WLE 4.2 - core dump in tgiopprotocol.cxx (Doc ID 766996.1)

Last updated on SEPTEMBER 13, 2023

Applies to:

Goal

It is possible that WLE will core dump when processing a reply message. The stack trace is as follows.:

=>[1] 0x4c005100(0x9d699f, 0x3, 0xfc, 0xea4ba190, 0xeaef3a4c, 0x97ba38), at 0x4c
  [2] IOPUserError::~IOPUserError(0x9c30d0, 0x3, 0x0, 0xefffc730, 0xeaef3a4c, 0x
  [3] ReplyMessage::ResetAndInit(0x9e7628, 0x97e3b8, 0x0, 0xefffc978, 0x0, 0x970
  [4] TGIOPReqSender::Reply(0xea4c1ba4, 0x97e558, 0xefffc978, 0x96fae8, 0xea6e9e
  [5] ObjectAdapterImpl::ProcessRequestServerRequest(0x97bc50, 0x97e558, 0xefffc
  [6] TGIOPProtocol::Request(0x97b5b8, 0x97e3b8, 0x97e460, 0xefffc978, 0x97b5b8,
  [7] TGIOPProtocol::CreateMessage(0x97b5b8, 0xea6ed4a4, 0x1e4, 0xea6ed4d4, 0xea
  [8] TGIOPProtocol::TGIOPService(0x97b5b8, 0x971ac4, 0x0, 0xea4c1ba4, 0xefffc9e
  [9] CORBA_SVC(0x971ac4, 0x4dfc, 0x15e0, 0x4, 0x0, 0xea2b9604), at 0x756b38
  [10] _tmsvcdsp(0x1400, 0x0, 0x970528, 0x970458, 0xf71cf0, 0x756b00), at 0xea23
  [11] _tmrunserver(0x94fb4c, 0x1544, 0x4fec, 0x1000000, 0x0, 0x0), at 0xea254ee
  [12] _tmstartserver(0xea2b288c, 0xefffccc4, 0x831560, 0x970528, 0x96f268, 0x75
  [13] main(0xc, 0xefffccc4, 0xefffccf8, 0x831400, 0x0, 0x0), at 0x296c00

From looking at the code in $TUXDIR/orb/src, we have determined the following.

The code in TGIOPReqSender::Reply (line 5647 in tgiopprotocol.cxx) calls ReplyMessage::ResetAndInit() when a reply
buffer is to be reused.  If either 
req_buf_ptr or reply_buf_ptr is null, the code calls SetIOPErrorFromStatus (line 844 in replymessage.cxx). The code in
SetIOPErrorFromStatus will call SetIOPError() if m_error is null. SetIOPError() calls Clear() which calls Release()
(defined inline in ioproot.hxx). Release will potentially delete the IOPUserError object if m_refcount is decremented
to zero; hence the entry for the destructor in the stack trace.

When the code in TGIOPReqSender::Reply() resumes, it attempts to reference the ErrorInfo object that was just deleted
and will core dump. The code that references the deleted object is as follows:

if  (AnErrorInfo.GetIOPError())
    return;

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.