Delete 1002 Index 0
[CeSetMenu] menu bar window = 2080949776 mbi.nToolBarId = 494792764
[CeSetMenu] TB_DELETEBUTTON
[CeSetMenu] TB_DELETEBUTTON
[CeSetMenu] p3 atPDA menuname: MenuItem1 Set FCommand = mi.wID = 1001
[CeSetMenu] atPDA Message TB_INSERTBUTTON with ButtonID: i = 0
[CeSetMenu] Adding menuitem to MenuItemsList
[CeSetMenu] p3 atPDA menuname: MenuItem2 Set FCommand = mi.wID = 1002
[CeSetMenu] atPDA Message TB_INSERTBUTTON with ButtonID: i = 1
[CeSetMenu] Adding menuitem to MenuItemsList
GetMenuItemInfo i=2 failed, breaking
TMenuItem.Destroy1: 1002, caption: New Item2
TMenuItem.Destroy1: 1001, caption: New Item1
TMenuItem.Destroy1: 1003, caption: 
lcldebug-verbose.log (2,031 bytes)   

Andrew G. Khodotov

2014-10-05 18:51

reporter   ~0078009

In your lcldebug-verbose.log:
 [CeSetMenu] p3 atPDA menuname: MenuItem1 Set FCommand = mi.wID = 1001
...
 [CeSetMenu] p3 atPDA menuname: MenuItem2 Set FCommand = mi.wID = 1002
...
 TMenuItem.Destroy1: 1002, caption: New Item2
 TMenuItem.Destroy1: 1001, caption: New Item1

Commands of top-level menu items are 1001 and 1002. It is confirmed by constants in wincewsmenus.pp:
  MenuBarID_L = 1001;
  MenuBarID_R = 1002;
But 3rd constant is 1003:
  MenuBarID_BASE = 1003;
Thus the modified command (ACommand := ACommand - MenuBarID_BASE;) for top-level items becomes negative - (-1) or (-2).
I think this modification exists because in TWinCEWSMenuItem.OpenCommand exists inverse mod:
  Result := Result + MenuBarID_BASE;
Less than zero test prevents addressing to negative items of zero-based CommandPool.

Stephano

2014-10-05 21:07

developer   ~0078012

FCommand is set starting 1003+1, but is later modified for top level menu items in procedure PocketPCAddMenuToToolbar:
TMenuItem.Create: 1004, caption:
TMenuItem.Create: 1005, caption:
then
TMenuItem.Destroy1: 1002, caption: New Item2
TMenuItem.Destroy1: 1001, caption: New Item1

Moreover, if there are many menu items, the 3rd top level one and beyond will have FCommand set to values as high as 30000!

In short, the issue is that FCommand is set to 1003+ on creation, but is changed to a different value in procedure PocketPCAddMenuToToolbar. The 1st 2 top level menu items (with negative FCommand) cause AV's at the time of destruction. The remaining top level menu items (which have high FCommand values) do not cause AV's.

Felipe Monteiro de Carvalho

2014-10-31 16:59

developer   ~0078779

Thanks, applied in rev 46728.

Also, I no longer use wince for anything ... if anyone wants to be the new wince maintainer, please contact me via e-mail.

Stephano

2014-11-01 21:15

developer   ~0078800

The patch eliminates the AV's but does not really solve the root of the problem and the corresponding commands in the command pool will not be freed.

Juha Manninen

2014-11-01 22:50

developer   ~0078806

Stephano clearly volunteers to be the new WinCE maintainer. :)

Andrew G. Khodotov

2014-11-03 10:34

reporter   ~0078844

>The patch eliminates the AV's
Yes. It was main purpose of this workaround. It's not elegant, but (in my opinion) better then obvious exception.

Maybe next code will be more correct solution:

class procedure TWinCEWSMenuItem.CloseCommand(ACommand: LongInt);
begin
  if ACommand >=MenuBarID_BASE then
  ACommand := ACommand - MenuBarID_BASE;
  inherited CloseCommand(ACommand);
end;

But now I haven't WinCE device and cant't test.

Felipe Monteiro de Carvalho

2014-11-09 12:34

developer   ~0079039

You can test in the emulator: http://wiki.lazarus.freepascal.org/Windows_CE_Interface#Windows_Mobile_5.0_Emulator

Issue History

Date Modified Username Field Change
2014-09-21 17:04 Andrew G. Khodotov New Issue
2014-09-21 17:04 Andrew G. Khodotov File Added: CEMenuBug.7z
2014-09-21 17:07 Andrew G. Khodotov File Added: wincewsmenus.pp.patch
2014-09-21 17:12 Andrew G. Khodotov Note Added: 0077496
2014-09-21 17:15 Andrew G. Khodotov Note Added: 0077497
2014-09-21 18:09 Juha Manninen Relationship added related to 0012105
2014-09-21 18:10 Juha Manninen Relationship added related to 0019898
2014-09-21 18:10 Juha Manninen Relationship added related to 0019972
2014-09-21 18:10 Juha Manninen Relationship added related to 0020274
2014-09-21 18:11 Juha Manninen Assigned To => Felipe Monteiro de Carvalho
2014-09-21 18:11 Juha Manninen Status new => assigned
2014-09-28 11:30 Juha Manninen Tag Attached: patch
2014-10-05 12:58 Stephano Note Added: 0078000
2014-10-05 13:00 Stephano File Added: lcldebug-verbose.log
2014-10-05 18:51 Andrew G. Khodotov Note Added: 0078009
2014-10-05 21:07 Stephano Note Added: 0078012
2014-10-31 16:59 Felipe Monteiro de Carvalho Fixed in Revision => 46728
2014-10-31 16:59 Felipe Monteiro de Carvalho LazTarget => -
2014-10-31 16:59 Felipe Monteiro de Carvalho Note Added: 0078779
2014-10-31 16:59 Felipe Monteiro de Carvalho Status assigned => resolved
2014-10-31 16:59 Felipe Monteiro de Carvalho Resolution open => fixed
2014-11-01 21:15 Stephano Note Added: 0078800
2014-11-01 21:15 Stephano Status resolved => feedback
2014-11-01 22:50 Juha Manninen Note Added: 0078806
2014-11-03 10:34 Andrew G. Khodotov Note Added: 0078844
2014-11-03 10:34 Andrew G. Khodotov Status feedback => assigned
2014-11-09 12:34 Felipe Monteiro de Carvalho Note Added: 0079039
2015-02-06 18:04 Juha Manninen Assigned To Felipe Monteiro de Carvalho => Stephano