Opened 10 years ago

Closed 10 years ago

#4161 closed Bug (fixed)

Crash when pasting a tier with multiple trackers to a torrent r12252

Reported by: Waldorf Owned by: livings124
Priority: Normal Milestone:
Component: Transmission Version: 2.22+
Severity: Normal Keywords:
Cc:

Description

When adding a tier with multiple trackers (udp+http in this case) to a torrent leads to a crash. Although, on restart, the trackers/tiers are added to the torrent correctly.

Removing a tracker from a tier also results in a crash.

Adding a single tracker/tier or multiple tiers with just one tracker does not result in a crash.

It's reproducible. This did not occur a few weeks ago.

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libSystem.B.dylib             	0x00007fff818fc120 strlen + 16
1   libSystem.B.dylib             	0x00007fff81946d5e sscanf + 160
2   org.m0k.transmission          	0x000000010014ce09 evutil_inet_pton + 89 (evutil.c:1609)
3   org.m0k.transmission          	0x00000001000ce407 tr_address_from_string + 55 (net.c:112)
4   org.m0k.transmission          	0x00000001000ab66d tr_addressIsIP + 29 (utils.c:997)
5   org.m0k.transmission          	0x000000010008d24b -[TrackerCell(Private) favIcon] + 203 (TrackerCell.m:203)
6   org.m0k.transmission          	0x000000010008b65f -[TrackerCell drawWithFrame:inView:] + 143 (TrackerCell.m:115)
7   com.apple.AppKit              	0x00007fff8769d684 -[NSTableView drawRow:clipRect:] + 478
8   com.apple.AppKit              	0x00007fff8769d273 -[NSTableView drawRowIndexes:clipRect:] + 369
9   com.apple.AppKit              	0x00007fff8769bc20 -[NSTableView drawRect:] + 1302
10  com.apple.AppKit              	0x00007fff87691c49 -[NSView _drawRect:clip:] + 3390
11  com.apple.AppKit              	0x00007fff876908bc -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 1325
12  com.apple.AppKit              	0x00007fff87690c26 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 2199
13  com.apple.AppKit              	0x00007fff87690c26 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 2199
14  com.apple.AppKit              	0x00007fff8768ef8e -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 767
15  com.apple.AppKit              	0x00007fff8768fe5a -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 4555
16  com.apple.AppKit              	0x00007fff8768fe5a -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 4555
17  com.apple.AppKit              	0x00007fff8768fe5a -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 4555
18  com.apple.AppKit              	0x00007fff8768eab0 -[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 254
19  com.apple.AppKit              	0x00007fff8768b362 -[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] + 2683
20  com.apple.AppKit              	0x00007fff87604b9a -[NSView displayIfNeeded] + 969
21  com.apple.AppKit              	0x00007fff875ffa46 _handleWindowNeedsDisplay + 678
22  com.apple.CoreFoundation      	0x00007fff880e2b37 __CFRunLoopDoObservers + 519
23  com.apple.CoreFoundation      	0x00007fff880be464 __CFRunLoopRun + 468
24  com.apple.CoreFoundation      	0x00007fff880bddbf CFRunLoopRunSpecific + 575
25  com.apple.HIToolbox           	0x00007fff85f077ee RunCurrentEventLoopInMode + 333
26  com.apple.HIToolbox           	0x00007fff85f075f3 ReceiveNextEventCommon + 310
27  com.apple.HIToolbox           	0x00007fff85f074ac BlockUntilNextEventMatchingListInMode + 59
28  com.apple.AppKit              	0x00007fff875d4e64 _DPSNextEvent + 718
29  com.apple.AppKit              	0x00007fff875d47a9 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 155
30  com.apple.AppKit              	0x00007fff8759a48b -[NSApplication run] + 395
31  com.apple.AppKit              	0x00007fff875931a8 NSApplicationMain + 364
32  org.m0k.transmission          	0x0000000100001617 main + 167 (main.m:37)
33  org.m0k.transmission          	0x0000000100001544 start + 52

Attachments (2)

Transmission_2011-04-01-164641_MacBookje.crash (37.2 KB) - added by Waldorf 10 years ago.
Transmission_2011-04-10-003518_MacBookje.crash (36.3 KB) - added by Waldorf 10 years ago.

Download all attachments as: .zip

Change History (16)

comment:1 Changed 10 years ago by jordan

  • Component changed from Transmission to Mac Client
  • Owner set to livings124

I can't reproduce this issue in the GTK+ client, so reclassifying as Mac for livings to take a look.

However, I've done a *lot* of hacking in the announcer code recently, so I wouldn't be surprised if this is a side-effect of some change I've made in libtransmission.

comment:2 Changed 10 years ago by livings124

Not sure if this is related. But I've narrowed down an issue to tr_announcerStats() (or possible tr_torrentSetAnnounceList()). I add a tracker "http://1" and it is returned from the function. I add "http://1" again and the function only returns one tracker. I add it a third time and it returns two trackers. This goes on where it only includes every other tracker.

