[OPEN-ILS-DEV] segfault in JSON object re-use code

[Bill Erickson]

I have not taken the time to heavily debug this yet, but I wanted to pass it 
on in case the solution is obvious to anyone else.  The code I'm writing 
parses an opensrf message, using jsonParseString under the covers, and 
segfaults while trying to take advantage of the jsonObject re-use code.  

---
// definition of freeObjList 
union unusedObjUnion{
    union unusedObjUnion* next;
    jsonObject obj;
};
typedef union unusedObjUnion unusedObj;
static unusedObj* freeObjList = NULL;
-----

The call to freeObjList->next is what segfaults

if( freeObjList ) {
    o = (jsonObject*) freeObjList;
    freeObjList = freeObjList->next;
    unusedObjRelease++;
    currentListLen--;
} else {
    ...


Am I crazy, or should unusedObjUnion actually be implemented as a struct and 
not a union, since it needs to actively maintain pointers to the next 
unusedObjUnion and its jsonObject simultaneously?  I.e. a union can only 
store data for one field at any given time.    

Another example occurs during the addition of a new jsonObject to the 
freeObjeList:

unusedObj* unused = (unusedObj*) o; // o is a jsonObject*
unused->next = freeObjList;

At this point, "unused" no longer contains a valid reference to the jsonObject 
since it is clobbered by the call to unused->next = freeObjList.

Thanks in advance for any schooling or insight.

-------------------
GDB Output for the segfault I'm seeing:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb77a7700 (LWP 20128)]
jsonNewObject (data=0x0) at osrf_json_object.c:86
warning: Source file is more recent than executable.
86                      freeObjList = freeObjList->next;
(gdb) bt
#0  jsonNewObject (data=0x0) at osrf_json_object.c:86
#1  0xb733eace in jsonNewObjectType (type=1) at osrf_json_object.c:170
#2  0xb73416f9 in jsonObjectDecodeClass (obj=0x8220848) at 
osrf_json_tools.c:113
#3  0xb7341254 in jsonParseString (
    str=0x82e7738 "[{\"__p\": {\"threadTrace\": 1, \"locale\": \"en_US\", 
\"type\": \"REQUEST\", \"payload\": {\"__p\": {\"params\": [\"Hello, World!
\"], \"method\nsrf.system.echo\"}, \"__c\": \"osrfMethod\"}}, \"__c\": 
\"osrfMessage\"}]") at osrf_json_parser.c:596
#4  0xb7476c13 in osrf_message_deserialize (
    string=0x82e7738 "[{\"__p\": {\"threadTrace\": 1, \"locale\": \"en_US\", 
\"type\": \"REQUEST\", \"payload\": {\"__p\": {\"params\": [\"Hello, World!
\"], \"methopensrf.system.echo\"}, \"__c\": \"osrfMethod\"}}, \"__c\": 
\"osrfMessage\"}]", msgs=0xbfe47bac, count=256) at osrf_message.c:253
#5  0xb775fdcb in osrfHttpTranslatorParseRequest (trans=0x82e7260) at 
osrf_http_translator.c:204
#6  0xb776046d in osrfHttpTranslatorProcess (trans=0x82e7260) at 
osrf_http_translator.c:316
#7  0xb77609a0 in handler (r=0x82f0c88) at osrf_http_translator.c:430
#8  0x080794a9 in ap_run_handler ()
#9  0x0807c8b7 in ap_invoke_handler ()
#10 0x08089f00 in ap_process_request ()
#11 0x0808720b in ?? ()
#12 0x08080aa9 in ap_run_process_connection ()
#13 0x0808e339 in ?? ()
#14 0x0808e677 in ?? ()
#15 0x0808f067 in ap_mpm_run ()
#16 0x08066dd5 in main ()
(gdb)

-b

-- 
Bill Erickson
| VP, Software Development & Integration
| Equinox Software, Inc. / The Evergreen Experts
| phone: 877-OPEN-ILS (673-6457)
| email: erickson at esilibrary.com
| web: http://esilibrary.com