Session hangs or crashes when a SAX-WRITER writes to longchar or memptr without deleting the object before it goes out of scope.

Session hangs or crashes when the SAX-WRITER writes to longchar or memptr and object is not deleted before longchar/memptr goes out of scope.

Oct 12, 2018
Knowledge

Title

URL Name

process-may-hang-or-crash-if-sax-writer-writes-to-longchar-or-memptr-and-object-is-not-deleted-before-longchar-memptr-gets-out-of-scope

Article Number

000181762

Environment

Product: OpenEdge Version: 11.6.3, 11.64 OS: All supported platforms

Question/Problem Description

Process hangs or crashes when a SAX-WRITER writes to longchar or memptr without deleting the object before the longchar/memptr goes out of scope.
AppServer Agent or ABL Client does not properly disconnect from the database - related to SAX-WRITER to longchar/memptr

Stack trace:

drSigFatal
# At location 0x0900000003171e34 but procedure information unavailable.
# At location 0x0900000002e4dddc but procedure information unavailable.
transcodeToBuffer__10SAXWWriterFPc
resetOutput__10SAXWWriterFP16ProSAXWriterData
proSAXWriterExecute
resetOutput
umSaxWrDestroy
umClassDestroy
umSuperDestroy
umWhackPool
umInitDwstpools
rnrqdone
css_run_down1
csd_end_service
do_serve
main

Steps to Reproduce

Clarifying Information

Error Message

Defect Number

Defect PSC00354941

Enhancement Number

Cause

The SAX-WRITER is writing to a LONGCHAR/MEMPTR and that is not deleted before the procedure that contains the MEMPTR/LONGCHAR gets out of scope.

It could also be caused by the fact that when the database is disconnected, a stop condition is raised which unwinds the call stack without giving a chance for the ABL program to delete the SAX-WRITER, assuming it is not in a WIDGET-POOL. The SAX-WRITER that hasn't been deleted at the end of the session needs to be deleted.

When the output destination for a SAX-WRITER object is set to a MEMPTR/LONGCHAR, it is associated with the memptrstr for the variable.

When the procedure goes away, that memptrstr becomes invalid

For LONGCHAR, it will become invalid when returning from internal or external procedures.
For MEMPTR, it becomes invalid when returning from an external. p's.

Since the memptrstr is allocated out of the procedure's pool, once the procedure ends and the pool is available for use for some other procedure, this means the SAX-WRITER is pointing at "free" memory.

When the object gets deleted after the MEMPTR/LONGCHAR is out of scope (explicitly or during session shutdown), the delete code will check if there is data to be flushed out to the MEMPTR/LONGCHAR, but that relies on the memptrstr. Since the memory is free, the behavior is unpredictable. It will crash or end up stuck in a loop in code that is trying to determine the size of the string.

Resolution

Upgrade to 11.7.0 or later where the following has been reworked:

When the SAX-WRITER's output destination is set to a MEMPTR/LONGCHAR:

The memptrstr will be marked to indicate it is tied to a SAX-WRITER and added to the SAX-WRITER's UIC to a chain.

If the object is deleted before the memptrstr goes out of scope:

The flag will be turned off and removed from the chain.

When the memptrstr is released, when returning from a procedure (internal or external) a check to determine if the memptrstr is associated with a SAX-WRITER object will be run and then call into a new function that will try to invalidate the SAX-WRITER:

If the SAX-WRITER is still set up for that same memptrstr, the SAX-WRITER will be reset so that there is no danger of needing to flush the cache data later when the object is deleted. Flags are turned off so that it becomes unusable, until a new output destination is set.
If the SAX-WRITER has some other destination by the time the memptrstr gets out of scope, then there is nothing to be done.

The code that handles the deletion of the SAX-WRITER, also tries to flush any cached data into the MEMPTR/LONGCHAR before the object is deleted. However, this relies on the memptrstr.

As a last resort, in the event a SAX-WRITER is still pointing at a memptrstr that is out of scope, code was added so that there is not a procedure running (which would be the case during the end of the session), the SAX-WRITER will also be reset so that it does not try to flush any data. The memptrstr location cannot be trusted in this case therefore it must be prevented from being written to.

Workaround

Aside from the defect itself, the reason this situation occurs, is because a SAX-WRITER is writing to a MEMPTR or LONGCHAR that is not getting deleted until the end of the session.

It is not the LONGCHAR or MEMPTR that is not getting cleaned up. The LONGCHAR / MEMPTR will be cleaned up but the SAX-WRITER is outliving the LONGCHAR / MEMPTR which is the problem. If the SAX-WRITER goes away along with the LONGCHAR / MEMPTR, this will avoid the situation that leads to the session crash/hang later when trying to handle the user disconnection from the database.

To avoid that situation:

Find where a SAX-WRITER is writing to a MEMPTR or LONGCHAR in the application code,
Add a "CREATE WIDGET." statement at the beginning of the code that is using the SAX-WRITER
The object will get created in that widget pool, which will get deleted at the end of the program, before the LONGCHAR / MEMPTR variable associated with the SAX-WRITER goes out of scope.

Notes

Keyword Phrase

Last Modified Date

11/14/2019 7:26 PM

Session hangs or crashes when a SAX-WRITER writes to longchar or memptr without deleting the object before it goes out of scope.

Files(0)

Was this article helpful?

Was this article helpful?

Session hangs or crashes when a SAX-WRITER writes to longchar or memptr without deleting the object before it goes out of scope.

Information

Related Articles