Memory leak in CLucene - c++

I am using CLucene for creating indexing and searching. The index files created are of more than 5 GB. I have Created the seperate dll for CLucene search.
DLL constructor contains the following code
lucene::index::IndexReader ptrIndexReader;
lucene::search::IndexSearcher searcher; these are defined in class decalaration/
ptrIndexReader = IndexReader::open(pDir.c_str(),false,NULL);
searcher = new IndexSearcher(ptrIndexReader);
I use one search function whose code is as follows
bool LuceneWrapper::SearchIndex(wstring somevalue)
{
lucene::analysis::KeywordAnalyzer fAnalyzer;
Document doc = NULL;
Hits hits = NULL;
Query f_objQuery = NULL;
NistRecord *f_objRecords = NULL;
bool flag = false;
try{
if (ptrIndexReader == NULL)
{
return NULL;
}
// Initialize IndexSearcher
wstring strQuery = _T("+somename:") + somevalue;
// Initialize Query Parser, with Keyword Analyzer
QueryParser *parser = new QueryParser( _T(""),&fAnalyzer);
// Parse Query string
f_objQuery = parser->parse(strQuery.c_str());
// Search Index directory
hits = searcher->search(f_objQuery);
//searcher.
int intHitCount = 0;
intHitCount = hits->length;
if(intHitCount > 0)
{
if(doc!=NULL)
delete [] doc;
flag = true;
}
//searcher.close();
}
catch(CLuceneError& objExp)
{
if(doc!=NULL)
delete doc;
return false;
}
if(hits!=NULL)
delete hits;
if(f_objQuery!=NULL)
delete f_objQuery;
return flag ;
}
I am searching very large number of values. according to the record count the main memory goes high and high and at on level it goes near to 2 GB and application crashes. Can anybody tell me what is wrong with this? Why is memory going so high and application crashing?

You never deallocate parser.
I can't see a reason to allocate it dynamically.
Why don't you just say
QueryParser parser( _T(""), &fAnalyzer);
f_objQuery = parser.parse(strQuery.c_str());
You also need to make sure that you delete both f_objQuery and hits in the event of an exception.
std::unique_ptr can help you here, if you have access to it.
(And you don't have to test for NULL so much - it's OK to delete a null pointer.)

