[Octave-bug-tracker] [bug #52666] Segfault when closing a figure inside a "deletefcn" callback

[Rik]

Follow-up Comment #4, bug #52666 (project octave):

When running with a version with ASAN enabled, I get


==26167==ERROR: AddressSanitizer: heap-use-after-free on address
0x6060011d2868 at pc 0x7f6e29d5ccf3 bp 0x7fff78bdec60 sp 0x7fff78bdec50
READ of size 8 at 0x6060011d2868 thread T0
    #0 0x7f6e29d5ccf2 in std::__shared_ptr<base_graphics_object,
(__gnu_cxx::_Lock_policy)2>::operator->() const
/usr/include/c++/5/bits/shared_ptr_base.h:1055
    #1 0x7f6e29f04bad in graphics_object::finalize()
libinterp/corefcn/graphics.h:3073
    #2 0x7f6e29d848d3 in gh_manager::do_free(octave_handle const&)
libinterp/corefcn/graphics.cc:2667
    #3 0x7f6e29f3fca8 in gh_manager::free(octave_handle const&)
libinterp/corefcn/graphics.h:12922
    #4 0x7f6e29d85bcc in delete_graphics_object
libinterp/corefcn/graphics.cc:2812
    #5 0x7f6e29d85d5b in delete_graphics_object
libinterp/corefcn/graphics.cc:2826
    #6 0x7f6e29d85e7e in delete_graphics_objects
libinterp/corefcn/graphics.cc:2841
    #7 0x7f6e29eea704 in F__go_delete__(octave_value_list const&, int)
libinterp/corefcn/graphics.cc:11449


Just glancing through the code, there are several comments about avoiding
problems just like this one where the child or parent graphics object has
already been destroyed.  Obviously, it isn't perfect, but extreme care was
taken in coding this up.



    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?52666>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/