Last edited 10 years ago by livings124 (previous) (diff)

comment:3 Changed 10 years ago by livings124

  • Component changed from Mac Client to Transmission

comment:4 Changed 10 years ago by livings124

announcer.c's filter_trackers() is causing the alternating behavior.

comment:5 Changed 10 years ago by livings124

Are you still seeing this issue with r12325 or later?

comment:6 Changed 10 years ago by livings124

  • Milestone None Set deleted
  • Resolution set to fixed
  • Status changed from new to closed

This crash shouldn't be possible anymore. Please reopen if it (or something similar) still occurs.

comment:7 Changed 10 years ago by Waldorf

  • Resolution fixed deleted
  • Status changed from closed to reopened

Crashed again: r12252

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libSystem.B.dylib             	0x00007fff81904ed6 strlcpy + 70
1   org.m0k.transmission          	0x00000001000ab0f5 tr_strlcpy + 37 (utils.c:855)
2   org.m0k.transmission          	0x000000010011737e tr_announcerStats + 462 (announcer.c:1528)
3   org.m0k.transmission          	0x00000001000c71af tr_torrentTrackers + 63 (torrent.c:1391)
4   org.m0k.transmission          	0x0000000100042043 -[Torrent allTrackerStats] + 51 (Torrent.m:646)
5   org.m0k.transmission          	0x0000000100094d25 -[InfoTrackersViewController(Private) removeTrackers] + 3701 (InfoTrackersViewController.m:379)
6   org.m0k.transmission          	0x00000001000936a7 -[InfoTrackersViewController addRemoveTracker:] + 231 (InfoTrackersViewController.m:244)
7   com.apple.AppKit              	0x00007fff87729e9a -[NSApplication sendAction:to:from:] + 95
8   com.apple.AppKit              	0x00007fff87729df9 -[NSControl sendAction:to:] + 94
9   com.apple.AppKit              	0x00007fff877b5e8c -[NSSegmentedCell _sendActionFrom:] + 50
10  com.apple.AppKit              	0x00007fff877b576b -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 1715
11  com.apple.AppKit              	0x00007fff877b4cdf -[NSSegmentedCell trackMouse:inRect:ofView:untilMouseUp:] + 1303
12  com.apple.AppKit              	0x00007fff877b4215 -[NSControl mouseDown:] + 624
13  com.apple.AppKit              	0x00007fff876ce34f -[NSWindow sendEvent:] + 5409
14  com.apple.AppKit              	0x00007fff87603a86 -[NSApplication sendEvent:] + 4719
15  com.apple.AppKit              	0x00007fff8759a4da -[NSApplication run] + 474
16  com.apple.AppKit              	0x00007fff875931a8 NSApplicationMain + 364
17  org.m0k.transmission          	0x0000000100001a37 main + 167 (main.m:37)
18  org.m0k.transmission          	0x0000000100001964 start + 52
Last edited 10 years ago by Waldorf (previous) (diff)

comment:8 follow-up: Changed 10 years ago by jordan

Waldorf, this crash looks like it's in my code, but before I dig into it... that revision is almost two weeks old. As livings asked is this happening in r12325 or later?

If so, could you outline the steps required to trigger the crash?

Thanks!

comment:9 Changed 10 years ago by Waldorf

Hmm. I'did do a svn pull && build just before. I'm suite sure it was newer then r12325. However after a clean build I don't see a crash, but this:

https://img.skitch.com/20110410-f1n6bmi9d614s9kq4p8sep8dgg.jpg

Steps:

  • take a torrent a torrent
  • paste (add) a tier with 2 trackers (UDP+HTTP)
  • look

Weird:

  • deleting the empty one doesn't do anything
  • deleting the second last (first in the screenshot above) removes the empty one
  • repeat with another pair/tier:

https://img.skitch.com/20110410-cf4d3ftds1dutb3mqpicwmbn94.jpg

* no trackers were left out in the screenshots

comment:10 Changed 10 years ago by livings124

How did you add empty trackers?

edit: I see, http + udp of the same tracker

Last edited 10 years ago by livings124 (previous) (diff)

comment:11 in reply to: ↑ 8 Changed 10 years ago by Waldorf

Replying to livings124: Yes, sorry, I should have been more clear on that part.

Replying to jordan: When adding a new torrent and when migrating from 2.22 to 2.30, T will modify the tracker list of a torrent by putting trackers who only differ in protocol in the same tier. But this behavior does not kick in when I add a tracker to an already existing torrent?

Few more oddities:

  • removing the second tracker from a tier (same tracker, http+udp) shifts the first of the next tier (http+udp) into the first tier.
    Tier 1
    - udp tracker A
    - http tracker A  <- Removed this one
    Tier 2
    - udp tracker B
    - http tracker B
    
    becomes:
    Tier 1
    - udp tracker A
    - udp tracker B
    Tier 2
    - http tracker B
    
    This is not persistent and is corrected on the next launch of Transmission:
    Tier 1
    - udp tracker A
    Tier 2
    - udp tracker B
    - http tracker B
    
  • adding a tracker for which already a sibling (adding a udp, http variant already in list but solo in a tier) exists, adds an empty tracker at the end of the list with the label "Tier 1". Also not persistent after relaunch.

comment:12 Changed 10 years ago by jordan

jordan * r12350 libtransmission/announcer.c: (trunk libT) fix 2.30b1 memory corruption bug when editing trackers. The problem was that the new number of trackers was not being kept and the old count was retained. So if the count changed, tr_torrentTrackers() could return dangling pointers to the ca

comment:13 Changed 10 years ago by livings124

Waldorf: still any issues?

comment:14 Changed 10 years ago by Waldorf

  • Resolution set to fixed
  • Status changed from reopened to closed

Nope. Seems fixed.

Note: See TracTickets for help on using tickets.