Related

Copy only necessary objects from PDF file

I've got a huge PDF file with more than 100 pages and I want to separate them to single PDF files (containing only one page each). Problem is, that PoDoFo does not copy just the page, but the whole document because of the references (and so each of the 100 PDF files have same size as the 100-page PDF). A relevant mailing list post can be found, unfortunately there is no solution provided.
In source code of function InsertPages there is explanation:
This function works a bit different than one might expect.
Rather than copying one page at a time - we copy the ENTIRE document
and then delete the pages we aren't interested in.
We do this because
1) SIGNIFICANTLY simplifies the process
2) Guarantees that shared objects aren't copied multiple times
3) offers MUCH faster performance for the common cases
HOWEVER: because PoDoFo doesn't currently do any sort of "object
garbage collection" during a Write() - we will end up with larger
documents, since the data from unused pages will also be in there.
I have tried few methods to copy only relevant objects, but each of them failed.
Copy all pages and remove irrelevant ones
Use XObject wrapping: FillXObjectFromDocumentPage and FillXObjectFromExistingPage
Copy object by object
Use RenumberObjects with bDoGarbageCollection = true
but none of them worked out. Does anybody have an idea or working solution for this problem?
The only solution is to use another PDF library. Or wait for garbage collection to be implemented.
The problem is stated in the quote you mentioned:
> during a Write() - we will end up with larger documents, since the
> data from unused pages will also be in there.
This means podofo always puts the entire PDF content in your file, no matter what. The whole PDF is there, you just don't see parts of it.
Dennis from the podofo support sent me an working example of optimized version of InsertPages function which is actually fixing page references and decreases document size significantly!
void PdfMemDocument::InsertPages2(const PdfMemDocument & rDoc, std::vector<int> pageNumbers)
{
std::unordered_set<PdfObject*> totalSet;
std::vector<pdf_objnum> oldObjNumPages;
std::unordered_map<pdf_objnum, pdf_objnum> oldObjNumToNewObjNum;
std::vector<PdfObject*> newPageObjects;
// Collect all dependencies from all pages that are to be copied
for (int i = 0; i < pageNumbers.size(); ++i) {
PdfPage* page = rDoc.GetPage(pageNumbers[i]);
if (page) {
oldObjNumPages.push_back(page->GetObject()->Reference().ObjectNumber());
std::unordered_set<PdfObject*> *set = page->GetPageDependencies();
totalSet.insert(set->begin(), set->end());
delete set;
}
}
// Create a new page object for every copied page from the old document
// Copy all objects the pages depend on to the new document
for (auto it = totalSet.begin(); it != totalSet.end(); ++it) {
unsigned int length = static_cast<unsigned int>(GetObjects().GetSize() + GetObjects().GetFreeObjects().size());
PdfReference ref(static_cast<unsigned int>(length+1), 0);
PdfObject* pObj = new PdfObject(ref, *(*it));
pObj->SetOwner(&(GetObjects()));
if ((*it)->HasStream()) {
PdfStream *stream = (*it)->GetStream();
pdf_long length;
char* buf;
