[Octave-bug-tracker] [bug #52666] Segfault when closing a figure inside a "deletefcn" callback

[Dan Sebald]

Follow-up Comment #8, bug #52666 (project octave):

I've printed out a bit more:


diff --git a/libinterp/corefcn/graphics.cc b/libinterp/corefcn/graphics.cc
--- a/libinterp/corefcn/graphics.cc
+++ b/libinterp/corefcn/graphics.cc
@@ -2661,6 +2661,7 @@ gh_manager::do_free (const graphics_hand
 
       octave_value val = bp.get_deletefcn ();
 
+std::cerr << "Ex deletefcn: " << &bp << "\n";
       bp.execute_deletefcn ();
 
       // Notify graphics toolkit.
@@ -2798,9 +2799,11 @@ delete_graphics_object (const graphics_h
     {
       graphics_object go = gh_manager::get_object (h);
 
+std::cerr << "Checking if is_beingdeleted " << h.value() << "\n";
       // Don't do recursive deleting, due to callbacks
       if (! go.get_properties ().is_beingdeleted ())
         {
+std::cerr << "Passed check\n";
           graphics_handle parent_h = go.get_parent ();
 
           graphics_object parent_go = gh_manager::get_object (parent_h);


And I see:


octave:1> fcn = @(h) close (ancestor (h, "figure"));
octave:2> hl = line ("deletefcn", fcn)
hl = -6.3352
octave:3> gcf
ans =  1
octave:4> delete (hl)
Checking if is_beingdeleted -6.33522
Passed check
Ex deletefcn: 0x7f8b308aa790
Checking if is_beingdeleted 1
Passed check
Ex deletefcn: 0x7f8b308aa790
Ex deletefcn: 0x7f8b307ae360
Ex deletefcn: 0x7f8b30851990
Ex deletefcn: 0x7f8b30824980
Ex deletefcn: 0x7f8b3081ddc0
Ex deletefcn: 0x7f8b30811450
Ex deletefcn: 0x7f8b30771280
^C^CPress Control-C again to abort.
^Cfatal: caught signal Interrupt -- stopping myself...
attempting to save variables to 'octave-workspace'...
save to 'octave-workspace' complete
terminate called after throwing an instance of 'octave::exit_exception'
Aborted


OK, I understand now.  In the above note that on the first pass, the handle is
-6.33522 which is the handle of the line deleted.  On the second pass, the
handle is the figure window 1.  Now take a look at this hunk of code:


static void
delete_graphics_object (const graphics_handle& h)
{
  if (h.ok ())
    {
      graphics_object go = gh_manager::get_object (h);

std::cerr << "Checking if is_beingdeleted" << h.value() << "\n";
      // Don't do recursive deleting, due to callbacks
      if (! go.get_properties ().is_beingdeleted ())
        {
std::cerr << "Passed check\n";


The test is on whether the g.o. associated with the handle passed into the
routine is being deleted, but on the second call (the one associated with the
close() of the line's callback function) the handle is 1, not -6.33522, and
the "beingdeleted" flag was not yet set for the g.o. associated with 1.  Hence
the double free because the figure doesn't realize the first item in its list
is in the process of being deleted.

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?52666>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/