Segfault in Editor::IdleStyling when closing a document in Geany

[Nick Treleaven]

Hi,
We're experiencing a segfault with Geany (SVN unstable branch) and GTK
Scintilla 2.22. I think the bug (or a related bug) occurs with Geany
0.19 and Scintilla 2.12 as well, as this also crashes. It occurs with
the following steps:

1. New document / Open existing
2. Add some text on the last line
3. Close the document
4. When Geany asks whether to save changes, choose Save (and Save again
if prompted for a filename)
5. Segfault

Note that step 2 probably just triggers the bug because Geany adds a
trailing newline when it doesn't already exist (based on a pref that's
on by default). Maybe the act of modifying the document then closing it
before it is redrawn triggers the crash.

It's possible Geany is doing something wrong but OTOH maybe it's due to
Scintilla's drawing optimizations in v2.12?

I've reproduced the crash under Valgrind and no memory errors occurred
until the segfault.

I set a breakpoint in gdb where the crash occurs:

Breakpoint 2, Editor::IdleStyling (this=0x99b7530) at
src/Editor.cxx:6343
6343 StyleToPositionInView
(pdoc->LineStart(pdoc->LineFromPosition(styleNeeded.upTo) + 2));
(gdb) p pdoc
warning: can't find linker symbol for virtual table for `Editor'
value $4 = (class Document *) 0x0
(gdb) n

Program received signal SIGSEGV, Segmentation fault.
0x0811afb7 in Editor::IdleStyling (this=0x99b7530) at
src/Editor.cxx:6343
6343 StyleToPositionInView
(pdoc->LineStart(pdoc->LineFromPosition(styleNeeded.upTo) + 2));
(gdb) bt
#0 0x0811afb7 in Editor::IdleStyling (this=0xa446788) at src/Editor.cxx:6343
#1 0x08107386 in ScintillaGTK::StyleIdle (sciThis=0xa446788) at gtk/ScintillaGTK.cxx:2366
#2 0x0056b541 in g_source_is_destroyed () from /lib/libglib-2.0.so.0
#3 0x0056d10c in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#4 0x0057054f in g_main_context_check () from /lib/libglib-2.0.so.0
#5 0x005708f9 in g_main_loop_run () from /lib/libglib-2.0.so.0
#6 0x0741f422 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#7 0x080cf217 in main (argc=1, argv=0xbf977324) at main.c:1137

Thanks,
Nick

[Neil Hodgson]

Nick Treleaven:

> Breakpoint 2, Editor::IdleStyling (this=0x99b7530) at
> src/Editor.cxx:6343
> 6343            StyleToPositionInView
> (pdoc->LineStart(pdoc->LineFromPosition(styleNeeded.upTo) + 2));
> (gdb) p pdoc
> warning: can't find linker symbol for virtual table for `Editor'
> value $4 = (class Document *) 0x0

Try http://scintilla.hg.sourceforge.net/hgweb/scintilla/scintilla/rev/b01887aee227

Neil

[Nick Treleaven]

Resending reply as original didn't seem to arrive...

Thanks, that fixed it.

Nick

[Nick Treleaven]

On Fri, 3 Dec 2010 15:41:00 +1100
Neil Hodgson <nyama...@gmail.com> wrote:

Thanks, that fixed it.

Nick