stream->GetCopy(&buf, &length);
PdfMemoryInputStream inputStream(buf, length);
pObj->GetStream()->SetRawData(&inputStream, length);
free(buf);
}
oldObjNumToNewObjNum.insert(std::pair<pdf_objnum, pdf_objnum>((*it)->Reference().ObjectNumber(), length+1));
GetObjects().push_back(pObj);
newPageObjects.push_back(pObj);
}
// In all copied objects, fix the object numbers so they are valid in the new document
for (auto it = newPageObjects.begin(); it != newPageObjects.end(); ++it) {
FixPageReferences(GetObjects(), *it, oldObjNumToNewObjNum);
}
// Insert the copied pages into the pages tree
for (auto it = oldObjNumPages.begin(); it != oldObjNumPages.end(); ++it) {
PdfObject* pageObject = GetObjects().GetObject(PdfReference(oldObjNumToNewObjNum[(*it)], 0));
PdfPage *page = new PdfPage(pageObject, std::deque<PdfObject*>());
GetPagesTree()->InsertPage(GetPageCount() - 1, page);
}
}
std::unordered_set<PdfObject *>* PdfPage::GetPageDependencies() const
{
std::unordered_set<PdfObject *> *set = new std::unordered_set<PdfObject *>();
const PdfObject* pageObj = GetObject();
if (pageObj) {
PdfVecObjects* objects = pageObj->GetOwner();
if (objects) {
set->insert((PdfObject*)pageObj);
objects->GetObjectDependencies2(pageObj, *set);
}
}
return set;
}
// Optimized version of PdfVecObjects::GetObjectDependencies
void PdfVecObjects::GetObjectDependencies2(const PdfObject* pObj, std::unordered_set<PdfObject*> &refMap) const
{
// Check objects referenced from this object
if (pObj->IsReference())
{
PdfObject* referencedObject = GetObject(pObj->GetReference());
if (referencedObject != NULL && refMap.count(referencedObject) < 1) {
(refMap).insert((PdfObject *)referencedObject); // Insert referenced object
GetObjectDependencies2((const PdfObject*)referencedObject, refMap);
}
}
else {
// Recursion
if (pObj->IsArray())
{
PdfArray::const_iterator itArray = pObj->GetArray().begin();
while (itArray != pObj->GetArray().end())
{
GetObjectDependencies2(&(*itArray), refMap);
++itArray;
}
}
else if (pObj->IsDictionary())
{
TCIKeyMap itKeys = pObj->GetDictionary().GetKeys().begin();
while (itKeys != pObj->GetDictionary().GetKeys().end())
{
if ((*itKeys).first != PdfName("Parent")) {
GetObjectDependencies2((*itKeys).second, refMap);
}
++itKeys;
}
}
}
}
void FixPageReferences(PdfVecObjects& objects, PdfObject* pObject, std::unordered_map<pdf_objnum, pdf_objnum>& oldNumToNewNum) {
if( !pObject)
{
PODOFO_RAISE_ERROR( ePdfError_InvalidHandle );
}
if( pObject->IsDictionary() )
{
TKeyMap::iterator it = pObject->GetDictionary().GetKeys().begin();
while( it != pObject->GetDictionary().GetKeys().end() )
{
if ((*it).first != PdfName("Parent")) {
FixPageReferences(objects, (*it).second, oldNumToNewNum);
}
++it;
}
}
else if( pObject->IsArray() )
{
PdfArray::iterator it = pObject->GetArray().begin();
while( it != pObject->GetArray().end() )
{
FixPageReferences(objects, &(*it), oldNumToNewNum),
++it;
}
}
else if( pObject->IsReference() )
{
//PdfObject* referencedObj = objects.GetObject(pObject->GetReference());
pdf_objnum oldnum = pObject->GetReference().ObjectNumber();
pdf_objnum newnum = oldNumToNewNum[oldnum];
if (!newnum) throw new std::exception("No new object number for old object number");
*pObject = PdfReference(newnum, 0);
}
}

