[XERCESC-1392] Bus Error using XMLUni::fgWFXMLScanner on 64 bit Solaris

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 2.6.0
• Component/s: Non-Validating Parser
• Environment: > uname -a ; SunOS fu 5.8 Generic_108528-29 sun4u sparc SUNW,Ultra-4; ; > CC -V; CC: Sun C++ 5.5 2003/03/12
• Assignee: Unassigned
• Reporter: Fred Dushin
• Created: 01/Apr/05 06:58
• Updated: 03/Nov/09 09:30
• Resolved: 03/Nov/09 09:30

Description

Readily reproducible bus error using the Well-Formedness XML Scanner (XMLUni::fgWFXMLScanner) on 64 bit Solaris. This does not appear to occur in 32 bit mode. Not able to reproduce this error with the other XML scanners. Used Sun C++ 5.5, and reproduced on Xerces 2.4 and 2.6, as well as with Forte6 (Update 2).

The Bus Error is as the result on an address alignment error, when any exception is thrown from a SAX2 handler. The C++ runtime appears to be peeking up the stack for a frame to catch the exception, when the bus error occurs.

Below is a patch file for the 2.6 SAX2Count sample program. This patch modifies the SAXCount driver to use the WF XML scanner, and the handler to always throw an exception.

Here is a stacktrace, from dbx:

t@1 (l@1) terminated by signal BUS (invalid address alignment)
0xffffffff7e007340: exception_matches : ld [%o1 + 0x28], %o3
(dbx) where -h
current thread: t@1
=>[1] __Cimpl::exception_matches(0xffffffff7e3f3920, 0x270022, 0x8000000000000000, 0x0, 0x9e8, 0x0), at 0xffffffff7e007340
[2] __Cimpl::locate_handler_frame(0x1, 0x1000041f4, 0x0, 0xffffffff7ef617b8, 0xffffffff7f167d08, 0xffffffff7e10d580), at 0xffffffff7e005cf4
[3] __Crun::ex_throw(0xffffffff7e10d580, 0xffffffff7e3f3920, 0x0, 0x10342c, 0xffffffff7e24ad68, 0x100107ae0), at 0xffffffff7e005e28
[4] SAX2CountHandlers::startElement(0xffffffff7fffd698, 0x1, 0x103970, 0xffffffff7eebd820, 0x0, 0x100107ae0), at 0x1000041e4
[5] xercesc_2_6::SAX2XMLReaderImpl::startElement(0x1001309a8, 0x100131fc8, 0x1, 0x10012f950, 0x100004f08, 0x0), at 0xffffffff7ee3328c
[6] xercesc_2_6::WFXMLScanner::scanStartTagNS(0x100137e38, 0x0, 0x0, 0x100131fc8, 0x0, 0x1), at 0xffffffff7ee9c6a4
[7] xercesc_2_6::WFXMLScanner::scanContent(0x100137e38, 0x1, 0x1, 0x0, 0xe7, 0xffffffff7fffcc80), at 0xffffffff7ee9ae1c
[8] xercesc_2_6::WFXMLScanner::scanDocument(0x100137e38, 0x1, 0x0, 0xffffffff7f15f0e0, 0x0, 0x10010b370), at 0xffffffff7ee99b58
[9] xercesc_2_6::XMLScanner::scanDocument(0x100137e38, 0xffffffff7ee99ad8, 0x10010b370, 0x226b70, 0xffffffff7f167e38, 0x10010c718), at 0xffffffff7eebae20
[10] xercesc_2_6::XMLScanner::scanDocument(0x100137e38, 0xffffffff7fffdb5a, 0x19, 0x1000038a8, 0x3, 0x100109840), at 0xffffffff7eebb1a4
[11] xercesc_2_6::SAX2XMLReaderImpl::parse(0x1001309a8, 0x0, 0x1050c5dbaf, 0xffffffffffffffc0, 0xfffffffffffffff8, 0x1093122440), at 0xffffffff7ee32694
[12] main(0x102f9fb79c8, 0x3e8, 0xffffffff7fffd180, 0xffffffff7fffd568, 0xffffffff7fffd698, 0x100107ae0), at 0x1000038a8

Patch:

diff -r -c SAX2Count.ORIG/SAX2Count.cpp SAX2Count/SAX2Count.cpp

• • • SAX2Count.ORIG/SAX2Count.cpp Thu Mar 31 13:29:32 2005
    • SAX2Count/SAX2Count.cpp Thu Mar 31 13:29:37 2005
      ***************
    • 302,307 ****
    • 302,311 ----
      parser->setFeature(XMLUni::fgXercesSchemaFullChecking, schemaFullChecking);
      parser->setFeature(XMLUni::fgXercesIdentityConstraintChecking, identityConstraintChecking);
      parser->setFeature(XMLUni::fgSAX2CoreNameSpacePrefixes, namespacePrefixes);
      + parser->setProperty(
      + XMLUni::fgXercesScannerName,
      + const_cast<unsigned short*const>(XMLUni::fgWFXMLScanner)
      + );

if (valScheme == SAX2XMLReader::Val_Auto)
{
diff -r -c SAX2Count.ORIG/SAX2CountHandlers.cpp SAX2Count/SAX2CountHandlers.cpp

• • • SAX2Count.ORIG/SAX2CountHandlers.cpp Thu Mar 31 13:29:33 2005
    • SAX2Count/SAX2CountHandlers.cpp Thu Mar 31 13:29:41 2005
      ***************
    • 74,79 ****
    • 74,80 ---- { fElementCount++; fAttrCount += attrs.getLength(); + throw std::logic_error( "crash me!" ); }

void SAX2CountHandlers::characters( const XMLCh* const chars