[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Octave-bug-tracker] [bug #52666] Segfault when closing a figure inside

From: Dan Sebald
Subject: [Octave-bug-tracker] [bug #52666] Segfault when closing a figure inside a "deletefcn" callback
Date: Thu, 14 Dec 2017 23:33:26 -0500 (EST)
User-agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0

Follow-up Comment #8, bug #52666 (project octave):

I've printed out a bit more:

diff --git a/libinterp/corefcn/graphics.cc b/libinterp/corefcn/graphics.cc
--- a/libinterp/corefcn/graphics.cc
+++ b/libinterp/corefcn/graphics.cc
@@ -2661,6 +2661,7 @@ gh_manager::do_free (const graphics_hand
       octave_value val = bp.get_deletefcn ();
+std::cerr << "Ex deletefcn: " << &bp << "\n";
       bp.execute_deletefcn ();
       // Notify graphics toolkit.
@@ -2798,9 +2799,11 @@ delete_graphics_object (const graphics_h
       graphics_object go = gh_manager::get_object (h);
+std::cerr << "Checking if is_beingdeleted " << h.value() << "\n";
       // Don't do recursive deleting, due to callbacks
       if (! go.get_properties ().is_beingdeleted ())
+std::cerr << "Passed check\n";
           graphics_handle parent_h = go.get_parent ();
           graphics_object parent_go = gh_manager::get_object (parent_h);

And I see:

octave:1> fcn = @(h) close (ancestor (h, "figure"));
octave:2> hl = line ("deletefcn", fcn)
hl = -6.3352
octave:3> gcf
ans =  1
octave:4> delete (hl)
Checking if is_beingdeleted -6.33522
Passed check
Ex deletefcn: 0x7f8b308aa790
Checking if is_beingdeleted 1
Passed check
Ex deletefcn: 0x7f8b308aa790
Ex deletefcn: 0x7f8b307ae360
Ex deletefcn: 0x7f8b30851990
Ex deletefcn: 0x7f8b30824980
Ex deletefcn: 0x7f8b3081ddc0
Ex deletefcn: 0x7f8b30811450
Ex deletefcn: 0x7f8b30771280
^C^CPress Control-C again to abort.
^Cfatal: caught signal Interrupt -- stopping myself...
attempting to save variables to 'octave-workspace'...
save to 'octave-workspace' complete
terminate called after throwing an instance of 'octave::exit_exception'

OK, I understand now.  In the above note that on the first pass, the handle is
-6.33522 which is the handle of the line deleted.  On the second pass, the
handle is the figure window 1.  Now take a look at this hunk of code:

static void
delete_graphics_object (const graphics_handle& h)
  if (h.ok ())
      graphics_object go = gh_manager::get_object (h);

std::cerr << "Checking if is_beingdeleted" << h.value() << "\n";
      // Don't do recursive deleting, due to callbacks
      if (! go.get_properties ().is_beingdeleted ())
std::cerr << "Passed check\n";

The test is on whether the g.o. associated with the handle passed into the
routine is being deleted, but on the second call (the one associated with the
close() of the line's callback function) the handle is 1, not -6.33522, and
the "beingdeleted" flag was not yet set for the g.o. associated with 1.  Hence
the double free because the figure doesn't realize the first item in its list
is in the process of being deleted.


Reply to this item at:


  Message sent via/by Savannah

reply via email to

[Prev in Thread] Current Thread [Next in Thread]