warning C6262: Function uses '27688' bytes of stack: exceeds /analyze:stacksize '16384'. Consider moving some data to heap

I have read a few questions and topics on this issue. For example:
Warning message regarding stack size
But I can't really work out how I am to isolate the issue in the method:
void CCreateReportDlg::ReadOptions()
{
CHeadingsDlg dlgHeadings(this);
COptionsDlg dlgOptions(this);
CBrothersDlg dlgBrothers(this, FALSE);
CAutoAssignSettingsDlg dlgAssign(this);
CString strSection = theApp.GetActiveScheduleSection(_T("Options"));
// headings
m_strReportTitle = dlgHeadings.GetReportTitle();
dlgHeadings.GetHeadings(m_aryStrHeading);
m_eReportMode = dlgOptions.GetReportMode();
// brother data
dlgBrothers.GetBrotherData(SOUND, m_aryStrSoundWT, m_aryStrSoundSM, TRUE);
dlgBrothers.GetBrotherData(PLATFORM, m_aryStrPlatformWT, m_aryStrPlatformSM, TRUE);
dlgBrothers.GetBrotherData(MIKE, m_aryStrMikeWT, m_aryStrMikeSM, TRUE);
dlgBrothers.GetBrotherData(ATTENDANT, m_aryStrAttendWT, m_aryStrAttendSM, TRUE);
dlgBrothers.GetBrotherData(SOUND, m_aryStrBroSoundAll, TRUE);
dlgBrothers.GetBrotherData(PLATFORM, m_aryStrBroPlatformAll, TRUE);
dlgBrothers.GetBrotherData(MIKE, m_aryStrBroMikeAll, TRUE);
dlgBrothers.GetBrotherData(ATTENDANT, m_aryStrBroAttendAll, TRUE);
CCustomAssignManagerDlg::GetCustomAssignData(m_aryPtrAssign, TRUE, ASSIGN_SORT_HEADING);
if(m_eReportMode != MODE_MEETING)
{
// We need to update the arrays to only include the brothers that are available
// on both days (so the two arrays become identical)
ModifyBrotherArrays();
}
dlgBrothers.GetBrotherData(m_cbBrother);
// We need an array of unique names
// (without first to entries in combo)
// Used during printing and exporting (multi highlight)
dlgBrothers.GetBrotherData(m_aryStrNames);
CBrothersDlg::SortArray(m_aryStrNames);
// options
m_bExcludePlatformColumn = dlgOptions.ExcludePlatformColumn();
m_bExcludePlatformMikeColumn = dlgOptions.ExcludePlatformMikeColumn();
m_bExcludeAttendColumn = dlgOptions.ExcludeAttendantColumn();
m_iNumMikeUsers = dlgOptions.GetNumMikeUsers();
m_iNumSoundUsers = dlgOptions.GetNumSoundUsers();
m_iNumAttendUsers = dlgOptions.GetNumAttendants();
dlgOptions.GetMeetingDays(m_iDayWT, m_iDaySM, m_iDayWeek);
m_iDayWT++;
m_iDaySM++;
m_iDayWeek++;
dlgOptions.GetCustomDateOptions(m_bCustomDate, m_strDateFormat);
m_bAvoidBack2Back = dlgAssign.AvoidBack2Back();
m_bCheckForConflicts = dlgAssign.CheckForConflicts();
m_bSelectNames = dlgAssign.SelectNames();
theApp.ReadDateMapData(m_mapSPtrBroDates);
m_bShowNotes = (BOOL)theApp.GetNumberSetting(strSection, _T("ShowNotes"), (int)TRUE);
m_bNoticeBoard = (BOOL)theApp.GetNumberSetting(strSection, _T("NoticeBoard"), (int)FALSE);
dlgOptions.ReadAssignStatesInfoEx(m_byAryAutoAssignStates);
}
I know I can adjust the compiler and increase the stacksize to supress the error.
But what is the basic approach to identifying the route cause in my method?
The first bunch of variables are CStringArray. Then it is followed by a CPtrArray of objects, of type CUSTOM_ASSIGN_S:
typedef struct tagCustomAssignment
{
int iIndex;
CString strDescription;
CString strHeading;
BOOL bExcluded;
CStringArray aryStrBrothersAll;
CStringArray aryStrBrothersWT;
CStringArray aryStrBrothersSM;
BOOL bIncludeWT;
BOOL bIncludeTMS;
BOOL bFixed;
int iFixedType;
} CUSTOM_ASSIGN_S;
Again, none of the members of the above structure are large arrays [xxx]. The only other notable method is ReadDateMapData that reads an archive and fills another map.
But as mentioned, I don't know how to go about isolating the issue. There are no large arrays being define. One or two TCHAR file[_MAXPATH]; but that is about it. The rest of classes like CStringArray or CPtrArray etc..
