W3C home > Mailing lists > Public > www-amaya@w3.org > April to June 2000

thot lib bug (PictInfo, _AbstractBox)

From: Fox One <rockman66_1999@yahoo.com>
Date: Mon, 17 Apr 2000 06:15:14 -0400 (EDT)
Message-ID: <20000417101441.4659.qmail@web4302.mail.yahoo.com>
To: www-amaya@w3.org
I think that I've found a bug in Amaya.

If I use Amaya to open a copy of the Html-3.2
Reference Spec, it takes a couple of seconds
to load, okay. 

But when I click on the scrollbar to scroll down,
it freezes. 

I decided to limit the max processor time and run
Amaya under GDB to see what was going on. This is
what happened:

Program received signal SIGXCPU, CPU time limit
RedrawFilledBoxes (frame=1, xmin=0, xmax=566,
ymin=258, ymax=516)
        at ../../thotlib/view/frame.c:243
243                     yorg += imageDesc->PicHeight;
(gdb) print yorg
$1 = 0
(gdb) print imageDesc->PicHeight
$2 = 0
(gdb) print ymin
$3 = 258

The following is the offending code in frame.c:
  imageDesc = (PictInfo *) pAb->AbPictBackground;
  if (imageDesc)
      xorg = pBox->BxXOrg + pBox->BxLMargin +
pBox->BxLBorder + pBox->BxLPadding;
      yorg = pBox->BxYOrg + pBox->BxTMargin +
pBox->BxTBorder + pBox->BxTPadding;
      /* check the visibility of the background image
      if (imageDesc->PicPresent == FillFrame)
          while (xorg + imageDesc->PicWidth < xmin)
            xorg += imageDesc->PicWidth;
          xd = xorg;
          width = width + xmin - xorg;
          while (yorg + imageDesc->PicHeight < ymin)
243:            yorg += imageDesc->PicHeight;
          yd = yorg + FrameTable[frame].FrTopMargin;
          height = height + ymin - yorg;

At the top, you see that `pAb' is cast to a
(PictInfo *) and assigned to `imageDesc.' Okay.

`imageDesc' is of type (PictInfo *)
`pAb' is of type (PtrAbstractBox)

But these two structures cannot be overlapped:
>From typemedia.h:

/* Description of an abstract images of a document
view */
typedef struct _AbstractBox
  PtrElement      AbElement;    /* Corresponding
element in the I.R. */
  PtrBox          AbBox;        /* Box descriptor
index */
  PtrAbstractBox  AbEnclosing;  /* Linking towards the
enclosing asbstr. box */
  PtrAbstractBox  AbNext;       /* Linking towards the
next sibling abstract box */
  PtrAbstractBox  AbPrevious;   /* Linking towards the
previous abstract box */
  PtrAbstractBox  AbFirstEnclosed;    /* Linking
towards the first child
                                         abstract box
  PtrAbstractBox  AbNextRepeated;/* Linking towards
the next repeated
box (laid out??) */
  PtrAbstractBox  AbPreviousRepeated; /* Linking
towards the previous
abstract box */
  PtrPSchema      AbPSchema;    /* Presentation schema
of the abstract box */
  int             AbDocView;    /* Document view
number */
  PtrCopyDescr    AbCopyDescr;  /* Descriptor of the
copied element if the

>From picture.h:

typedef struct 
  int            PicXArea;
  int            PicYArea;
  int            PicWArea;
  int            PicHArea;
  int            PicWidth;
  int            PicHeight;
  PictureScaling PicPresent;
  int            PicType;
  CHAR_T*        PicFileName; 
  Pixmap         PicPixmap;
  int            PicNbColors;
  int           *PicColors;
  Pixmap         PicAlpha;
# ifndef _WINDOWS
  Pixmap         PicMask;
# else  /* _WINDOWS */
  int            bgRed;
  int            bgGreen;
  int            bgBlue;
# endif /* _WINDOWS */
  ThotBool       mapped;         /* Used for
ExtraHandlers */
  ThotBool       created;        /* Used for
ExtraHandlers */
  ThotWidget     wid;            /* Used for
ExtraHandlers */
  void*          pluginInstance; /* Used for
ExtraHandlers */
} PictInfo;

As you can see, they are very different structures. 

This sort of thing would have been caught from the
get-go, were it not for the typecast. 

I don't know anything about the Thot library or 
what the original author intended to do, but I do
that this demonstrates the danger of typecasts. :-)

Do You Yahoo!?
Send online invitations with Yahoo! Invites.
Received on Monday, 17 April 2000 06:27:52 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 7 January 2015 14:53:21 UTC