SegFault when opening some odt document

[JCavallo]

On PyPy 2.6.0, using both versions 3.4.4 and trunk (3.5.0.beta1), had the following backtrace :

#0 pypy_g_from_ref (l_ref_69=l_ref_69@entry=0x85) at pypy_module_cpyext_pyobject.c:74
#1 0x00007ffff5309bd8 in pypy_g_from_ref (l_ref_69=l_ref_69@entry=0x7fffe4cecea0) at pypy_module_cpyext_pyobject.c:93
#2 0x00007ffff527d879 in PyPyWeakref_LockObject (l_stararg0_342=0x7fffe4cecea0) at pypy_module_cpyext_api_3.c:10230
#3 0x00007fffddbbb671 in __pyx_f_4lxml_5etree__isProxyAliveInPypy.isra.106 () from /home/giovanni/Projets/python_envs/env_a/site-packages/lxml/etree.pypy-26.so
#4 0x00007fffddbbb75e in __pyx_f_4lxml_5etree_canDeallocateChildNodes () from /home/giovanni/Projets/python_envs/env_a/site-packages/lxml/etree.pypy-26.so
#5 0x00007fffddbbb8e3 in __pyx_f_4lxml_5etree_attemptDeallocation () from /home/giovanni/Projets/python_envs/env_a/site-packages/lxml/etree.pypy-26.so
#6 0x00007fffddbbba3e in __pyx_tp_dealloc_4lxml_5etree__Element () from /home/giovanni/Projets/python_envs/env_a/site-packages/lxml/etree.pypy-26.so
#7 0x00007ffff5fe3648 in pypy_asm_stackwalk () from /home/giovanni/Projets/python_envs/env_a/bin/libpypy-c.so
#8 0x00007ffff4afbef1 in pypy_g_cpy_call_external__funcPtr_PyObjectPtr (l_funcptr_2=<optimized out>, l_a0_8=<optimized out>) at implement.c:9712
#9 0x00007ffff52b80b0 in pypy_g_generic_cpy_call__StdObjSpaceConst_funcPtr_PyObj (l_func_1732=0x7fffddbbb9d0 <__pyx_tp_dealloc_4lxml_5etree__Element>, l_v902920=0x7fffe7880530) at pypy_module_cpyext_api_4.c:38726
........

Full backtrace is very long, since the crash happens using the trytond[1] server, using genshi[2] and relatorio[3] to generate a document.

It is reproductible, though the python line which causes the error varies. It may be because the problem is related to garbage collection, according to frames #4/#5

It happened with several odt documents, sometimes even empty documents.

Update : Can be reproduced by just running the tests on relatorio[3]

[1] http://www.tryton.org/
[2] http://genshi.edgewall.org/
[3] http://relatorio.tryton.org/

Python : (major=2, minor=7, micro=9, releaselevel='final', serial=42)
lxml.etree : (3, 5, 0, -99)
libxml used : (2, 9, 2)
libxml compiled : (2, 9, 2)
libxslt used : (1, 1, 28)
libxslt compiled : (1, 1, 28)

Linux Gaia 3.19.0-21-generic #21-Ubuntu SMP Sun Jun 14 18:31:11 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

Note : I am posting here because the first frames seem to indicate that the crash happens in lxml related code, but this is juste an assumption.

[scoder (scoder)]

Closing as outdated.