Thank you in advance.
Update
Based on the comments provided I was able to establish that even just the variable declarations at the top:
CHeadingsDlg dlgHeadings(this);
COptionsDlg dlgOptions(this);
CBrothersDlg dlgBrothers(this, FALSE);
CAutoAssignSettingsDlg dlgAssign(this);
CString strSection = theApp.GetActiveScheduleSection(_T("Options"));
Would cause it to have a stack size of 18072 to begin with.
My main variables in this class were actually dialog objects which understandably are quite large due to all the member variables etc..
The reason I was using these dialogues was to gain access to application settings by using their public methods.
By changing these dialogue declarations to new / delete and adjusting the code I no longer get the stack size warning:
void CCreateReportDlg::ReadOptions()
{
CHeadingsDlg *pDlgHeadings = new CHeadingsDlg(this);
if (pDlgHeadings != NULL)
{
m_strReportTitle = pDlgHeadings->GetReportTitle();
pDlgHeadings->GetHeadings(m_aryStrHeading);
delete pDlgHeadings;
}
COptionsDlg *pDlgOptions = new COptionsDlg(this);
if (pDlgOptions != NULL)
{
m_eReportMode = pDlgOptions->GetReportMode();
m_bExcludePlatformColumn = pDlgOptions->ExcludePlatformColumn();
m_bExcludePlatformMikeColumn = pDlgOptions->ExcludePlatformMikeColumn();
m_bExcludeAttendColumn = pDlgOptions->ExcludeAttendantColumn();
m_iNumMikeUsers = pDlgOptions->GetNumMikeUsers();
m_iNumSoundUsers = pDlgOptions->GetNumSoundUsers();
m_iNumAttendUsers = pDlgOptions->GetNumAttendants();
pDlgOptions->ReadAssignStatesInfoEx(m_byAryAutoAssignStates);
pDlgOptions->GetCustomDateOptions(m_bCustomDate, m_strDateFormat);
pDlgOptions->GetMeetingDays(m_iDayWT, m_iDaySM, m_iDayWeek);
m_iDayWT++;
m_iDaySM++;
m_iDayWeek++;
delete pDlgOptions;
}
CBrothersDlg *pDlgBrothers = new CBrothersDlg(this, FALSE);
if (pDlgBrothers != NULL)
{
pDlgBrothers->GetBrotherData(SOUND, m_aryStrSoundWT, m_aryStrSoundSM, TRUE);
pDlgBrothers->GetBrotherData(PLATFORM, m_aryStrPlatformWT, m_aryStrPlatformSM, TRUE);
pDlgBrothers->GetBrotherData(MIKE, m_aryStrMikeWT, m_aryStrMikeSM, TRUE);
pDlgBrothers->GetBrotherData(ATTENDANT, m_aryStrAttendWT, m_aryStrAttendSM, TRUE);
pDlgBrothers->GetBrotherData(SOUND, m_aryStrBroSoundAll, TRUE);
pDlgBrothers->GetBrotherData(PLATFORM, m_aryStrBroPlatformAll, TRUE);
pDlgBrothers->GetBrotherData(MIKE, m_aryStrBroMikeAll, TRUE);
pDlgBrothers->GetBrotherData(ATTENDANT, m_aryStrBroAttendAll, TRUE);
pDlgBrothers->GetBrotherData(m_cbBrother);
// We need an array of unique names (without first two entries in combo)
// Used during printing and exporting (multi highlight)
pDlgBrothers->GetBrotherData(m_aryStrNames);
CBrothersDlg::SortArray(m_aryStrNames);
delete pDlgBrothers;
}
CAutoAssignSettingsDlg *pDlgAssign = new CAutoAssignSettingsDlg(this);
if (pDlgAssign != NULL)
{
m_bAvoidBack2Back = pDlgAssign->AvoidBack2Back();
m_bCheckForConflicts = pDlgAssign->CheckForConflicts();
m_bSelectNames = pDlgAssign->SelectNames();
delete pDlgAssign;
}
CCustomAssignManagerDlg::GetCustomAssignData(m_aryPtrAssign, TRUE, ASSIGN_SORT_HEADING);
if(m_eReportMode != MODE_MEETING)
{
// We need to update the arrays to only include the brothers that are available
// on both days (so the two arrays become identical)
ModifyBrotherArrays();
}
theApp.ReadDateMapData(m_mapSPtrBroDates);
CString strSection = theApp.GetActiveScheduleSection(_T("Options"));
m_bShowNotes = (BOOL)theApp.GetNumberSetting(strSection, _T("ShowNotes"), (int)TRUE);
m_bNoticeBoard = (BOOL)theApp.GetNumberSetting(strSection, _T("NoticeBoard"), (int)FALSE);
}

