[Ace-users] [tao-users] Facing memory corruption error in TAO1.5

[Steve Totten]

Hello Nayeem,

Nayeem Khan wrote:
> Hi
> 
> We are using TAO1.5a

Since you are using an OCI version of TAO, your best course of
action for receiving support is to contact OCI (sales at ociweb.com)
and arrange for a support contract.  It is possible your company
or organization already has a support contract with OCI, so check
with your manager.  The tao-users mailing list is primarily for
general TAO questions/discussions and for those using the most
recent DOC Group beta release of TAO.

Also, please always provide a complete PROBLEM-REPORT-FORM (PRF),
found in $TAO_ROOT/PROBLEM-REPORT-FORM.  The answers to your
questions often vary depending upon your specific TAO version,
platform, compiler, and build configuration.

> stack trace shows that memory corruption is occuring in destructor of 
> *TAO_Var_Base_T,I have pasted the code below and the point at which its 
> throwing error*
>    *  container.exe!CosNaming::Binding::`scalar deleting destructor'()  
> + 0x32 bytes    C++

I would be very surprised to learn that there was a bug in this
template class, as it is the base class for many _var types
generated by the IDL compiler, so it is very widely used.
As you probably know, the purpose of the _var types is to help
with memory management, such as cleaning up heap-allocated
memory in the _var's destructor.  More than likely, the memory
owned by some particular _var has already been deleted, so you
are seeing the memory corruption error in the _var's destructor
when it tries to again delete the same memory.

I have some comments inserted into the code you provided, below.

> container.exe!TAO_Var_Base_T<CosNaming::Binding>::~TAO_Var_Base_T<CosNaming::Binding>()  
> Line 23 + 0x1e bytes    C++
>      
> container.exe!TAO_Var_Var_T<CosNaming::Binding>::~TAO_Var_Var_T<CosNaming::Binding>()  
> + 0x16 bytes    C++
>  >   container.exe!CorbaNamingService::getPortByDBInstance(const 
> String_m & name1={...}, const String_m & componentType={...}, Port * & 
> port=0x00000000)  Line 770    C++*
> 
> Any suggestions or pointers
> 
> Bool CorbaNamingService::getPortByDBInstance(const String_m& name1, 
> const String_m& componentType, Port_ptr& port)
> {
>     char t1[200];
>     CosNaming::Name name;
>     Bool found = False_m;
>     CosNaming::NamingContext_var dbInstance ;
>     CORBA::Object_var obj;
>     CORBA::Object_var obj2;
> 
>     // try whether name1 corresponds to a dbInstance itself
>     name.length(1);
>     name[0].id = CORBA::string_dup(name1.asciiPtr(t1));
>     name[0].kind = CORBA::string_dup("");
>     try {
>             obj2 = dbInstances->resolve(name);
>             dbInstance = CosNaming::NamingContext::_narrow(obj2);
> 
>             name.length(2);
>             name[0].id = CORBA::string_dup("TYPECOUNTS");
>             name[0].kind = CORBA::string_dup("");
>             name[1].id = CORBA::string_dup(componentType.asciiPtr(t1));
>             name[1].kind = CORBA::string_dup("");
>             obj = dbInstance->resolve(name);
>             found =  True_m;
>     }
>     catch (EXCPT_TYPE CosNaming::NamingContext::NotFound e)
>     {
>     }
>    
>     if (!found)
>     {
>         // name1 is not a dbInstance name
>         name.length(2);
>         name[0].id = CORBA::string_dup("INSTANCES");
>         name[0].kind = CORBA::string_dup("");
>         name[1].id = CORBA::string_dup(name1.asciiPtr(t1));
>         name[1].kind = CORBA::string_dup("");
>    
>      
>         CORBA::ULong    howMany = 0;
> 
>         CosNaming::BindingList_var bl;
>         CosNaming::BindingIterator_var bi;
> 
>         dbInstances->list(howMany, bl.out(), bi.out());
>  
> #ifdef CORBA_TAO
>         if((CosNaming::BindingIterator*)bi != NULL)

The above line of code is not the proper way to check for
a nil BindingIterator.  You should always us the following
form:

   if (!CORBA::is_nil(bi.in()))

Or, better yet, re-phrase your if-statement in the affirmative:

   if (CORBA::is_nil(bi.in()))
   {
     // what to do if the BindingIterator *is* nil...
   }
   else
   {
     // what to do if it is *not* nil...
   }

> #else
>            if(bi != NULL)
> #endif
>         {
>              CORBA::ULong i = 0;
>           CosNaming::Binding_var binding;
>           while ( (!found) && (bi->next_one(binding.out()))) {
>             obj2 = dbInstances->resolve(binding->binding_name);
>             dbInstance = CosNaming::NamingContext::_narrow(obj2);
>             try {
>                 obj = dbInstance->resolve(name);
>                 found = True_m;
> 
>             }
>             catch (EXCPT_TYPE CosNaming::NamingContext::NotFound e)
>             {
>             }
>           }
>           bi->destroy();
>         }*//Memory Corruption error is thrown at this point*

<rest of code omitted>

The stack trace indicates that the problem occurs while
destructing the CosNaming::Binding_var binding, created on the
stack above.  However, I don't really see a problem with the
way you are using it.  Maybe I'm missing something.

<thinking-out-loud>
Hmm... If bi->next_one() returns false the first time through
the above while loop, then the Binding_var will be uninitialized.
Could that be causing the memory corruption in the _var's
destructor?  Maybe you could try:

   CosNaming::Binding_var = (CosNaming::Binding*)0;

(The ugly C-style cast may not be necessary.)
</thinking-out-loud>

At this point, you can:

- Try the above suggestion.
- Try this code against the latest TAO 1.5a patch release.
- Try this code against the latest DOC Group beta.
- Use a memory checker (such as valgrind or Purify) to see if
   you can pinpoint the problem.
- Contract for support.

Steve
-- 
----------------------------------------------------------------
  Steve Totten, Principal Software Engineer and Partner
  Object Computing, Inc. (OCI), St. Louis, MO, USA
  http://www.ociweb.com/  http://www.theaceorb.com/
----------------------------------------------------------------