Bug 689284 - Abnormal dependence of 'known' on name hash indices
Summary: Abnormal dependence of 'known' on name hash indices
Status: NOTIFIED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: General (show other bugs)
Version: 0.00
Hardware: PC Windows XP
: P1 normal
Assignee: leonardo
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-06-17 11:09 UTC by leonardo
Modified: 2008-12-19 08:31 UTC (History)
0 users

See Also:
Customer:
Word Size: ---


Attachments
MyEnc (5.37 KB, application/postscript)
2007-06-17 11:10 UTC, leonardo
Details
params.ps (149 bytes, application/postscript)
2007-06-17 11:22 UTC, leonardo
Details
311-03-.ps (5.48 KB, application/postscript)
2007-06-18 23:38 UTC, leonardo
Details
311-03-.ps (5.28 KB, application/postscript)
2007-06-18 23:51 UTC, leonardo
Details
patch.txt (2.31 KB, patch)
2007-06-19 03:01 UTC, leonardo
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description leonardo 2007-06-17 11:09:09 UTC
Running pdfwrite 311-03.ps got :

        Fail: (localdict2 \(key4\) known ?)

A further analyzis shows that the efect depends on the content of 
gs\Resource\Encoding. A fresh gs copy has gs/Resource/Encoding/Wingdings, and 
doesn't fail. When I add gs/Resource/Encoding/MyEnc , it stablely fails. 
Devices other than pdfwrite don't fail. The command line is :

F:\SVN-GS\HDRF\gs\bin\gswin32c.exe   -IF:\SVN-GS\HDRF\gs\lib;f:\afpl\fonts -
dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=HDRF.pdf params.ps 311-03-.ps

It happens with gs revision 8047 and withj few older revisions. Younger 
revisions were not tested yet.

The test file checks the interaction of def/undef/known with save/restore. It 
doesn't deal with Resource, but the Ghostscript initialization fails do read 
gs/Resource/Encoding. I guess here we observe eiter a delicate heap corruption, 
or a bug in save/restore logic, possibly related to name indices. Particularly, 
need to check whether a name may be garbage colloected while it is used in a 
dictionary, and later re-created with another index.
Comment 1 leonardo 2007-06-17 11:10:51 UTC
Created attachment 3027 [details]
MyEnc 

Attaching the mentioned resource file, rather I don't think that its content is
really important for the problem. However it may be impotant for reproducing
the problem.
Comment 2 leonardo 2007-06-17 11:12:13 UTC
Created attachment 3028 [details]
311-03-.ps

A simplified test case, which fails as well.
Comment 3 leonardo 2007-06-17 11:13:48 UTC
Diagnosed with MSVC8 debug build.
Setting P1 because it impedes the regression testing.
Comment 4 leonardo 2007-06-17 11:22:41 UTC
Created attachment 3029 [details]
params.ps

Attaching params.ps, which is listed in the command line. The failure with this
command line appears to depend on presence of it in the command line. However
here is another command line with no params.ps, which fails also :

..\..\gs-hd\bin\gswin32c.exe  -IF:/AFPL/gs-hd/lib;f:\afpl\fonts -dBATCH
-dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=cur.pdf
H:\AuxFiles\comparefiles\311-03.ps 

Thus the effect is pretty delicate and it possibly is hardly reproducible on
another machine.
Comment 5 leonardo 2007-06-18 23:38:10 UTC
Created attachment 3032 [details]
311-03-.ps

A more simplified test case.
Comment 6 leonardo 2007-06-18 23:51:59 UTC
Created attachment 3033 [details]
311-03-.ps

A more simplified test case. It allows to set a conditional breakpoint at
idict.c:307 to filter out operations with the interesting dictionary. The
condition is pkey->value.bytes[0]=='k' && pkey->value.bytes[1]=='e' &&
pkey->value.bytes[2]=='y' .
Comment 7 leonardo 2007-06-19 00:26:27 UTC
Here is the bottom of the problem. The further explanation assumes gs revision 
8047 with applied changes 8062, 8064, when it works with params.ps and the 
attachment 3033 [details]. Here is the action sequence :

key2 put start=4 empty insert
key3 put start=3 hash-conflict
key4 put start=3 empty insert
         index=2 empty insert
key3 undef start=3 found set("deleted")
save
key4 undef start=3 "deleted"
           index=2 found 
           idict.c:589 succeeds [1]==("empty"),
               [2]:="empty"
               [3]:="empty"
restore : [3] is still empty.
key4 known start=3 empty (must be deleted!) 
               goto miss (wrong!!!!!)

So here we observe a bug in the interaction of the "undef" algorithm 
with "restore". The effect depends on hane hash, that explains why it depends 
on params.ps and on MyEnc - the just interfere the name indices.

Need to think how to fix it better.

Comment 8 leonardo 2007-06-19 00:32:03 UTC
The last comment has been added with errors. Here is the improved revision :

Here is the bottom of the problem. The further explanation assumes gs revision 
8047 with applied changes 8062, 8064, when it works with params.ps and the 
attachment 3033 [details]. Here is the action sequence :

key2 put start=4 empty insert
key3 put start=3 empty insert
key4 put start=3 hash-conflict
         index=2 empty insert
key3 undef start=3 found set("deleted")
save
key4 undef start=3 "deleted"
           index=2 found 
           idict.c:589 succeeds [1]==("empty"),
               [2]:="empty"
               [3]:="empty"
restore : [3] is still empty.
key4 known start=3 empty (must be deleted!) 
               goto miss (wrong!!!!!)

So here we observe a bug in the interaction of the "undef" algorithm 
with "restore". The effect depends on hane hash, that explains why it depends 
on params.ps and on MyEnc - the just interfere the name indices.

The culprit is the cycle in idict.c:579-580. Its changes are not saved.

Need to think how to fix it better.


Comment 9 leonardo 2007-06-19 00:34:22 UTC
s/hane/name
Comment 10 leonardo 2007-06-19 00:39:47 UTC
Changing the bug summary for a better reflection of the problem. The old one 
is "Abnormal dependence of 'known' on the Resource/Encoding contents.".
Comment 11 leonardo 2007-06-19 03:01:59 UTC
Created attachment 3034 [details]
patch.txt

A suggested patch is being tested now.
Comment 12 leonardo 2007-06-19 09:53:46 UTC
The patch passed the regression test. It has been committed. Here is the full 
list of patches related to this problem :

http://ghostscript.com/pipermail/gs-cvs/2007-June/007641.html
http://ghostscript.com/pipermail/gs-cvs/2007-June/007643.html
http://ghostscript.com/pipermail/gs-cvs/2007-June/007644.html
http://ghostscript.com/pipermail/gs-cvs/2007-June/007647.html

The last patch is the real fix. Others just improve the debugging technology. 
Closing the bug now.