Memory usage of C++ program grows, (shown in Debian's "top"), until it crashes

I'm working on a C++ program that should be able to run for several days, so it is a bit of a hassle that its memory consumption seems to grow really fast.
The full code of the program is a little long, so I'll post just the related things. The structure is the following:
int main (void){
//initialization of the global variables
error = 0;
state = 0;
cycle = 0;
exportcycle = 0;
status = 0;
counter_temp_ctrl = 0;
start = 0;
stop = 0;
inittimer();
mysql_del ("TempMeas");
mysql_del ("TempMeasHist");
mysql_del ("MyControl");
mysql_del ("MyStatus");
initmysql();
while(1){
statemachine();
pause();
}
}
The timer function that is initialized above is the following:
void catch_alarm (int sig)
{
//Set the statemachine to state 1 (reading in new values)
start = readmysql("MyStatus", "Start", 0);
stop = readmysql("MyStatus", "Stop", 0);
if (start == 1){
state = 1;
}
if (stop == 1){
state = 5;
}
//printf("Alarm event\n");
signal (sig, catch_alarm);
return void();
}
So basically, since I'm not setting the start bit in the webinterface that modifies the MyStatus Tab the program just calls the readmysql function twice every second (the timer's interval). The readmysql function is given below:
float readmysql(string table, string row, int lastvalue){
float readdata = 0;
// Initialize a connection to MySQL
MYSQL_RES *mysql_res;
MYSQL_ROW mysqlrow;
MYSQL *con = mysql_init(NULL);
if(con == NULL)
{
error_exit(con);
}
if (mysql_real_connect(con, "localhost", "user1", "user1", "TempDB", 0, NULL, 0) == NULL)
{
error_exit(con);
}
if (lastvalue == 1){
string qu = "Select "+ row +" from "+ table +" AS a where MeasTime=(select MAX(MeasTime) from "+ table;
error = mysql_query(con, qu.c_str());
}
else{
string qu = "Select "+ row +" from "+ table;
error = mysql_query(con, qu.c_str());
}
mysql_res = mysql_store_result(con);
while((mysqlrow = mysql_fetch_row(mysql_res)) != NULL)
{
readdata = atoi(mysqlrow[0]);
}
//cout << "readdata "+table+ " "+row+" = " << readdata << endl;
// Close the MySQL connection
mysql_close(con);
//delete mysql_res;
//delete mysqlrow;
return readdata;
}
I thought that the variables in this function are stored on the stack and are freed automaticaly when leaving the function. However it seems that some part of the memory is not freed, because it just grows after all. As you can see I have tried to use the delete function on two of the variables. Seems to have no effect. What am i doing wrong in terms of memory-management and so on?
Thanks for your help!
Greetings Oliver.
At least mysql_store_result is leaking. From documentation:
After invoking mysql_query() or mysql_real_query(), you must call mysql_store_result() or mysql_use_result() for every statement that successfully produces a result set (SELECT, SHOW, DESCRIBE, EXPLAIN, CHECK TABLE, and so forth). You must also call mysql_free_result() after you are done with the result set.
If your program continuously consumes memory (without ever releasing it), then you have a memory leak.
A good way to detect memory leaks, is to run it through a memory debugger, e.g. valgrind:
$ valgrind /path/to/my/program
Once your program started eating memory, stop it and valgrind will give you a nice summary about where your program allocated memory that was never freed.
There is no need to let the system run out of memory and crash; just wait until it has eaten some memory that has not been freed. Then fix your code. Then repeat until no more memory errors can be detected.
Also note that valgrind intercepts your systems memory management. This usually results in a (severe) performance penalty.

C++ Create std::list in function and return through arguments

How to correct return created std::list through function argument? Now, I try so:
bool DatabaseHandler::tags(std::list<Tag> *tags)
{
QString sql = "SELECT * FROM " + Tag::TABLE_NAME + ";";
QSqlQueryModel model;
model.setQuery(sql);
if(model.lastError().type() != QSqlError::NoError) {
log(sql);
tags = NULL;
return false;
}
const int count = model.rowCount();
if(count > 0)
tags = new std::list<Tag>(count);
else
tags = new std::list<Tag>();
//some code
return true;
}
After I can use it:
std::list<Tag> tags;
mDB->tags(&tags);
Now, I fix my function:
bool DatabaseHandler::tags(std::list<Tag> **tags)
{
QString sql = "SELECT * FROM " + Tag::TABLE_NAME + ";";
QSqlQueryModel model;
model.setQuery(sql);
if(model.lastError().type() != QSqlError::NoError) {
log(sql);
*tags = NULL;
return false;
}
const int count = model.rowCount();
if(count > 0)
*tags = new std::list<Tag>(count);
else
*tags = new std::list<Tag>();
for(int i = 0; i < count; ++i) {
auto record = model.record(i);
Tag tag(record.value(Table::KEY_ID).toInt());
(*tags)->push_back(tag);
}
return true;
}
It works but list return size 4 although loop executes only 2 iterations and empty child objects (if I just called their default constructor). The Tag class hasn't copy constructor.
Since you passed an already instantiated list as a pointer to the function, there is no need to create another list.
In that sense, you question is pretty unclear. I'd suggest you read up a bit on pointers, references and function calls in general.
http://www.cplusplus.com/doc/tutorial/pointers/
http://www.cplusplus.com/doc/tutorial/functions/
UPDATE: I still strongly suggest you read up on the mentioned topics, since you don't know these fundamental points.
Anyway, this is what you probably want to do (event though I would suggest using references, here is the solution with pointers):
bool someFunc(std::list<Tag> **tags) {
// by default null the output argument
*tags = nullptr;
if (error) {
return false;
}
// dereference tags and assign it the address to a new instance of list<Tag>
*tags = new std::list<Tag>();
return true
}
std::list<Tag> *yourList;
if (someFunc(&yourList)) {
// then yourList is valid
} else {
// then you had an error and yourList == nullptr
}
However, this is not idiomatic C++. Please read a modern book or tutorial.
Use a reference.
bool DatabaseHandler::tags(std::list<Tag>& tags);
std::list<Tag> tags;
mDB->tags(tags);
You'll have to change all the -> to ., of course. Every operation done on the reference in the function will be done to the original tags list it was called with.
EDIT: If you want to create the list inside the function and return it, you have a couple options. The closest, I think, is to just return a list pointer, and return nullptr if the function fails.
//beware, pseudocode ahead
std::list<Tag>* DatabaseHandler::tags() //return new list
{
if (success)
return new std::list<Tag>(...); //construct with whatever
else
return nullptr; //null pointer return, didn't work
}
std::list<Tag> tags* = mDB->tags();
You could alternatively have it return an empty list instead, depending on how you want it to work. Taking a reference to a pointer would work the same way, too.
bool DatabaseHandler::tags(std::list<Tag>*&); //return true/false
std::list<Tag>* tags;
mDB->tags(tags); //tags will be set to point to a list if it worked

mfc sdi application cdocument dosave error 0xFEEEFEEE

in my MFC SDI application, i'm trying to override CDocument::DoSave to save my document. I'm using a third part component (TxTextControl) to build a text control. When i save the document, the file is created, but after about one minute my app crashes rising read access error 0xFEEEFEEE, in ole32.dll.
This is my code, txtCtrl is my component:
BOOL CEditorTxDoc::DoSave(LPCTSTR lpszPathName, BOOL bReplace)
{
CString path, nome;
VARIANT vt1, vt2, vt3;
POSITION pos = GetFirstViewPosition();
CEditorTxView *pView = (CEditorTxView*)this->GetNextView(pos);
VariantInit(&vt1);
vt1.vt = VT_INT;
vt1.intVal = -1;
VariantInit(&vt2);
vt2.vt = VT_INT;
vt2.intVal = 3;
VariantInit(&vt3);
vt3.vt = VT_BOOL;
vt3.boolVal = FALSE;
if (lpszPathName == NULL) {
CFileDialog fSaveDlg(FALSE);
fSaveDlg.m_pOFN->lpstrFilter = _T("File Tx (*.tx)");
fSaveDlg.m_pOFN->lpstrDefExt = _T("tx");
fSaveDlg.m_pOFN->lpstrTitle = _T("Salva documento");
fSaveDlg.m_pOFN->lpstrInitialDir = _T("c:");
if(fSaveDlg.DoModal()==IDOK)
{
path = fSaveDlg.GetPathName();
nome = fSaveDlg.GetFileName();
pView->txtCtrl.Save(path, vt1, vt2, vt3);
SetTitle(nome);
SetModifiedFlag(FALSE);
SetPathName(path);
}
} else {
pView->txtCtrl.Save(GetPathName(), vt1, vt2, vt3);
SetModifiedFlag(FALSE);
}
return TRUE;
}
Magic debug values:
FEEEFEEE Used by Microsoft's HeapFree() to mark freed heap memory
That is, the problem comes up from the fact that the code deals with released memory as if it is still alive. To isolate the issue to specific code fragment, debug and use call stack information at the time of exception.